Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Changed the definition of "get_provider_moves"
⟨19 unchanged words⟩ lost participants to whom, for the whole network or for one country (`country`), in one call. The `top` largest providers ⟨288 unchanged words⟩ Providers only; a Vendor is not in it. With `country`, the matrix holds the moves of the participants of that country: card country first, the country of the ICD prefix as fallback. The window is then one day longer (`from` = today − `days`), the same days as the `country_*_{7,30,90}d` fields of `GET /v1/aps?country=`. `platform_by_provider` gives the platform moves of EVERY provider of that country (not limited by `top`): what a net-growth chart takes out of a provider's movers to show its organic net. A move with no attributable country is dropped, so the countries do not add up to the network. A platform move is judged per provider pair across the whole network, not per country. `country_share` gives the movers of one country (the `country` param, else FR) among all movers of the window that have a country.The matrix has no country filter; thisThis share includes the platform moves.
{"properties":{"country":{"description":"Scope the matrix to one market: an ISO 3166-1 alpha-2 code (e.g. `BE`), case-insensitive. Anything that is not exactly two letters is a 400. Omit it for the whole network.","pattern":"^[A-Za-z]{2}$","type":"string"},"days":{"default":30,"description":"The ⟨46 unchanged words⟩
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "list_access_point_churn_participants"
⟨65 unchanged words⟩ and `no_longer_matched`, and adds `counterpart_kind` to each item. `category` takes a comma list, or `net` for the four net-growth categories: the items come in the order joiner, mover_in, mover_out, leaver (then newly_matched, no_longer_matched), each category newest day first, and every item names its `category`. `day` is the short form of `from` = `to` = that day. The counts are of participant IDs, not companies: group on `company_key` to count companies.
{"properties":{"category":{"description":"The churncategorycategories toexpand.expand: one of `joiner`, `mover_in`, `mover_out`, `leaver`, `newly_matched`, `no_longer_matched`, a comma list of them (`joiner,leaver`), or `net` for `joiner,mover_in,mover_out,leaver`. `newly_matched`
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Added "get_provider_moves" and "get_provider_roster_spread"; changed the definition of "get_access_point_churn", "get_access_point_roster_mix", "get_adoption" and 5 more (63 tools before, 65 now)
⟨133 unchanged words⟩ , not movement, and are never in `net_growth`. For a Provider key, `counterpart_flow` gives each mover side (out, in) its top counterpart with its share and the effective number of counterparts, over the requested period. The share is null under 25 movers on that side and the effective number under 100. A Vendor key has no `counterpart_flow`. PLATFORM MOVES. A mover is a platform move when the platform that serves the participant stayed and only the certificate Seat changed: it is not a customer decision. The verdict is per DIRECTED provider pair (from → to), over all its movers since 2026-08-02, with one of two reasons (`same_host`, `sub_provider`): at least 90% of the movers whose endpoint host can be compared (5 or more, and at least 50% of all movers of the pair) kept their endpoint host, or at least 90% of 25 or more movers still carry, at the new provider, the sub-provider brand of the provider they left. It is a CURRENT judgment, computed again on every rollup cycle. For a Provider key, the movers of a platform-move pair are in `platform_won` / `platform_lost` of the counterpart and not in its `won` / `lost`; the flag is per direction (counterpart → Provider, Provider → counterpart). `totals.platform_in` / `totals.platform_out` are their sums. `totals.movers_in`, `totals.movers_out`, `net_growth` and the daily series still count all movers. A Vendor key is not changed: its counterparts have no platform fields.
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "get_access_point", "get_access_point_churn", "get_access_point_roster_mix" and 3 more
⟨149 unchanged words⟩ other providers' SMPs that carry this AP's participants. Each `sub_providers` bucket names its Vendor (`name`) and links to the Vendor's row (`vendor_key`). A Vendor key (`v-<slug>`) returns the Vendor detail instead and needs a Market-tier key: the Providers it connects through (`via`), its participants and Companies, the signals that back the row, and the composition of its roster. A Vendor has no Seats, no certificate and no hosts of its own.
