{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.aidatahub.io/api/security-advisories.schema.json",
  "title": "AIDataHub AI Security Advisories v1",
  "description": "Public advisory history for the AI ecosystem. See https://www.aidatahub.io/docs/security-advisories. Unknown additive fields must be tolerated.",
  "type": "object",
  "required": ["schemaVersion", "generatedAt", "initializedAt", "pollIntervalSeconds", "coverage", "sources", "events"],
  "additionalProperties": true,
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "initializedAt": { "type": "string", "format": "date-time" },
    "pollIntervalSeconds": { "type": "integer", "minimum": 1 },
    "coverage": { "type": "string" },
    "links": { "type": "object", "additionalProperties": { "type": "string", "format": "uri" } },
    "sources": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["id", "name", "kind", "url", "lastAttemptAt", "status", "lastSuccessAt", "error", "recognized"],
        "additionalProperties": true,
        "properties": {
          "id": { "type": "string", "description": "ghsa and cisa-kev are required sources; other ids are supplementary incident sources." },
          "name": { "type": "string" },
          "kind": { "enum": ["advisory-database", "exploited-catalog", "vendor-notice", "security-research", "malicious-packages"] },
          "required": { "type": "boolean", "description": "false for supplementary sources whose outage degrades, but does not fail, a scan." },
          "url": { "type": "string", "format": "uri" },
          "lastAttemptAt": { "type": "string", "format": "date-time" },
          "baselineAt": { "type": "string", "format": "date-time" },
          "status": { "enum": ["ok", "error"] },
          "lastSuccessAt": { "anyOf": [{ "type": "string", "format": "date-time" }, { "type": "null" }] },
          "error": { "type": ["string", "null"] },
          "recognized": { "type": "integer", "minimum": 0 }
        }
      }
    },
    "events": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["id", "type", "advisoryId", "cveId", "title", "summary", "severity", "cvssScore", "cvssVector", "epssPercentile", "cwes", "affected", "matchedTerms", "disclosedAt", "sourceUpdatedAt", "exploitation", "sourceId", "sourceUrl", "references", "evidence", "firstSeenAt", "publishedAt", "updatedAt", "revision", "baseline"],
        "additionalProperties": true,
        "properties": {
          "id": { "type": "string", "description": "Stable: ghsa:<GHSA id>, kev:<CVE id>, osv:<MAL id>, or incident:<CVE id | hash of the first report URL>." },
          "type": { "enum": ["advisory", "exploited", "incident"] },
          "advisoryId": { "type": "string" },
          "cveId": { "type": ["string", "null"] },
          "title": { "type": "string" },
          "summary": { "type": "string", "description": "Templated from structured fields; never free text from the source." },
          "severity": { "enum": ["critical", "high", "medium", "low", "unknown"] },
          "cvssScore": { "type": ["number", "null"] },
          "cvssVector": { "type": ["string", "null"] },
          "epssPercentile": { "type": ["number", "null"] },
          "cwes": { "type": "array", "items": { "type": "string" } },
          "affected": {
            "type": "array",
            "items": {
              "type": "object",
              "required": ["ecosystem", "name"],
              "additionalProperties": true,
              "properties": {
                "ecosystem": { "type": "string" },
                "name": { "type": "string" },
                "vendor": { "type": "string" },
                "vulnerableVersionRange": { "type": ["string", "null"] },
                "firstPatchedVersion": { "type": ["string", "null"] }
              }
            }
          },
          "matchedTerms": { "type": "array", "items": { "type": "string" } },
          "signals": { "type": "array", "items": { "type": "string" }, "description": "Incidents only: the security vocabulary that qualified the report." },
          "disclosedAt": { "type": "string", "format": "date", "description": "GHSA publication date, CISA KEV date added, report publication date, or OSV record modification date (UTC)." },
          "sourceUpdatedAt": { "type": ["string", "null"] },
          "exploitation": {
            "anyOf": [
              { "type": "null" },
              {
                "type": "object",
                "required": ["dateAdded", "dueDate", "requiredAction", "knownRansomwareCampaignUse"],
                "properties": {
                  "dateAdded": { "type": "string", "format": "date" },
                  "dueDate": { "type": ["string", "null"] },
                  "requiredAction": { "type": "string" },
                  "knownRansomwareCampaignUse": { "type": "boolean" }
                }
              }
            ]
          },
          "sourceId": { "type": "string" },
          "sourceUrl": { "type": "string", "format": "uri" },
          "references": { "type": "array", "items": { "type": "string", "format": "uri" } },
          "evidence": { "type": "string" },
          "firstSeenAt": { "type": "string", "format": "date-time" },
          "publishedAt": { "type": "string", "format": "date-time", "description": "When the collector first published the event. Use for arrival order." },
          "updatedAt": { "type": "string", "format": "date-time" },
          "revision": { "type": "integer", "minimum": 1 },
          "baseline": { "type": "boolean", "description": "Historical import; never an alert." }
        }
      }
    }
  }
}