I have a process that uses the NVD API to pull down vulnerability data. It has worked fine for years.

Suddenly, I get periodic errors in the log, e.g. :

Downloaded 6000 CVEs.
Process finished at 2024-07-02 11:02:55
Total duration: 173.34 seconds
Downloaded 8000 CVEs.
Error: Invalid API key
Process finished at 2024-07-02 15:01:10
Total duration: 0.30 seconds
Downloaded 0 CVEs.
Process finished at 2024-07-02 17:00:37
Total duration: 1.92 seconds
Downloaded 0 CVEs.
Error: Invalid API key

I tested the issue with this code here:

import requests
import logging
import time

# Configure logging
logging.basicConfig(filename='/<dir>/api_key_check.log', level=logging.INFO, format='%(asctime)s:%(levelname)s:%(message)s')

def is_valid_api_key(apiKey, retries=3, delay=5, timeout=10):
    test_url = 'https://services.nvd.nist.gov/rest/json/cves/2.0'
    test_params = {'startIndex': 0, 'resultsPerPage': 1}
    headers = {'apiKey': apiKey}

    for attempt in range(retries):
        try:
            logging.info(f"Attempt {attempt + 1} to check API key.")
            test_response = requests.get(test_url, params=test_params, headers=headers, timeout=timeout)
            if test_response.status_code == 200:
                logging.info("API key is valid.")
                return True
            elif test_response.status_code == 403:
                logging.error("Forbidden: The API key might be invalid or rate-limited.")
                return False
            else:
                logging.error(f"Unexpected status code {test_response.status_code} on attempt {attempt + 1}")
        except requests.Timeout:
            logging.error(f"Request timed out on attempt {attempt + 1}")
        except requests.RequestException as e:
            logging.error(f"Request failed on attempt {attempt + 1}: {e}")
        time.sleep(delay)

    logging.error("API key validation failed after multiple attempts.")
    return False

# Replace 'your_api_key_here' with your actual API key
apiKey = 'your_api_key_here'
if is_valid_api_key(apiKey):
    print("API key is valid.")
else:
    print("Error: Invalid API key.")

I run that and I get:

Error: Invalid API key.

NIST and the NVD people are not great at responding. This has been broken for 4 days.

They have this on their chat group:

https://groups.google.com/a/list.nist.gov/g/nvd-news

Has anyone experienced this issue, or have any guidance?