⟨3 unchanged words⟩ :"The provider key (e.g. `c-tickstar`, `o-teamleader-nv-1f3a2b9c`), or a Vendor key (`v-exact`).","type":"string"}},"required" ⟨3 unchanged words⟩
Authorization not required, issuer https://api.peppolstatus.com
Added "get_deregistered_company_stats", "get_deregistered_stats" and "list_deregistered_ids"; changed the definition of "list_participants" (60 tools before, 63 now)
⟨36 unchanged words⟩ `vat_liable` booleans, and a smart `q` (a`scheme::value`/barefullvaluePeppolhitsIDtheorIDaindex;barefreeidentifier number matches the ID; other textrunsis a
Changed the definition of "list_access_point_churn_participants"
⟨13 unchanged words⟩ churn category count for this Provider over theperiod.period,Boundednewest observation day first. `counterpart` narrows a mover category to the participants won from or lost to one Provider. Cursor-paginated in pages of at most 500:rowsfollow(never`next_cursor`paginated;untilnext_cursoritnull).
Certificate changed, valid to 2027-01-01
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "get_adoption"
⟨5 unchanged words⟩ — `be`, `fr`, `sk`, `no`, `se`, `fi` or`fi`.`si`.","enum":["be","fr","sk","no","se","fi","si"],"type":"string"}},"required" ⟨3 unchanged words⟩
Authorization not required, issuer https://api.peppolstatus.com
Added "get_network_stats" and "get_network_stats_history" (58 tools before, 60 now)
Get the network-level statistics How the whole network moves: Movers (AP) and Movers (SMP), Cross-border moves, Bulk moves, Joiners, Leavers and Net growth, the Leaver rate (annualized), Concentration (AP) and Concentration (SMP) (HHI, top 5, top 10), Foreign-served participants and penetration. Each flow statistic gives its count over the last 7 and 30 days, the 7-day mean and the change against the period before. Every rate is of the registered-participant count at the START of its period (`base`, the end of `base_day`) and is returned beside its absolute count. A day with no completed ch…
Get one network-level statistic as a daily series One point for every UTC day of the window. `stat` is required. A flow statistic (`ap_switching` = Movers (AP), `cross_border` = Cross-border moves, `smp_switching` = Movers (SMP), `growth` = Net growth with Joiners and Leavers) carries per day its counts (`values`), the registered-participant count at the start of the day (`base`), the first key as a percentage of that base (`pct`) and its 7-day mean (`mean_7d`). For `cross_border`, `base` is all AP moves of the day and `pct` is the cross-border share of them. A day with no completed change s…
Removed "get_host_software", "list_host_software", "list_host_software_history" and 1 more; changed the definition of "get_access_point", "get_software_stats", "list_anomalies" and 2 more (62 tools before, 58 now)
⟨86 unchanged words⟩ totals behind the capped `hostnames` / `smp_hostnames` samples. `smp_tenants` lists the Access Points (seats) that serve the participants on this Provider's SMP hosts — on a multi-tenant SMP most of the hosted footprint belongs to other APs — with `smp_tenant_count` / `smp_tenant_other` / `smp_tenant_no_ap` so the rows add up to `hosted_participant_count` (both come from the same rollup run); `smp_hosted_by` is the reverse: other providers' SMPs that carry this AP's participants.
⟨17 unchanged words⟩ `other`), version distribution within each named vendor (k=10), ASN hosting share, and a two-denominator coverage
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "get_access_point_roster_mix", "get_adoption", "get_participants_mix" and 1 more
⟨14 unchanged words⟩ {key}` (country, entity type, NACEsectorRev. 2.1 division, size class, region) recomputed over a ⟨152 unchanged words⟩
⟨186 unchanged words⟩ ":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`) to EXCLUDE. Rows with ⟨139 unchanged words⟩ sector":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`).","items":{ ⟨37 unchanged words⟩
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "list_access_points"
⟨59 unchanged words⟩ compare providers within one market instead of network-wide. Every item carries the windowed net growth; a MARKET-tier key additionally gets the four churn components behind each net (`joiners`, `movers_in`, `movers_out`, `leavers` × 7d/30d/90d), which a lower-tier key simply does not receive.
