API

Free, no key, no sign-up. Limited to 120 requests a minute per IP address.

The best way to use it is to download the whole list and match it inside your own product. Your customers' app lists never leave your platform, and you never have to tell us what you're looking for.

Everything

GET https://m365rogueapps.com/v1/apps
GET https://m365rogueapps.com/v1/apps.csv

Only what's new

GET https://m365rogueapps.com/v1/apps?since=2026-11-01

Returns entries listed on or after that date. Run a full download now and then as well, because entries can be retired.

One app

GET https://m365rogueapps.com/v1/apps/{applicationId}

A 404 means it isn't listed, which doesn't mean it's safe.

Fields

id

Stable reference, such as MRA-2019-0007. The year is when it was found. Never reused.

app_id

Application (client) ID, lowercase.

name

Display name exactly as reported, including lookalike letters. Null if none was published.

status

rogue (built by attackers: disable it), abused (a legitimate product attackers often use: check who consented) or watch (Microsoft's own app that attackers also use: don't remove it, watch its sign-ins).

reason

Why it's listed, in a sentence or two.

categories

What attackers use it for, such as Mailbox theft or Contact harvesting. Empty if not stated.

publisher

Who publishes the app, if known.

owner_tenant_id

Tenant that owned the app, if reported. Often a compromised victim, so don't treat it as the attacker.

first_seen, last_seen

As reported by the source. A full date, a year or null.

scopes

Permissions reported by the source. Empty if none were.

reply_urls

Reported reply URLs. These can be live attacker infrastructure, so don't fetch them.

attributed_to

Threat actor named by the source, if any.

found_on

Earliest date on record for this app, and the year in its reference.

found_precision

day or year. If it's year, only the year in found_on means anything.

found_basis

Where the date came from: first_seen, last_seen, published (the date a source published it) or listed (the date it was added here).

evidence

Source, URL, note and the date we confirmed it names this app ID.

listed_on

Date added here. This is what since filters on.

Treat every string as untrusted when you display it. App names are chosen by attackers.