owui-tools/docs/setup/nvd.md

OWUITOOLS_NVD_KEY — lifts the rate limit on lookup_cve

Ten minutes, most of it waiting for an email. Free. Optional, and it matters less than the other two.

Why

lookup_cve asks CIRCL first, MITRE second, and only goes to NVD for CVSS scoring and CPE detail. CIRCL has no hard limit, so most lookups never touch NVD at all. Keyless NVD is documented at 5 requests per 30 seconds, which is only a problem if you lean on the score breakdown.

Steps

1. Go to https://nvd.nist.gov/developers/request-an-api-key.

2. Fill in the form. The key arrives by email, usually within minutes.

3. Put it in configs/owuitools.env:

   OWUITOOLS_NVD_KEY=...
   

4. docker compose up -d api

Checking it

./tests/try-tool.sh lookup_cve '{"cve_id": "CVE-2014-0160"}' | head -10

You should see a CVSS vector. Without a key you still get the description and references.