⟨35 unchanged words⟩ `country_orgs` and `country_net_7d|30d|90d`; the network-wide fields are unchanged. A MARKET-tier key additionally gets the scoped churn components `country_joiners|movers_in|movers_out|leavers_7d|30d|90d`.","pattern":"^[A-Za-z]{2}$" ⟨4 unchanged words⟩
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Added "get_participants_mix" (61 tools before, 62 now)
Get a filtered participant breakdown The participant set broken down by country, entity type, NACE sector, size class, region and serving Access Point, over a FILTERED slice — so a breakdown stays true while the list is cut down. The filters are the same names and shapes as `GET /v1/participants`. TWO SOURCES, one shape, named by `source`. A request that narrows on NOTHING is answered from the hourly rollup (`source: "rollup"`, with `refreshed_at`) — the whole-network breakdown, no scan. A request that narrows is computed live (`source: "slice"`). BOUNDED BY DESIGN. A live slice is compute…
Added "get_access_point_roster_mix"; changed the definition of "list_participants" (60 tools before, 61 now)
⟨201 unchanged words⟩ "minimum":1,"type":"integer"},"not_country":{"description":"Comma-array of country codes (`NO,SE`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"not_entity_type":{"description":"Comma-array of company legal-form families (`company`,`natural_person`,`association`,`public`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"not_region":{"description":"Comma-array of company seat region codes (`NO-32,BE-BRU`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"not_sector":{"description":"Comma-array of 2-digit NACE divisions (`47,62`) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"not_size":{"description":"Comma-array of company size classes (as stored; SIRENE only) to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"not_smp":{"description":"Comma-array of SMP hostnames to EXCLUDE. Rows with no value are KEPT — excluding a value never drops the un-enriched remainder. Combines with its include twin: `?region=NO-03¬_region=NO-32` applies both.","items":{"type":"string"},"type":"array"},"
Authorization not required, issuer https://api.peppolstatus.com
Changed the definition of "get_adoption"
⟨3 unchanged words⟩ Country code — `be`, `fr`, `sk`, `no`, `se` or`se`.`fi`.","enum":["be","fr","sk","no","se","fi"],"type":"string"}},"required" ⟨3 unchanged words⟩
Changed the definition of "get_adoption", "get_host_software", "get_participant_stats" and 4 more
{"properties":{"country":{"description":"Country code — `be`, `fr`, `sk`, `no` or`fr`.`se`.","enum":["be","fr","sk","no","se"],"type":"string"}},"required" ⟨3 unchanged words⟩
⟨30 unchanged words⟩ structured evidence that fired. `?at=` returns point-in-time state. The version axis adds release staleness (issue #798): `latest_release` (the newest stable upstream release of the product LANE — `oxalis` has three independent lanes, so the comparison is never one "latest Oxalis"), `lag` (`releases_behind`, `days_behind`, and an `exactness` of `exact` / `at_least` for a floor reading such as `>=8.1.0`, measured against the floor version / `unknown` for a snapshot or a version no lane claims) and `advisories` (CVSS severity counts plus the matching advisory ids). All three are NULL when the engine tracks no upstream lane; `advisories` alone is NULL when the lane publishes no advisory feed, and all-zero counts mean tracked and clean, which is a different statement.
Authorization not required, issuer https://api.peppolstatus.com
Authorization not required, issuer https://api.peppolstatus.com
Added "get_software" and "list_software"; changed the definition of "list_compliance_findings" (58 tools before, 60 now)
⟨96 unchanged words⟩ "since":{"description":"Only findings whose`last_confirmed_at``last_seen_at` or `resolved_at` is at or after this ISO 8601instant.instant:Aeverythingchangethefeedlatest scans still confirm, plus everything opened, changed or resolved since. A finding whose evidence has notamovedlivenessfor
Changed the definition of "get_access_point" and "get_host"
⟨56 unchanged words⟩ returned `key` is always the canonical current one. `software` groups the Provider's sighted hosts by registrable domain with the crawled identity of each, and `hostname_count` / `smp_hostname_count` give the true totals behind the capped `hostnames` / `smp_hostnames` samples.
