---
title: "List the software library (Market)"
method: GET
path: "/v1/software"
tags: ["Software"]
---

# List the software library (Market)

`GET /v1/software`

## Request

- Base URL: `https://api.peppolstatus.com`
- URL: `https://api.peppolstatus.com/v1/software`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

The software catalogue's PRODUCT taxonomy joined to what the network shows: for every engine, its display name, vendor, category and homepage, the current host count broken down by observed role, when it was first and last seen, a compliance signal for the seats running it, and a host-count trend of up to 90 UTC days.

Every catalogue engine appears, including one the network does not currently show (`hosts: 0`, a flat trend) — the library is the catalogue, not only today's sightings. `category` is the vendor's own framing; `roles` is the OBSERVED fact and is the one to trust where the two disagree.

`compliance.seats_linked` is deliberately not called "owned": an engine → seat link is MANY-TO-MANY, so a seat whose hosts run two engines is counted under both and its findings appear under both. Summing `open_findings` across engines therefore OVER-COUNTS the network total; the figure answers "how much compliance debt sits behind this engine", never "who is to blame". `compliance` is null when no seat is linked to the engine, and `snapshot_date` always travels with the numbers because the daily rollup can be a day stale.

`lanes[]` (issue #798) reports each tracked upstream LANE of the engine — a lane is not an engine: `oxalis` covers three independent release ladders — with its `latest_release` and the `hosts_current` / `hosts_behind` / `hosts_unknown` split of the hosts running it (all three null when any is below 10). `advisories` summarises the live advisories published for the product by CVSS severity. Both are NULL — never `[]` or zero counts — for the engines the catalogue tracks no upstream feed for. Market tier.

## Query parameters

- `days` integer

## Response `200`

The whole software library.

- SoftwareLibraryList: The whole software library, ordered by current host count (desc) then display name.
  - `items` SoftwareLibraryRow[], required
    - `engine` string, required: The catalogue engine slug.
    - `display_name` string, required
    - `vendor` string, nullable, required
    - `category` 'smp' | 'ap' | 'both' | 'unknown', required
    - `homepage` string, nullable, required
    - `hosts` integer, required: Current production host+role targets running the engine.
    - `roles` SoftwareLibraryRoleCount[], required
      - `role` 'smp' | 'ap', required
      - `hosts` integer, required
    - `first_seen` string, date-time, nullable, required: First observation of the engine anywhere on the network.
    - `last_seen` string, date-time, nullable, required: End of the most recent observation window — the request instant while the engine is still present.
    - `compliance` SoftwareLibraryCompliance, required: The compliance debt of the seats running an engine, summed from the daily seat rollup at its newest `snapshot_date` (published because the rollup can be a day stale). `seats_linked` is MANY-TO-MANY with engines — a seat whose hosts run two engines is counted under both — so this figure must never be summed across engines to reach a network total. `seats_scored` ≤ `seats_linked`: a linked seat the scan has not covered contributes nothing. `open_per_1k` is null when the linked seats host no registrations (a certificate finding needs none, and 0 would claim a clean sheet).
      - `snapshot_date` string, date, required
      - `seats_linked` integer, required
      - `seats_scored` integer, required
      - `registrations` integer, required
      - `open_findings` integer, required
      - `fatal` integer, required
      - `warning` integer, required
      - `notice` integer, required
      - `open_per_1k` number, nullable, required
    - `trend` SoftwareLibraryTrendPoint[], required
      - `day` string, date, required
      - `hosts` integer, required
    - `lanes` SoftwareLaneStats[], nullable, required: The engine's tracked upstream lanes, each with its newest stable release and the current / behind / unknown split of the hosts running it. Null when the engine tracks no upstream feed.
      - `lane` string, required: The catalogue `upstream` lane key.
      - `latest_release` SoftwareLatestRelease, required: The newest STABLE (non-prerelease) release of a tracked product lane, from the daily upstream sync (issue #798). Published even when the host's own version cannot be placed on the ladder — it is the half a reader can still act on.
        - `version` string, required: Normalized: tag prefix and publisher suffix stripped.
        - `released_at` string, date, required
      - `hosts_current` integer, nullable, required: null when fewer than 10 hosts
      - `hosts_behind` integer, nullable, required: null when fewer than 10 hosts
      - `hosts_unknown` integer, nullable, required: null when fewer than 10 hosts
    - `advisories` SoftwareAdvisorySummary, required: Known advisories by CVSS severity (issue #798). All-zero counts with an empty `ids` mean TRACKED AND CLEAN; the whole object is null when the lane publishes no advisory feed at all. The two are different statements and must render differently. Verified 2026-09-17: no CVE/GHSA exists for any tracked product, so a clean sheet is the expected day-one answer.
      - `critical` integer, required
      - `high` integer, required
      - `medium` integer, required
      - `low` integer, required
      - `ids` string[], required: Advisory ids (GHSA-… / CVE-…) behind the counts.
  - `catalogue_version` integer, required: Which software-catalogue edition produced the product metadata.
  - `trend_from` string, date, required
  - `trend_to` string, date, required
  - `generated_at` string, date-time, required

## Other responses

- `400`: An invalid `days` window.

---

[API](https://skmtc.dev/peppolstatus/apis/peppolstatus-api.md) · [All operations](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/llms.txt) · [OpenAPI document](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/revisions/7e74fb32f23c?raw)