---
title: "Get one software product (Market)"
method: GET
path: "/v1/software/{engine}"
tags: ["Software"]
---

# Get one software product (Market)

`GET /v1/software/{engine}`

## Request

- Base URL: `https://api.peppolstatus.com`
- URL: `https://api.peppolstatus.com/v1/software/{engine}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

One engine of the software library: the same row the list returns (product metadata, host count per observed role, first/last seen, the compliance signal and the host-count trend) plus the catalogue version and generation stamp. `engine` is a catalogue engine slug as published in `engine` on the list; an unknown slug is a 404.

Beyond the list row it also returns `advisory_list[]` (issue #798): every live advisory of the engine's lanes with its id, normalized severity, CVSS score, summary, url and publication stamp, newest first. Null when no lane of the engine has an advisory feed; `[]` when it has one and upstream has published nothing. Market tier.

## Path parameters

- `engine` string, required

## Query parameters

- `days` integer

## Response `200`

The engine's library entry.

- SoftwareLibraryDetail: One engine of the software library: its product metadata plus what the network shows. An engine with no current sighting is still a row (`hosts: 0`, `roles: []`, null seen stamps, a flat trend). `compliance` is null when no seat is linked to the engine, or while the seat rollup is unavailable — never a fabricated zero. `lanes` and `advisories` (issue #798) are null — never `[]` or zero counts — for the 44 of 53 engines the catalogue tracks no upstream release feed for.
  - `engine` string, required: The catalogue engine slug.
  - `display_name` string, required
  - `vendor` string, nullable, required
  - `category` 'smp' | 'ap' | 'both' | 'unknown', required
  - `homepage` string, nullable, required
  - `hosts` integer, required: Current production host+role targets running the engine.
  - `roles` SoftwareLibraryRoleCount[], required
    - `role` 'smp' | 'ap', required
    - `hosts` integer, required
  - `first_seen` string, date-time, nullable, required: First observation of the engine anywhere on the network.
  - `last_seen` string, date-time, nullable, required: End of the most recent observation window — the request instant while the engine is still present.
  - `compliance` SoftwareLibraryCompliance, required: The compliance debt of the seats running an engine, summed from the daily seat rollup at its newest `snapshot_date` (published because the rollup can be a day stale). `seats_linked` is MANY-TO-MANY with engines — a seat whose hosts run two engines is counted under both — so this figure must never be summed across engines to reach a network total. `seats_scored` ≤ `seats_linked`: a linked seat the scan has not covered contributes nothing. `open_per_1k` is null when the linked seats host no registrations (a certificate finding needs none, and 0 would claim a clean sheet).
    - `snapshot_date` string, date, required
    - `seats_linked` integer, required
    - `seats_scored` integer, required
    - `registrations` integer, required
    - `open_findings` integer, required
    - `fatal` integer, required
    - `warning` integer, required
    - `notice` integer, required
    - `open_per_1k` number, nullable, required
  - `trend` SoftwareLibraryTrendPoint[], required
    - `day` string, date, required
    - `hosts` integer, required
  - `lanes` SoftwareLaneStats[], nullable, required: The engine's tracked upstream lanes, each with its newest stable release and the current / behind / unknown split of the hosts running it. Null when the engine tracks no upstream feed.
    - `lane` string, required: The catalogue `upstream` lane key.
    - `latest_release` SoftwareLatestRelease, required: The newest STABLE (non-prerelease) release of a tracked product lane, from the daily upstream sync (issue #798). Published even when the host's own version cannot be placed on the ladder — it is the half a reader can still act on.
      - `version` string, required: Normalized: tag prefix and publisher suffix stripped.
      - `released_at` string, date, required
    - `hosts_current` integer, nullable, required: null when fewer than 10 hosts
    - `hosts_behind` integer, nullable, required: null when fewer than 10 hosts
    - `hosts_unknown` integer, nullable, required: null when fewer than 10 hosts
  - `advisories` SoftwareAdvisorySummary, required: Known advisories by CVSS severity (issue #798). All-zero counts with an empty `ids` mean TRACKED AND CLEAN; the whole object is null when the lane publishes no advisory feed at all. The two are different statements and must render differently. Verified 2026-09-17: no CVE/GHSA exists for any tracked product, so a clean sheet is the expected day-one answer.
    - `critical` integer, required
    - `high` integer, required
    - `medium` integer, required
    - `low` integer, required
    - `ids` string[], required: Advisory ids (GHSA-… / CVE-…) behind the counts.
  - `advisory_list` SoftwareAdvisoryEntry[], nullable, required: The advisories behind `advisories`, newest-published first — the detail endpoint only. Null when no lane of the engine has an advisory feed; `[]` when it has one and upstream has published nothing (issue #798).
    - `id` string, required: GHSA-… or CVE-…
    - `severity` 'critical' | 'high' | 'medium' | 'low', required
    - `cvss_score` number, nullable, required
    - `summary` string, required
    - `url` string, uri, required
    - `published_at` string, date-time, nullable, required
  - `catalogue_version` integer, required
  - `trend_from` string, date, required
  - `trend_to` string, date, required
  - `generated_at` string, date-time, required

## Other responses

- `400`: An invalid `days` window.
- `404`: The engine slug is not in the software catalogue.

---

[API](https://skmtc.dev/peppolstatus/apis/peppolstatus-api.md) · [All operations](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/llms.txt) · [OpenAPI document](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/revisions/7e74fb32f23c?raw)