⟨15 unchanged words⟩ provider for a host. `?at=` returns point-in-time state. `profile` carries the crawled software identity of the host's registrable domain when one is publishable (curated, or extraction confidence 0.8+ — then unverified).
Certificate recorded, valid to 2026-11-03
Authorization not required, issuer https://api.peppolstatus.com
First tool surface recorded: 58 tools (server version 1.0.0)
Showing the latest 39 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨232 unchanged words⟩ ":{"description":"Comma-array of company sizeclassesband codes (asstored;stored:SIRENE`21,NN`; FR and NO only) to EXCLUDE. Rows with no value ⟨146 unchanged words⟩
⟨28 unchanged words⟩ section rollup (A–V), region, FR-only département+, size class (FR and NO), BE-only province + postcode + mandate scope, ⟨23 unchanged words⟩ history). Region cells carry ISO 3166-2 (BE, NO, SK) / INSEE région (FR) codes and ⟨42 unchanged words⟩
⟨32 unchanged words⟩ (HHI, top 5, top 10), Concentration per country, Foreign-served participants and penetration. Each flow statistic gives ⟨150 unchanged words⟩ `day`, which can be one day after `as_of`. `concentration_by_country` gives, per country, how the Peppol IDs of that country are shared over the providers that serve it: the HHI, the effective number of providers (10000 / HHI), the largest provider with its share, the top-4 and top-10 shares and the number of providers above 1%. The basis is the provider rosters (certificate seats); Vendors are not counted. Only a country with 8 or more providers is returned. The headline numbers are free. The organic/bulk split ⟨31 unchanged words⟩
⟨170 unchanged words⟩ stock statistic (`concentration_ap` = Concentration (AP), `concentration_ap_country` = Concentration per country, `concentration_smp` = Concentration (SMP), `foreign_served` = Foreign-served ⟨15 unchanged words⟩ the registered participants of that day. `concentration_ap`, `concentration_ap_country`, `foreign_served` and `penetration` have no history before their first snapshot. A day with no snapshot is absent, not 0. The series starts 2026-08-02.
⟨27 unchanged words⟩ return: `ap_switching` (keys total, organic, bulk, platform), `cross_border` (cross, same, unknown, strict_cross ⟨10 unchanged words⟩ cr5_pct, cr10_pct, hhi, total, providers), `concentration_ap_country` (per country with 8 or more providers: hhi, effective_providers, leader_pct, top4_pct, top10_pct, providers_over_1pct, providers, total), `foreign_served` (pct, foreign, domestic, unknown) or ⟨9 unchanged words⟩ ","cross_border","smp_switching","growth","concentration_ap","concentration_ap_country","concentration_smp","foreign_served","penetration"]," ⟨23 unchanged words⟩
⟨237 unchanged words⟩ ":{"description":"Comma-array of company sizeclassesband codes (asstored;stored:SIRENE`21,NN`; FR and NO only) to EXCLUDE. Rows with no value are ⟨141 unchanged words⟩ ":{"description":"Comma-array of company sizeclassesband(codes, asstored;storedSIRENE(`12,21`):onlythe INSEE trancheEffectifs codes for FR (`NN` = unknown)., and for NO the same code set plus `1-4`.","items":{"type":"string"}, ⟨30 unchanged words⟩
⟨195 unchanged words⟩ on every recompute, not frozen at detection. PLATFORM MOVES. A mover is a platform move when the platform that serves the participant stayed and only the certificate Seat changed: it is not a customer decision. The verdict is per DIRECTED provider pair (from → to), over all its movers since 2026-08-02, with one of two reasons (`same_host`, `sub_provider`): at least 90% of the movers whose endpoint host can be compared (5 or more, and at least 50% of all movers of the pair) kept their endpoint host, or at least 90% of 25 or more movers still carry, at the new provider, the sub-provider brand of the provider they left. It is a CURRENT judgment, computed again on every rollup cycle. A cohort of such a pair has `platform_move: true`. It stays in the list. A Vendor's cohorts (`provider=v-<slug>`) are not changed and have no `platform_move`. `from`/`to` are OVERLAP bounds (a cohort counts when ⟨36 unchanged words⟩
