---
name: first-epss-ingestion
description: "How to get FIRST EPSS Scores API data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load selected FIRST EPSS scores into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/first-epss
Provider: https://api.first.org/epss
Checked against the provider's documentation: 2026-11-01

## Access
- No account, registration or key. Use the CVE query parameter for one CVE or a small comma-separated batch.

## Request
```bash
curl 'https://api.first.org/data/v1/epss?cve=CVE-2021-44228,CVE-2023-44487,CVE-2024-3094'
```

## Format
JSON response metadata and rows containing CVE ID, EPSS probability, percentile and score date.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""Selected FIRST EPSS scores -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://api.first.org/data/v1/epss"
CVES = "CVE-2021-44228,CVE-2023-44487,CVE-2024-3094"
r = requests.get(URL, params={"cve": CVES}, timeout=60)
r.raise_for_status()
df = pd.DataFrame(r.json()["data"])
df["epss"] = pd.to_numeric(df["epss"])
df["percentile"] = pd.to_numeric(df["percentile"])
df["date"] = pd.to_datetime(df["date"], utc=True)
df.to_parquet("first_epss.parquet", index=False)
print(len(df), "scores", df["date"].min().date().isoformat(),
      "maximum", f'{df["epss"].max():.6f}')
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 3 scores 2026-11-01 maximum 0.999990

## Limits
- Public endpoints are limited to 1,000 requests per minute.
- The CVE filter accepts at most 2,000 characters including commas; the global page limit is 10,000 records.
- FIRST says the API is for lookup, not bulk synchronization; use the daily CSV for the complete current population.

## Quirks
- EPSS is a probability of observed exploitation activity in the next 30 days, not a severity score.
- percentile is relative to the currently scored population and can move even when a CVE's probability changes little.
- Historical score series cross several model versions, which can create discontinuities unrelated to a vulnerability-specific event.

## Terms and attribution
- FIRST publishes EPSS scores free of charge with no registration required.
- The service-content licence is limited to vulnerability disclosure, cybersecurity incident response or preventative cybersecurity uses; attribution is requested for publications or products.
- Terms page: https://www.first.org/about/policies/terms

## Sources
- https://www.first.org/epss/data: "EPSS scores are published daily, free of charge, with no registration required."
- https://api.first.org/: "Public endpoints without authentication are limited to 1000 requests per minute."
- https://api.first.org/epss: "The maximum size accepted for this parameter is 2000 characters (including commas)."
- https://www.first.org/epss/faq: "Attribution is requested when EPSS data is used in publications or products."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.