patchletter

The patchletter API — update data straight into your tooling

patchletter exposes the product catalog, release history, CVE/KEV hits and end-of-life cycles as a free, open REST API. Read-only GET endpoints, no account required.

View the OpenAPI specBrowse resources

Auth & rate limits

Public read access works fully without signing in. An optional personal API key raises your rate limit — create one in seconds in the dashboard.

Without a key

60 req/min · IP

60 requests/minute per IP address. The default for every unauthenticated request.

With an API key

600 req/min · Key

600 requests/minute per key — 10× more. Free, one key per account.

Create an API key in the dashboard →

Send the key as a bearer token or as its own header — both are equivalent:

curl -H "Authorization: Bearer pk_live_YOUR_KEY" "https://patchletter.com/api/v1/products"

# äquivalent:
curl -H "X-API-Key: pk_live_YOUR_KEY" "https://patchletter.com/api/v1/products"

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (a Unix timestamp). Exceeding the limit returns 429 rate_limited with a Retry-After header:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1770000000
Retry-After: 23

{ "error": { "code": "rate_limited", "message": "Rate limit exceeded — try again later." } }

Resources

All endpoints live under the base URL https://patchletter.com/api/v1 and return JSON. Lists are wrapped as { data, pagination }; pagination.nextCursor is an opaque string — pass it back to ?cursor= as-is, don't parse it.

GET/api/v1/products

Product list

Filtered, sorted, paginated list of all active products. Filters: category (exact category slug), q (free-text search over name/vendor/slug), cursor, limit (1-100, default 50).

Example

curl "https://patchletter.com/api/v1/products?category=server-datenbanken&limit=2"

Example response

{
  "data": [
    {
      "slug": "nginx",
      "name": "nginx",
      "vendor": "F5 / nginx",
      "category": "server-datenbanken",
      "subcategory": "Reverse Proxy",
      "websiteUrl": "https://nginx.org",
      "isHardware": false,
      "latestVersion": "1.27.4",
      "latestReleasedAt": "2026-02-05T00:00:00.000Z"
    },
    {
      "slug": "postgresql",
      "name": "PostgreSQL",
      "vendor": "PostgreSQL Global Development Group",
      "category": "server-datenbanken",
      "subcategory": null,
      "websiteUrl": "https://www.postgresql.org",
      "isHardware": false,
      "latestVersion": "17.2",
      "latestReleasedAt": "2026-01-09T00:00:00.000Z"
    }
  ],
  "pagination": { "nextCursor": "postgresql", "limit": 2 }
}
GET/api/v1/products/{slug}

Product detail

A single product including its latest version, channel and EOL summary. eol is null when the product isn't tracked on endoflife.date. Unknown slug → 404.

Example

curl "https://patchletter.com/api/v1/products/nginx"

Example response

{
  "slug": "nginx",
  "name": "nginx",
  "vendor": "F5 / nginx",
  "category": "server-datenbanken",
  "subcategory": "Reverse Proxy",
  "description": "Webserver und Reverse Proxy — überall.",
  "websiteUrl": "https://nginx.org",
  "isHardware": false,
  "latestVersion": "1.27.4",
  "latestChannel": "STABLE",
  "latestReleasedAt": "2026-02-05T00:00:00.000Z",
  "eol": null
}
GET/api/v1/products/{slug}/releases

Release history

Chronological release list for a product, newest version first. Filters: channel (STABLE, LTS, BETA, SECURITY, FIRMWARE), cursor, limit.

Example

curl "https://patchletter.com/api/v1/products/nginx/releases?limit=2"

Example response

{
  "data": [
    {
      "version": "1.27.4",
      "versionNorm": "1.27.4",
      "channel": "STABLE",
      "releasedAt": "2026-02-05T00:00:00.000Z",
      "detectedAt": "2026-02-06T03:00:12.000Z",
      "notesUrl": "https://nginx.org/en/CHANGES",
      "summary": "Security fix for a request-smuggling edge case in HTTP/2 handling.",
      "isSecurity": true
    },
    {
      "version": "1.27.3",
      "versionNorm": "1.27.3",
      "channel": "STABLE",
      "releasedAt": "2025-12-16T00:00:00.000Z",
      "detectedAt": "2025-12-17T03:00:05.000Z",
      "notesUrl": "https://nginx.org/en/CHANGES",
      "summary": null,
      "isSecurity": false
    }
  ],
  "pagination": { "nextCursor": "eyJ2ZXJzaW9uTm9ybSI6IjEuMjcuMyIsImlkIjoiY2xxeHh4In0", "limit": 2 }
}
GET/api/v1/products/{slug}/versions

Known versions

Deduplicated dropdown vocabulary of all known version strings for a product ("your version"), prioritizing STABLE/LTS.

