---
title: "EOL Risk Score for a specific version"
method: GET
path: "/v1/score/{slug}/{version}"
---

# EOL Risk Score for a specific version

`GET /v1/score/{slug}/{version}`

## Request

- Base URL: `https://api.endoflife.ai`
- URL: `https://api.endoflife.ai/v1/score/{slug}/{version}`
- Auth: one of:
  - none
  - API key in header `X-API-Key`
  - HTTP bearer

A patch or build version (18.19.0, 8.6) resolves to its release line; the answer then carries requested_version and version_matched_by. A build on a line split into sibling cycles (SQL Server service packs), a Firefox number that could be the standard release or the ESR, or a version above an ended line's last published patch is refused with the reason.

## Path parameters

- `slug` string, required
- `version` string, required

## Response `200`

EOL Risk Score

- Score: One version's lifecycle facts and EOL Risk Score. The same object is returned by /v1/score, inside /v1/product versions[], /v1/batch results[] and /v1/sbom results[].
  - `product` string
  - `version` string: The release cycle answered. When the request named a patch or build, requested_version and version_matched_by are present too.
  - `alias_of` string: Only when the slug sent is an alias of a tracked product (fortigate, weblogic, ios-xe): the slug as sent; product is the tracked slug it resolved to.
  - `requested_version` string: Only when the version was resolved to its release line: the version as sent.
  - `version_matched_by` 'release-line': Only when the version was resolved to its release line rather than matched exactly.
  - `latest_release` string, nullable
  - `release_date` string, date, nullable
  - `eol_date` string, date, nullable: null when the vendor has published no date, or has only said the line is already end of life (see eol_boolean).
  - `eol_boolean` boolean, nullable: true = end of life with no exact date published; false = not end of life, no date published; null = a date is given in eol_date.
  - `status` 'active' | 'warn' | 'eol' | 'unknown': warn = within 180 days of end of life, still supported; unknown = the published date could not be read
  - `is_supported` boolean: true when the vendor still ships fixes today: status active or warn. false for eol and unknown.
  - `days_until_eol` integer, nullable: Counted to eol_date. When eol_date_precision is month or quarter, that is the period's last day: show the month, not the count.
  - `days_past_eol` integer, nullable
  - `eol_date_precision` 'day' | 'month' | 'quarter', nullable: How precisely the vendor publishes eol_date: day = the vendor names the day; month or quarter = the vendor names only the month (quarter), so eol_date is that period's LAST day, kept for sorting and comparison; display the period ("October 2026"), not the day. null when eol_date is null.
  - `support_date` string, date, nullable: End of the vendor's active (full or standard) support phase for this line, where one is published. The risk score's eol_recency factor reads it. null where none is recorded.
  - `support_date_precision` 'day' | 'month' | 'quarter', nullable: How precisely the vendor publishes support_date: day = the vendor names the day; month or quarter = the vendor names only the month (quarter), so support_date is that period's LAST day, kept for sorting and comparison; display the period ("October 2026"), not the day. null when support_date is null.
  - `extended_support_date_precision` 'day' | 'month' | 'quarter', nullable: How precisely the vendor publishes extended_support_date: day = the vendor names the day; month or quarter = the vendor names only the month (quarter), so extended_support_date is that period's LAST day, kept for sorting and comparison; display the period ("October 2026"), not the day. null when extended_support_date is null.
  - `date_precision_note` string: Present only when a date above is month or quarter precision: which date, the period it stands for, and that it is stored as the period's last day.
  - `score` integer: EOL Risk Score (higher = riskier)
  - `grade` string
  - `grade_label` string
  - `band` string
  - `factors` object: The four components of the score; methodology at methodology_url.
    - `eol_recency` integer
    - `attack_surface` integer
    - `cisa_kev_exposure` integer
    - `extended_support` integer
  - `cpe` string[], nullable: Verified CPE 2.3 identifier(s) for joining this product to scanner and CVE data. null where no identifier has been verified — we publish none rather than a guess. For a hardware product whose versions are models (cpe_scope model), only the identifiers that name this model.
