Microsoft Security Response Center (MSRC) API

Beginner's Pick Security / No Auth Required Beginner HTTPS
Free to Use Varies (check documentation)
82 A
Measured Score 0 50 100 Reachability 30/30 Speed 10/20 Security 15/15 Developer XP 12/20 Reliability 15/15 TESTED 2026-07-23

Overview

The Microsoft Security Response Center (MSRC) API provides programmatic access to Microsoft's security update data, including CVEs, advisories, and patch information. It is free to use without authentication and is ideal for organizations that need to track Microsoft vulnerabilities for patch management or compliance. The data is published in CVRF (Common Vulnerability Reporting Framework) format.

Beginner Tip

No API key is required — you can start querying immediately. Use the /Updates endpoint to list all available security updates, then fetch a specific update by its ID (formatted as YYYY-MMM, e.g., 2024-Jan) to get full CVE details.

Available Data

Microsoft Security Response Center (MSRC) data via REST API

Example Response

JSON Response
{
  "url": "https://example.com",
  "safe": true,
  "threat_level": "none",
  "categories": [
    "clean"
  ],
  "scan_date": "2025-01-15T10:00:00Z"
}

Field Reference

DocumentTitle.Value Title of the security update document (e.g., "January 2024 Security Updates").
Vulnerability Array of CVE entries included in this security update.
Vulnerability[].CVE CVE identifier for the vulnerability (e.g., CVE-2024-12345).
Vulnerability[].Threats Threat assessment entries including severity and impact type.
Vulnerability[].Remediations Patch and workaround information including KB article numbers.

Implementation Example

Request
const url = "https://msrc.microsoft.com/report/developer";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

404 Not Found The update ID format is incorrect or that month has no security updates.
Use the exact format YYYY-Mmm (e.g., 2024-Jan) — the month must be a 3-letter abbreviation with the first letter capitalized.
XML returned instead of JSON The Accept header defaults to application/xml if not specified.
Always include -H "Accept: application/json" in your request to receive JSON-formatted responses.
Large response payload Monthly update files contain hundreds of CVEs and can be several megabytes.
Filter the response client-side by CVE ID or product name, or use targeted endpoints for specific vulnerability lookups.

Measured Score Breakdown

Live HTTP request to the API endpoint

Reachability 30/30
Speed 10/20
Security 15/15
Developer XP 12/20
Reliability 15/15
Endpoint Response Time 667ms

Fully tested on Jul 23, 2026

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS UNKNOWN
Category Security
Difficulty Beginner
Verified: 2026-04-04

Related Tags

Similar APIs

View All →