API

Software end-of-life API: versions, EOL dates and vulnerabilities

One catalog of software versions, end-of-life dates and known vulnerabilities, with an inventory checker.

What it does

The Software Catalog API lists products and their release cycles, with support status, end-of-life dates, latest versions and linked CVEs. Search by name (typos and aliases work), filter by vendor, kind, OS or lifecycle state, and read a timeline for any product.
Its key call is the inventory check. Send up to 200 items such as "Microsoft Office 2016" or "macOS 14.5" and get back, for each one, the matched release, its status (active, security, extended, eol, unknown, version_not_in_catalog or not_found), the EOL date, whether a newer version exists, and vulnerability counts including CISA KEV.
It solves the spreadsheet chore of tracking what is about to go out of support. Ask which releases reach EOL in the next 90 days, or what changed since last week.
Know the limits. The catalog is built by syncing public sources. Some source parsers read web pages and can break when a page changes, and vulnerability links are thin until the CVE database has finished loading. An unmatched name returns not_found or an ambiguous flag with alternatives rather than a guess.
Affordable by design. Start free* within platform limits for connected ShadowCradle organizations, with affordable pricing beyond that. *Free within platform limits; usage beyond limits may be charged to maintain the platform.

See how it works

From a software list to a traffic light

Send names and versions; each one comes back matched to a release with its status, EOL date, newer versions and vulnerability counts. Names that do not match return not_found rather than a guess. Products shown are placeholders.

Example use cases

EOL report for a client

An MSP exports a client's installed software, posts it to /check, and builds a list of anything at EOL or ending soon.

Patch priority by exploitation

Security teams pull a product's vulnerabilities with kev=true or a minimum EPSS score to patch what is exploited first.

Upgrade planning

Ops teams read /lifecycle for a runtime or database to time an upgrade before support ends.

Lifecycle badges in your product

Product teams show "supported until" next to a customer's detected versions.

Watch the feed of changes

Poll /changes for new releases and moved EOL dates, and alert the owner of each affected system.

From CVE to affected software

Start with a CVE id and list the catalog products and cycles it touches.

Try it

Check an inventory

curl -s -X POST "https://app.takelan.com/api/v1/software/check" \
  -H "X-API-Key: $TAKELAN_API_KEY" -H "Content-Type: application/json" \
  -d '{"items":[{"name":"Example Server","version":"2.4.1","os":"linux"},{"name":"Sample DB","version":"9"}]}'

Response (trimmed, fictional): { "count": 2, "results": [{ "status": "eol", "match": { "confidence": 0.93, "ambiguous": false }, ... }, ...] }. Up to 200 items per call. Results are cached by normalized name, version and OS; nothing from your request is stored or shared.

Releases reaching end of life soon

curl -s "https://app.takelan.com/api/v1/software/eol?within_days=90&kind=database&limit=25" \
  -H "X-API-Key: $TAKELAN_API_KEY"

Endpoints

GET /api/v1/software Find: search with filters (q, vendor, kind, os, eol, has_vulns, has_kev, sort, paging up to 200).
GET /api/v1/software/suggest Find: typeahead suggestions.
GET /api/v1/software/match Find: multi-term matcher (?term=office&term=2016).
POST /api/v1/software/match Find: same as a JSON body.
POST /api/v1/software/check Inventory: check up to 200 items for status, EOL and vulnerabilities.
GET /api/v1/software/eol Lifecycle: releases whose EOL falls in a window.
GET /api/v1/software/{slug} Product: details.
GET /api/v1/software/{slug}/versions Product: release versions.
GET /api/v1/software/{slug}/versions/{version} Product: one version.
GET /api/v1/software/{slug}/lifecycle Product: timeline bars and dated events per cycle.
GET /api/v1/software/{slug}/known-versions Product: version strings seen.
GET /api/v1/software/{slug}/similar Product: related products with reasons.
GET /api/v1/software/{slug}/changes Changes: history for one product.
GET /api/v1/software/changes Changes: what the sync changed (new releases, EOL moves).
GET /api/v1/software/{slug}/vulnerabilities Vulnerabilities: CVEs for a product with KEV, EPSS, fixed-in and severity filters.
GET /api/v1/software/{slug}/vulnerabilities/summary Vulnerabilities: counts by severity, cycle, year, and a 24-month trend.
GET /api/v1/software/by-cve/{cve_id} Vulnerabilities: products and cycles a CVE affects.
GET /api/v1/software/vulnerabilities/top Vulnerabilities: top products by exposure.
GET /api/v1/software/categories Reference: categories (also /kinds and /platforms).
GET /api/v1/software/stats Reference: catalog size and completeness.

MCP

Available as tools through /mcp/utils. Read tools work by default with an API key. Anything that writes is off until your tenant turns on the writes switch, and a read-only key never writes. Calls run with your own permissions. About 44 routes make up this family, including admin curation (sync, merge, CPE rules, products). Curation writes are excluded from MCP; sync and rebuild calls need writes on. About MCP

Common questions

How do I check if software is end of life with an API?

POST your inventory to /api/v1/software/check, or read /api/v1/software/{slug}/lifecycle for one product. Status is active, security, extended, eol, unknown, version_not_in_catalog or not_found.

Is there an API for software end-of-life dates?

Yes. The catalog holds EOL and support dates per release cycle, built from public sources and synced on a schedule.

How do I find software that goes end of life in the next 90 days?

GET /api/v1/software/eol?within_days=90. Add past_days to include recently ended releases.

Can I check a whole installed-software list in one call?

Yes, up to 200 items. Names like "Microsoft Windows 10 Pro 10.0.19045" resolve to the matching release.

How are vulnerabilities linked to software?

By CPE matching with version ranges against the local CVE database, with CISA KEV and EPSS added. Links fill in as the CVE database load completes.

What if my software name is not matched?

You get not_found, or a match with ambiguous true and up to three alternatives. It does not guess.

How current is the catalog?

It follows sync runs from public sources. /stats and /changes show the last run and what moved. Some sources can fail if a page layout changes.

Does it store my inventory?

No. Per-item catalog results are cached by normalized name, version and OS only. Nothing from the request is stored or shared.

All API families | Takelan Utilities & APIs | Pricing