# `OWUITOOLS_NVD_KEY` — lifts the rate limit on `lookup_cve`

Ten minutes, most of it waiting for an email. Free. **Optional**, and it matters less than
the other two.

## Why

`lookup_cve` asks CIRCL first, MITRE second, and only goes to NVD for CVSS scoring and CPE
detail. CIRCL has no hard limit, so most lookups never touch NVD at all. Keyless NVD is
documented at **5 requests per 30 seconds**, which is only a problem if you lean on the
score breakdown.

## Steps

1. Go to <https://nvd.nist.gov/developers/request-an-api-key>.
2. Fill in the form. The key arrives by email, usually within minutes.
3. Put it in `configs/owuitools.env`:

   ```
   OWUITOOLS_NVD_KEY=...
   ```

4. `docker compose up -d api`

## Checking it

```sh
./tests/try-tool.sh lookup_cve '{"cve_id": "CVE-2014-0160"}' | head -10
```

You should see a CVSS vector. Without a key you still get the description and references.