⟨366 unchanged words⟩ ":{"description":"Comma-array of company sizeclassesband codes (asstored;stored:SIRENE`21,NN`; FR and NO only) to EXCLUDE. Rows with no value are ⟨298 unchanged words⟩ ":{"description":"Comma-array of company sizeclassesband(codes, asstored;storedSIRENE(`12,21`):onlythe INSEE trancheEffectifs codes for FR (`NN` = unknown)., and for NO the same code set plus `1-4`.","items":{"type":"string"}, ⟨441 unchanged words⟩
Get moves between providers The from→to matrix of participants that changed Access Point provider in a trailing window: who lost participants to whom, for the whole network, in one call. The `top` largest providers on each side keep their identity (`from` = sources, `to` = destinations; a provider can be on both). Every other provider folds into one "Other" node per side, and `other` gives the number of folded providers and their participants. `pairs` is the COMPLETE folded matrix, largest first: a `null` `from` or `to` is the "Other" node of that side, zero cells are omitted, and the value…
Get the provider roster-size spread per country How Access Point provider roster sizes are spread in each country, in one call. A roster size is the number of participant IDs one provider serves in the country (`country_roster` of `GET /v1/aps?country=`). Each country row is the five-number summary over the providers with at least one participant there: `n` providers, `min`, `q1`, `median`, `q3`, `max`, and `total` (the sum). Quantiles use linear interpolation between the two closest ranks (type 7), rounded to 2 decimals. `points` is every roster size in ascending order when the country has…
⟨60 unchanged words⟩ while served. Defaults to the trailing 30 days. A Vendor key (`v-<slug>`) returns the same shape for the Vendor, from a daily comparison of its membership. Movement is counted from `churn_since`; there is no history before it. A counterpart is a Provider or another Vendor (`kind`). `match_totals` and the `newly_matched` / `no_longer_matched` series count membership changes with no real event behind them (a signal appeared or disappeared): they are a data-quality figure, not movement, and are never in `net_growth`.
⟨19 unchanged words⟩ "description":"The Provider key (e.g. `c-tickstar`), or a Vendor key (`v-exact`).","type":"string"},"to": ⟨17 unchanged words⟩
⟨173 unchanged words⟩ the total rather than served as a bucket. A Vendor key (`v-<slug>`) answers the same question over the Vendor's roster and needs a Market-tier key. `seat` then selects one Seat the Vendor connects through.
⟨57 unchanged words⟩ :"The provider key (e.g. `c-tickstar`, `o-teamleader-nv-1f3a2b9c`), or a Vendor key (`v-exact`).","type":"string"},"not_country": ⟨322 unchanged words⟩
⟨46 unchanged words⟩ most 500: follow `next_cursor` until it is null. A Vendor key (`v-<slug>`) lists the Vendor's events, also accepts `newly_matched` and `no_longer_matched`, and adds `counterpart_kind` to each item.
⟨2 unchanged words⟩ :{"description":"The churn category to expand. `newly_matched` and `no_longer_matched` are valid for a Vendor key only; with a Provider key they are a 400.","enum":["joiner","mover_in","mover_out","leaver","newly_matched","no_longer_matched"],"type":"string"},"counterpart":{ ⟨14 unchanged words⟩ (`mover_in`) or lost to (`mover_out`).Not allowedAllowed with`joiner`theortwo`leaver`.mover categories only. For a Vendor key the counterpart can also be a Vendor key. An unknown key returns an empty list."," ⟨27 unchanged words⟩ },"key":{"description":"The Providerkey.key, or a Vendor key (`v-<slug>`).","type":"string"},"limit":{ ⟨39 unchanged words⟩
⟨92 unchanged words⟩ which a lower-tier key simply does not receive. `kind` selects the row kinds. The default is `provider`, and the list is then Provider rows only. A Vendor is a curated software or service brand that connects its customers through the Seats of one or more Providers; `kind=vendor` returns the Vendor rows and `kind=all` returns both, each item marked by `kind`. A Vendor's participants are always also in the count of the Provider that serves them: never add Provider rows and Vendor rows into one total, share or rank.
