Data licence

Lifecycle data
inside your product

For platforms that already show their customers software and versions: asset inventory and IT asset management, vulnerability and exposure management, and MSP tools (RMM and PSA). A licence lets you show endoflife.ai end-of-life dates, the source of each date, the EOL Risk Score™ and CISA Known Exploited Vulnerabilities exposure next to every title you already discover, for 700+ products and 14,000+ versions.

What a licence includes

Lifecycle dates
Release, end of active support, end of security support or end of life, and extended support where the vendor sells it, per product and version.
Source on every date
Whether the date was read on the vendor's own page or feed, or comes from the open endoflife.date dataset, with the source address and the day we last read it. Corrections and held changes are marked.
EOL Risk Score
0 to 100 per version, with its grade and the factors behind it. Methodology.
KEV exposure
Per product and version: entries in CISA's Known Exploited Vulnerabilities catalog, the latest one and the ransomware flag, derived from the live catalog at every build.
Exploited and unpatchable
Versions past end of life with an actively exploited vulnerability and no vendor fix. The feed.
Identifiers
CPE and package URL (purl) per product for matching against scanners and SBOMs, or a written reason where none applies. Never a guessed CPE.
Change record
Every added, removed, re-dated or re-scored record, per build.

Every field is described in the data dictionary.

How it is delivered

API. A licence key on api.endoflife.ai sized to your use: single and batch lookups, SBOM enrichment (CycloneDX and SPDX in, the same document out with lifecycle, score and KEV on each component) and the MCP server for AI agents.

Snapshots. Versioned JSON and CSV files at a stable address, refreshed at least daily, with the change record, so you can mirror the data instead of calling once per asset.

Schema stability. Changes within a schema version are additive only. A new major version is announced 60 days ahead and the old one runs alongside it for 90 days.

How the data is kept accurate

We start from the open endoflife.date dataset, read vendors' own lifecycle pages directly, and correct what disagrees. A suspicious upstream change, such as a date moving a year or more, is held at the last good value until a person has read the vendor's page. The build refuses to publish a figure the data does not support. The live figures (the share of dates read at the vendor, the corrections published, the checks that run on every build) are on the accuracy scoreboard, updated with every build.

Built for three kinds of platform

Asset inventory
You already discover the software. A licence adds when each title stops getting fixes, where that date came from, and how risky it is now, on the asset page and in reports.
Vulnerability management
End of life explains the findings that will never get a patch. The exploited-and-unpatchable flag and KEV exposure rank them; CPE and purl identifiers match them to what your scanner already sees.
MSP tools
End-of-life dates on every client asset turn into upgrade projects and renewal conversations, inside the PSA or RMM the technicians already use.

Who needs a licence

Licence scope: free for evaluation and for running, securing and planning your own IT estate, including through the official endoflife.ai integrations; a data licence from [email protected] is required to use endoflife.ai data to assess, rate, underwrite, audit, research or report on other organisations, in any product, service or deliverable for third parties, to redistribute or resell it, or to store it in bulk to build a dataset. Data that originates from endoflife.date stays under its MIT licence and CISA KEV records stay public domain; the licence requirement applies only to what endoflife.ai adds. Full terms.

A team that only looks dates up for its own estate does not need a licence: the API plans cover that.

What we commit to in writing A disputed date is re-read at the vendor's own publication within one business day, then corrected with the source cited or defended in writing. Corrections are published, never silent. Support is by email, with a first response within one business day. Licences run twelve months, renew, and are non-exclusive both ways.

Try it on your own data

Ask for an evaluation key sized to your real volume, a sample feed, or the terms of a 90-day pilot. We work in writing.

[email protected] Accuracy scoreboard Integrations