Example

curl "https://patchletter.com/api/v1/products/nginx/versions"

Example response

{
  "versions": ["1.27.4", "1.27.3", "1.26.3", "1.26.2", "1.24.0"]
}
GET/api/v1/products/{slug}/cves

CVE hits for a product

CVE/KEV feed for a single product, newest detection first. Filters: severity (CRITICAL, HIGH, MEDIUM, LOW — case-insensitive), cursor, limit.

Example

curl "https://patchletter.com/api/v1/products/nginx/cves?severity=high"

Example response

{
  "data": [
    {
      "cveId": "CVE-2026-31337",
      "title": "Example: heap buffer overflow when parsing a malformed HTTP/2 header block",
      "severity": "HIGH",
      "cvss": 8.6,
      "knownExploited": true,
      "ransomware": false,
      "dueDate": "2026-08-01T00:00:00.000Z",
      "publishedAt": "2026-07-10T00:00:00.000Z",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31337"
    }
  ],
  "pagination": { "nextCursor": null, "limit": 50 }
}
GET/api/v1/products/{slug}/eol

EOL cycles for a product

Raw cycles from the endoflife.date cache. cycles is an empty array (not an error) when the product isn't listed there.

Example

curl "https://patchletter.com/api/v1/products/postgresql/eol"

Example response

{
  "slug": "postgresql",
  "name": "PostgreSQL",
  "cycles": [
    {
      "cycle": "17",
      "releaseDate": "2024-09-26",
      "eol": "2029-11-08",
      "latest": "17.2",
      "lts": false,
      "support": "2027-11-11"
    },
    {
      "cycle": "16",
      "releaseDate": "2023-09-14",
      "eol": "2028-11-09",
      "latest": "16.6",
      "lts": false,
      "support": "2026-11-12"
    }
  ]
}
GET/api/v1/releases/recent

Recent releases (across all products)

Newest release detections across all active products, optionally security-only (securityOnly=1). Filters: cursor, limit.

Example

curl "https://patchletter.com/api/v1/releases/recent?securityOnly=1&limit=2"

Example response

{
  "data": [
    {
      "product": { "slug": "nginx", "name": "nginx" },
      "version": "1.27.4",
      "prevVersion": "1.27.3",
      "channel": "STABLE",
      "isSecurity": true,
      "date": "2026-02-05T00:00:00.000Z"
    },
    {
      "product": { "slug": "fortios", "name": "FortiOS" },
      "version": "7.6.3",
      "prevVersion": "7.6.2",
      "channel": "FIRMWARE",
      "isSecurity": true,
      "date": "2026-02-03T00:00:00.000Z"
    }
  ],
  "pagination": { "nextCursor": "eyJkZXRlY3RlZEF0IjoiMjAyNi0wMi0wM1QwMDowMDowMFoiLCJpZCI6ImNseXh4eHgifQ", "limit": 2 }
}
GET/api/v1/cves

Global CVE/KEV feed

CVE/KEV hits across all active products, with a product reference on every row. Filters: severity, cursor, limit.

Example

curl "https://patchletter.com/api/v1/cves?severity=critical&limit=1"

Example response

{
  "data": [
    {
      "cveId": "CVE-2026-31337",
      "title": "Example: heap buffer overflow when parsing a malformed HTTP/2 header block",
      "severity": "CRITICAL",
      "cvss": 9.1,
      "knownExploited": true,
      "ransomware": true,
      "dueDate": "2026-08-01T00:00:00.000Z",
      "publishedAt": "2026-07-10T00:00:00.000Z",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31337",
      "product": { "slug": "nginx", "name": "nginx" }
    }
  ],
  "pagination": { "nextCursor": null, "limit": 1 }
}
GET/api/v1/categories

Categories

The full, stable category list including the count of active products. Unpaginated — pagination.nextCursor is always null.

Example

curl "https://patchletter.com/api/v1/categories"

Example response

{
  "data": [
    { "slug": "browser-clients", "label": "Browser & Clients", "labelEn": "Browsers & Clients", "count": 14 },
    { "slug": "betriebssysteme", "label": "Betriebssysteme", "labelEn": "Operating Systems", "count": 22 }
  ],
  "pagination": { "nextCursor": null, "limit": 2 }
}

Machine-readable specification

The full OpenAPI 3.1 specification documents every endpoint, parameter and field in machine-readable form — perfect for generating API clients or importing into Postman/Insomnia.

View GET /api/v1/openapi.json →

Fair use

patchletter is free and built on open sources — vendor release notes, the CISA KEV catalog and endoflife.date. Please be fair: cache responses (Cache-Control is set), don't poll more often than you need to, and credit patchletter if you republish the data. Need more volume? hello@patchletter.com.

Get started right away

No account needed for read access. Want a higher rate limit? Create a free API key.

View the OpenAPI specBrowse the catalog