⟨45 unchanged words⟩ key additionally gets the scoped churn components `country_joiners|movers_in|movers_out|leavers_7d|30d|90d`. A Vendor row carries `country_roster` and `country_orgs` only: there is no country-scoped Vendor movement.","pattern":"^[A-Za-z]{2}$","type":"string"},"kind":{"default":"provider","description":"Which row kinds to return. `provider` (default): Provider rows only. `vendor`: Vendor rows only. `all`: both, sorted together by `participant_count`. `vendor` and `all` need a MARKET-tier key; a lower-tier key gets a 403, never a list without the Vendors. Any other value is a 400.","enum":["provider","vendor","all"],"type":"string"}},"type":"object"}
⟨156 unchanged words⟩ so a lower value cannot surface smaller groups. With a Vendor key as `provider` the floor and the default are 5.","minimum":1,"type":"integer"} ⟨11 unchanged words⟩ ). Matches EITHER side unless `direction` narrows it. A Vendor key (`v-<slug>`) returns the cohorts of that Vendor's movers instead: each item has `kind: \"vendor\"`, one side of the pair is the Vendor, and the floor is 5 participants. Vendor cohorts are in no other response of this endpoint.","type":"string"},"to":{ ⟨31 unchanged words⟩
⟨467 unchanged words⟩ array"},"q":{"description":"Smartsearch:search. A full Peppol ID (`scheme::value`/barevalue`,valueor→a bare `icd:value`) matches that IDlookup;exactly. A bare identifier number (digits only, 4 or more) matches the participants whose ID is that number under any ICD prefix, and also names that contain it. Any other text is a name search: it matches the business-card name or the company-register name. The words can be in any order. All words must match (at most 8 words are used). Case, accents and punctuation are ignored. The search needs at least one word of 3 or more characters, elsename-contains.400. A name that the response withholds is not searchable: the card name of a `discovered` participant and the register name of a natural person. If a name search exceeds the query timeout, the first page is returned empty with `meta.search_degraded: true`; a later page (with `cursor`) returns 503. Neither is cacheable. Use a narrower term.","type":"string"},"region":{ ⟨114 unchanged words⟩ `entity_type`/`sector` views show only enriched (non-null) participants. The `name` sort lists only participants that have a business-card name: a participant with only a company-register name is NOT in a `name`-sorted list (and not in its `meta.filter_count`), although `q` can find it under the other sorts. The `country` sort lists only participants with a country. It is IGNORED when `doctype`/`transport_profile`/`host` is set WITHOUT ⟨334 unchanged words⟩
Get the company breakdown of the De-registered IDs Who left: the De-registered IDs of `/v1/stats/deregistered` (same population, same daily rollup, same `deregistered` total) by company profile, register status, lifetime, re-activation and leftovers. `entity_type`, `sector`, `size` and `region` come from the company register (BE, FR, NO, SE, FI and SI only) and cover the `enriched` IDs: the cells of each of the four add up to `enriched`, with the key `unknown` for an enriched ID that has no value in that breakdown. Each cell carries `base`, the registered IDs in the same cell, so the two mi…
Get the De-registered overview The participants that left the network. A De-registered ID is a participant that is not registered now AND has at least one closed registration row. An ID that was never observed registered (not scanned yet, or never in the SML) is not de-registered: it is counted apart in `never_registered` and is in no other number here. `leavers` is the sub-count of the De-registered IDs that left while a Provider served them. `deregistered`, `share_pct` and `countries` are the stock of the daily rollup (`as_of`). `flow` and `weekly` are the leave flow from the network grow…
