Microsoft Security Response Center API

Free Microsoft Security Response Center API with no key: monthly security update summaries and full CVRF documents with CVEs, affected products, KB articles and severities.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the Microsoft Security Response Center API?

The MSRC Security Updates API is a free, key-free OData service listing Microsoft's monthly security update releases and serving each one as a full CVRF document containing every CVE addressed, the affected products, the KB articles that fix them and the severity ratings.

Microsoft publishes security fixes on a monthly cadence, and this API is the machine-readable form of Patch Tuesday. The `/updates` endpoint lists every release since 1999 by month identifier such as `2026-Feb`, and each entry carries a `CvrfUrl` pointing at the complete Common Vulnerability Reporting Framework document for that month — typically a hundred-plus vulnerabilities with product-by-product remediation detail.

Two practical notes. First, the API is CORS-hostile in an unusual way: sending an `Origin` header returns HTTP 200 with a zero-byte body rather than an error, so browser code appears to succeed while receiving nothing. Call it from a server. Second, the CVRF documents are large and structured around product trees, where the same CVE appears once per affected product build — that is what makes them precise for patch matching and awkward to read. Recent releases also include Azure Linux and Mariner package updates alongside Windows, so filter by product family unless you want everything Microsoft ships.

Quick facts

Base URL: https://api.msrc.microsoft.com/cvrf/v3.0
Authentication: No API key or account for the CVRF v3.0 endpoints. Microsoft publishes this data for customers and security tooling; the terms of the Microsoft Security Update Guide apply.
Rate limit: No published limit. Documents are large and change monthly, so fetch on release and cache.
Pricing: Free, with no registration.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the Microsoft Security Response Center API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. List every Microsoft security update release

GET https://api.msrc.microsoft.com/cvrf/v3.0/updates

curl

curl 'https://api.msrc.microsoft.com/cvrf/v3.0/updates' \
  -H 'Accept: application/json'

JavaScript (fetch)

const res = await fetch("https://api.msrc.microsoft.com/cvrf/v3.0/updates", {
  headers: {
    "Accept": "application/json",
  },
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Accept": "application/json",
}

res = requests.get("https://api.msrc.microsoft.com/cvrf/v3.0/updates", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "@odata.context": "https://api.msrc.microsoft.com/$metadata#Updates",
  "value": [
    {
      "ID": "1999-Sep",
      "Alias": "1999-Sep",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "1999-09-02T00:00:00Z",
      "CurrentReleaseDate": "2025-10-01T23:10:48Z",
      "CvrfUrl": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/1999-Sep"
    },
    {
      "ID": "2000-Feb",
      "Alias": "2000-Feb",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "2000-02-02T00:00:00Z",
      "CurrentReleaseDate": "2026-02-19T01:07:19Z",
      "CvrfUrl": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2000-Feb"
    },
    {
      "ID": "2000-Jan",
      "Alias": "2000-Jan",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "2000-01-02T00:00:00Z",
      "CurrentReleaseDate": "2026-02-18T01:04:13Z",
      "CvrfUrl": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2000-Jan"
    },
    {
      "ID": "2000-Oct",
      "Alias": "2000-Oct",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "2000-10-02T00:00:00Z",
      "CurrentReleaseDate": "2025-10-01T23:10:10Z",
      "CvrfUrl": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2000-Oct"
    },
    {
      "ID": "2001-May",
      "Alias": "2001-May",
      "DocumentTitle": "Mariner Release Notes",
      "Severity": null,
      "InitialReleaseDate": "2001-05-02T00:00:00Z",
      "CurrentReleaseDate": "2020-09-25T00:00:00Z",
      "CvrfUrl": "https:

Parameters

Parameter	Type	Required	Description
`(endpoint) /updates`	path	Optional	All security update releases, oldest first, each with a CVRF document URL. `/cvrf/v3.0/updates`
`(endpoint) /cvrf/{id}`	path	Optional	The full CVRF document for one monthly release. `/cvrf/v3.0/cvrf/2026-Feb`
`id`	path segment	Optional	Release identifier in `YYYY-Mon` form, as returned by the updates listing. `2026-Feb`
`$filter`	query	Optional	OData filter over the updates collection, for example by release date. `InitialReleaseDate gt 2026-01-01`
`(Accept header)`	header	Optional	`application/json` for JSON; the endpoint also serves the native CVRF XML. `application/json`

Response fields

@odata.contextstring: OData metadata URL, confirming the response shape.
value[]array: The releases. OData wraps collections in `value` rather than returning a bare array.
value[].ID / Aliasstring: Release identifier such as `2026-Feb`. Both fields carry the same value in practice.
value[].DocumentTitlestring: Human-readable release title, for example `Mariner Release Notes` or a Patch Tuesday title.
value[].InitialReleaseDate / CurrentReleaseDatestring: When the release first shipped and when it was last revised. Old releases are still amended.
value[].CvrfUrlstring: URL of the full CVRF document with every CVE, product and KB article for that release.

What you can build with the Microsoft Security Response Center API

Track Patch Tuesday releases programmatically
Extract every CVE fixed in a given month with its severity
Map a KB article to the vulnerabilities it addresses
Build a Windows patch compliance report
Correlate Microsoft advisories with your asset inventory

Common errors and how to fix them

200 with an empty body

The request carried an `Origin` header.

Fix: MSRC returns a zero-byte body to any cross-origin request. Call the API from a server, never from browser JavaScript.

Very large CVRF documents

A month's release covers many products and builds.

Fix: Stream and filter rather than loading whole documents into memory, and narrow to the product families you care about.

Same CVE appearing many times

CVRF is organised by product tree.

Fix: Each affected product build gets its own entry. Deduplicate on CVE ID if you want one row per vulnerability.

404 on a release id

The identifier format is `YYYY-Mon` with a three-letter month.

Fix: Take ids from the `/updates` listing rather than constructing them; abbreviation style is not always what you would guess.

Microsoft Security Response Center API — frequently asked questions

Is the Microsoft MSRC API free?

Yes, the CVRF v3.0 read endpoints are free with no key or registration. Microsoft publishes them for customers and security tooling under the Security Update Guide's terms.

Why do I get an empty response in the browser?

Because MSRC answers requests carrying an `Origin` header with HTTP 200 and no body at all. It looks like a successful empty result rather than a CORS error, which makes it hard to diagnose. Call the API server-side.

What is CVRF?

The Common Vulnerability Reporting Framework, an industry standard for machine-readable security advisories. It structures an advisory around a product tree so each vulnerability is tied precisely to the builds it affects and the update that fixes it.

Does this cover more than Windows?

Yes. Recent releases include Azure Linux and Mariner package updates, Microsoft Edge, Office and cloud services alongside Windows. Filter by product family in the CVRF product tree if you only want part of it.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

XML to JSON Converter

Convert XML to JSON online. Elements become objects, attributes are prefixed with @, text is preserved, and parse errors are reported clearly — in-browser.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

Microsoft Security Response Center is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.