FilterLists vs Microsoft Security Response Center (MSRC)

FilterLists is Collin Barrett's independent, actively-maintained directory of filter and host lists used by adblockers, firewalls, and DNS sinkholes to block ads, trackers, malware, and other unwanted content. Its ASP.NET Core REST API serves the same catalog that powers the site -- filter lists, the domains/URLs they target, licenses, and maintainer info -- with an interactive Swagger UI for exploring the schema before writing a query. The API and site are fully free and keyless, open-sourced on GitHub with commits as recent as this week. The API lives entirely on a separate `api.filterlists.com` host -- the intuitive REST paths on the main `filterlists.com` domain just return the site's own SPA shell.

MSRC's CVRF API serves Microsoft's own machine-readable security-update bulletins: list every bulletin's ID and dates from `/updates`, then pull one full document by ID (e.g. "2026-Jan") from `/cvrf/{id}` -- as CVRF XML by default, or the same CVRF document serialised to JSON under an `Accept: application/json` header. It's a fully public, unauthenticated REST endpoint with no signup or key required, backing tools like the community MsrcSecurityUpdates PowerShell module. Two traps confirmed live: the OData-shaped response envelope is misleading (most `$filter`/`$top` syntax 500s, and there's no CVE-to-bulletin lookup at all), and the separately documented `/csaf/{id}` route rejected all 17 id formats probed with "Invalid ID format" -- so despite the CSAF branding, the JSON this API actually returns is CVRF, not CSAF. The old stored URL pointed at the unrelated Report Abuse API's developer page; the live developer portal for this security-updates API now redirects straight to its published OpenAPI/Swagger definition.