List the latest De-registered IDs The De-registered IDs of `/v1/stats/deregistered` (same population, same daily rollup) with the newest leave date: at most 1000, newest first, cursor-paginated. Each item is a `/v1/participants` list item plus `left_at`, the close of its latest registration. `left_at` is recorded about 3 days after the true leave, and a date before 2026-08-02 is not reliable. An ID that is registered again since the rollup run is left out, so a page can be shorter than `total` says. `/v1/participants?registered=false` is a wider list: it also holds the never-registered IDs,…
⟨12 unchanged words⟩ ,"leaver"],"type":"string"},"counterpart":{"description":"Filter to one counterpart Provider key: the Provider the participants were won from (`mover_in`) or lost to (`mover_out`). Not allowed with `joiner` or `leaver`. An unknown key returns an empty list.","type":"string"},"cursor":{"description":"Opaque pagination cursor returned as `next_cursor` by the previous page.","type":"string"},"from":{"description":"Inclusive period start, `YYYY-MM-DD` UTC.","format": ⟨5 unchanged words⟩ ":"The Provider key.","type":"string"},"limit":{"default":500,"description":"Page size, clamped to [1, 500]. Defaults to 500 (20 through MCP).","maximum":500,"minimum":1,"type":"integer"},"to":{"description":"Inclusive period ⟨12 unchanged words⟩
⟨31 unchanged words⟩ endpoint_off_footprint","moved_to_unverified_seat","mass_change_burst","split_id_registration","software_version_downgrade","software_vendor_swap","host_tls_cert_expired","host_tls_cert_expiring"],"type":"string"} ⟨69 unchanged words⟩
⟨150 unchanged words⟩ ,"ap_seat_changed","host_cert_rotated","hosting_changed","directory_card_changed","software_changed","version_changed"],"type":"string"},"type":" ⟨19 unchanged words⟩
List the software library (Market) Thesignaturesoftware catalogue's PRODUCT taxonomy joined to what the network ⟨210 unchanged words⟩ `hosts_behind` / `hosts_unknown` split of the hosts runningit.it (all three null when any is below 10). `advisories` summarises the live advisories published for the ⟨27 unchanged words⟩
Get a host's software fingerprint The detected software of a host across ALL its roles: vendor, version and hosting per role, each with its confidence tier, first-seen timestamp and the structured evidence that fired. `?at=` returns point-in-time state. The version axis adds release staleness (issue #798): `latest_release` (the newest stable upstream release of the product LANE — `oxalis` has three independent lanes, so the comparison is never one "latest Oxalis"), `lag` (`releases_behind`, `days_behind`, and an `exactness` of `exact` / `at_least` for a floor reading such as `>=8.1.0`, meas…
List all hosts' software (Market) Every host with open software fingerprint rows, one row per (hostname, role) with the vendor / version / hosting axes folded in (value, tier, first-seen; plus vendor `variant` and version `kind`). The evidence blob is omitted to keep the list lean — it stays on the per-host resource. Cursor-paginated on the stable (hostname, role) order; optional `vendor=` filter. The version axis also carries release staleness (issue #798): `latest_release` (the newest stable upstream release of the product lane), `lag` (`releases_behind`, `days_behind`, `exactness`) and `…
List a host's software-fingerprint history The closed (superseded) software rows for one host, newest-first, cursor-paginated. Each row is one axis transition with its evidence. Market tier.
List software anomalies The software-fingerprinting anomaly feed (spec §6): version downgrades and vendor swaps, both graded `notice`. A `market` carve-out — the general `/v1/anomalies` feed (network) excludes these detectors. Same shape as that feed.