  - `cpe_scope` 'model': Present for hardware products whose versions are models: cpe lists only this model's identifiers, never the other models on the vendor page.
  - `cpe_note` string: Present when cpe_scope is model and no NIST CPE names this model, so cpe is null.
  - `purl` string[], nullable: Package URL(s) that resolve an SBOM component to this product (endoflife.ai/purl-map.json). null where none is known.
  - `extended_support_available` boolean
  - `extended_support_vendor` object, nullable: A featured extended-support vendor for this product where one is listed; null otherwise.
  - `score_card_url` string, uri: The score card page on endoflife.ai. The cycle is written as the site writes it: every character outside letters, digits, dot, dash and underscore becomes a dash.
  - `product_url` string, uri
  - `methodology_url` string, uri
  - `data_source` string, uri: Where the served eol_date was read from: the vendor page for a vendor-sourced date, https://endoflife.date for an upstream date, https://endoflife.ai/how-it-works for our own catalog.
  - `generated_at` string, date-time
  - `extended_support_date` string, date, nullable: End of the vendor's own extended or paid support phase for this line where one is published (Microsoft ESU, Oracle Extended Support, Red Hat ELS, Ubuntu ESM). A line past eol_date may still be covered until this date under that program, unless extended_support_ships_fixes is false. null where none is recorded. The eol_date_source and eol_date_confidence fields describe eol_date only; this date comes from the same lifecycle record but is not covered by them, so confirm it with the vendor before relying on it for a contract.
  - `extended_support_ships_fixes` boolean, nullable: false where the vendor ships no fixes in the phase that ends on extended_support_date (support services or advice only: Cisco Last Date of Support, Hazelcast Extended Support, Ivanti Customer care, Zyxel End of Life), so a line past eol_date receives no patches from the vendor even though that phase is still open. null where no such statement is recorded.
  - `eol_date_source` 'vendor-override' | 'vendor-fetched' | 'vendor-verified' | 'custom' | 'upstream' | 'discrepancy', nullable: Where eol_date comes from: vendor-override (set from the vendor's own publication), vendor-fetched (our adapter read the vendor's lifecycle page and it agrees), vendor-verified (a human cross-check covers this version), custom (our own catalog), upstream (endoflife.date only), discrepancy (the vendor page disagrees with the served value; under review). Full report: https://endoflife.ai/verification.json
  - `eol_date_source_url` string, nullable: The vendor page or record the label rests on.
  - `eol_date_verified_at` string, date, nullable: When the label was last established: the vendor feed's read date, the human check date, or the day the correction was applied.
  - `eol_date_status` 'ok' | 'fallback' | 'mismatch' | 'human' | 'upstream' | 'custom', nullable: ok = vendor feed read within 14 days and agreeing; fallback = feed older than 14 days (last good value); mismatch = the vendor feed disagrees with the served value; human = a recorded correction or human verification; upstream = endoflife.date only; custom = our own catalog.
  - `eol_date_agreement` integer, nullable: How many independent source classes agree with eol_date: the vendor's own feed, a human decision (correction or verification record), the upstream dataset.
  - `eol_date_confidence` 'high' | 'medium' | 'low', nullable: high = two or more sources agree; medium = one source; low = the vendor feed disagrees with the served value, or a stale feed is the only source.
  - `keyless_access_notice` object: Only on answers to anonymous calls before 2026-11-16T00:00:00Z: message, keyless_access_ends (ISO date-time), get_free_key (URL). From then such calls are 401.
    - `message` string
    - `keyless_access_ends` string, date-time
    - `get_free_key` string, uri

## Other responses

- `401`: No valid X-API-Key, from 2026-11-16T00:00:00Z (keyless access ends then). The body says how to get a free key (https://endoflife.ai/api#free-key); X-EOL-Key-Status names why a sent key was not honoured.
- `404`: Unknown product, or a version that did not resolve (reason, candidates, cycle, last_published say why when the refusal was deliberate)
- `429`: Daily quota exhausted for this tier (anonymous per IP, keyed per key). Retry-After says when the counter resets (next UTC midnight).

---

[API](https://skmtc.dev/endoflife/apis/endoflife-ai-api.md) · [All operations](https://skmtc.dev/endoflife/apis/endoflife-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/endoflife/apis/endoflife-ai-api/revisions/266133050383?raw)