shipapis
StarSubmit an APISubmit API

Microsoft Security Response Center (MSRC)

Microsoft's security update documents, as CVRF JSON

🔐 SecurityHEALTHYchecked 12h ago
AUTH NONECORS ✗AGENT ✓HTTPS ✓COMMERCIAL ?

The Microsoft Security Response Center API publishes machine-readable security update summaries in the CVRF format. The updates endpoint lists every monthly release with titles, dates, and links to the full vulnerability documents. No key needed — but it quietly returns an empty body unless your client sends a browser-like User-Agent.

92HOW IT'S SCORED ⓘ
Docs ↗
Status badge · for your READMEshipapis health badge: 92 · healthy
Uptime history
100%90 days
100%30 days
538P50 · ms
1107P95 · ms
operationalpartialdownno data
Response time · last 48 checks
Fastest 121 ms, slowest 980 ms, most recent 130 ms.
Live response samplecaptured by our last successful check
GET https://api.msrc.microsoft.com/cvrf/v3.0/updates

{
  "@odata.context": "https://api.msrc.microsoft.com/$metadata#Updates",
  "value": [
    {
      "ID": "1999-Sep",
      "Alias": "1999-Sep",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "1999-09-02T00:00:00Z",
      "CurrentReleaseDate": "2025-10-01T23:10:48Z",
      "CvrfUrl": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/1999-Sep"
    }
  ]
}
Call itcurl · fetch · python
curl "https://api.msrc.microsoft.com/cvrf/v3.0/updates"
const res = await fetch("https://api.msrc.microsoft.com/cvrf/v3.0/updates");
const data = await res.json();
console.log(data);
import requests

res = requests.get("https://api.msrc.microsoft.com/cvrf/v3.0/updates")
print(res.json())

BROWSER CALLS BLOCKED (NO CORS/HTTPS) — USE THE CURL SNIPPET

Endpoints · 5HealthyFULL DOCS ↗
Monitored path responding — GET /cvrf/v3.0/updates538 mschecked 12h ago
GET/cvrf/v3.0/updatesPROBED

Microsoft's security update documents, as CVRF JSON

GET/cvrf

Cvrf — documented GET route.

GET/cvrf/1

Cvrf details by ID (example: 1).

GET/cvrf?limit=10

Cvrf — documented GET route.

GET/cvrf/search?q=test

Search by query parameters.

Machine-readable spec

We probe a documented GET and expect 2xx JSON — full uptime and health score. Export includes every documented route below.

Response-shape history

Stable. No schema drift observed since monitoring began — the response shape has not changed under our checks.

Microsoft Security Response Center (MSRC): common questions

Is Microsoft Security Response Center (MSRC) free to use?

Yes — Microsoft Security Response Center (MSRC) is a free security API. Free tier: Free — no key required. Whether the free tier allows commercial use is unclear — check the provider docs.

Does Microsoft Security Response Center (MSRC) need an API key?

No — Microsoft Security Response Center (MSRC) needs no API key or signup. You can call it straight away; rate limits still apply (Unpublished).

Can I call Microsoft Security Response Center (MSRC) from the browser?

Not directly — Microsoft Security Response Center (MSRC) doesn't send browser-friendly CORS headers, so call it from a server or proxy instead. Copy the curl or Python snippet on this page to get started.

Is Microsoft Security Response Center (MSRC) up right now?

As of our last scheduled check, Microsoft Security Response Center (MSRC) is healthy with 100% uptime over 90 days and a 538 ms median response. We re-probe it every sweep — the status badge and uptime chart above always show the latest.