⟨19 unchanged words⟩ the single-dimension cuts (sector with a NACE Rev. 2.1 section rollup (A–V), region, FR-only département + size class, ⟨41 unchanged words⟩ (FR) codes and sector cells the NACE Rev. 2.1 division code, so the choropleth joins geometry ⟨29 unchanged words⟩
⟨8 unchanged words⟩ broken down by country, entity type, NACEsectorRev. 2.1 division, size class, region and serving Access Point ⟨192 unchanged words⟩
⟨196 unchanged words⟩ ":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`) to EXCLUDE. Rows with ⟨167 unchanged words⟩ sector":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`).","items":{ ⟨49 unchanged words⟩
⟨325 unchanged words⟩ ":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`) to EXCLUDE. Rows with ⟨181 unchanged words⟩ sector":{"description":"Comma-array of 2-digit NACE Rev. 2.1 divisions (`47,62`).","items":{ ⟨413 unchanged words⟩
Get a filtered access point roster breakdown The five roster breakdowns of `GET /v1/aps/{key}` (country, entity type, NACE sector, size class, region) recomputed over a FILTERED slice of the roster, so a breakdown stays true while the roster is cut down. The filters are the same names and shapes as `GET /v1/participants`, scoped to this provider's seats. BOUNDED BY DESIGN. The breakdowns are computed only when the filtered slice is narrow (under an internal cap of 10,000 participants). A request that narrows on nothing, that carries a filter this endpoint cannot express (`doctype`, `transpo…
⟨14 unchanged words⟩ an estimated total, from the hourly rollup. `total_count` counts every ID ever registered; `registered_count` and the `country_registered` facet scope the same data to the LIVE (registered) IDs (issue #818). Keyless-cacheable — safe for the marketing site to hit directly.
⟨51 unchanged words⟩ the list; an unknown slug is a 404. Beyond the list row it also returns `advisory_list[]` (issue #798): every live advisory of the engine's lanes with its id, normalized severity, CVSS score, summary, url and publication stamp, newest first. Null when no lane of the engine has an advisory feed; `[]` when it has one and upstream has published nothing. Market tier.
⟨57 unchanged words⟩ stable (hostname, role) order; optional `vendor=` filter. The version axis also carries release staleness (issue #798): `latest_release` (the newest stable upstream release of the product lane), `lag` (`releases_behind`, `days_behind`, `exactness`) and `advisories` (CVSS severity counts plus ids). All three are NULL when the engine tracks no upstream lane at all, and `advisories` alone is NULL when the lane publishes no advisory feed — null is not zero. A TRACKED engine whose detected version matches none of its lanes keeps `lag` with `exactness: "unknown"` and null counts, so it stays distinguishable from an untracked one. Market tier.
⟨83 unchanged words⟩ → unverified cert-CN — the same as `/v1/aps`. `provider` is who OPERATES the host; `owner` names the party the curated registry says OWNS it, and is set only when that is a different party (a shared registry SMP served under another party's cert), else null. Not paginated (the envelope's `next_cursor` is always null).
⟨184 unchanged words⟩ the daily rollup can be a day stale. `lanes[]` (issue #798) reports each tracked upstream LANE of the engine — a lane is not an engine: `oxalis` covers three independent release ladders — with its `latest_release` and the `hosts_current` / `hosts_behind` / `hosts_unknown` split of the hosts running it. `advisories` summarises the live advisories published for the product by CVSS severity. Both are NULL — never `[]` or zero counts — for the engines the catalogue tracks no upstream feed for. Market tier.
Get one software product (Market) One engine of the software library: the same row the list returns (product metadata, host count per observed role, first/last seen, the compliance signal and the host-count trend) plus the catalogue version and generation stamp. `engine` is a catalogue engine slug as published in `engine` on the list; an unknown slug is a 404. Market tier.
List the software library (Market) The signature catalogue's PRODUCT taxonomy joined to what the network shows: for every engine, its display name, vendor, category and homepage, the current host count broken down by observed role, when it was first and last seen, a compliance signal for the seats running it, and a host-count trend of up to 90 UTC days. Every catalogue engine appears, including one the network does not currently show (`hosts: 0`, a flat trend) — the library is the catalogue, not only today's sightings. `category` is the vendor's own framing; `roles` is the OBSERVED fact and…