{ "openapi": "3.0.1", "info": { "title": "Dependency Vulnerability Scanner: CVE, KEV, EPSS", "description": "Scan npm, PyPI, Maven, Go and other package versions for CVE vulnerabilities with OSV. A dependency security audit and CVE lookup with one row per package: worst severity, CVE IDs, CISA KEV flag, EPSS score, fixed version and end of life status. Reads package.json and requirements.txt.", "version": "0.1", "x-build-id": "NbFHGw9KP4d9KWVIb" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/maliksaid~dependency-vulnerability-audit/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-maliksaid-dependency-vulnerability-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/maliksaid~dependency-vulnerability-audit/runs": { "post": { "operationId": "runs-sync-maliksaid-dependency-vulnerability-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/maliksaid~dependency-vulnerability-audit/run-sync": { "post": { "operationId": "run-sync-maliksaid-dependency-vulnerability-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "packages": { "title": "Packages", "type": "array", "description": "One package version per line. Use ecosystem:name@version, for example npm:lodash@4.17.15, PyPI:django@3.2.0 or Maven:org.apache.logging.log4j:log4j-core@2.14.1. Package URLs such as pkg:npm/lodash@4.17.15 also work. Ecosystems: npm, PyPI, Maven, Go, NuGet, crates.io, RubyGems, Packagist, Pub, Hex. Leave every input empty to check a small sample list.", "items": { "type": "string" } }, "packageJson": { "title": "package.json or package-lock.json", "type": "string", "description": "Paste the content of a package.json or package-lock.json file. From package.json the Actor uses the base version of each range, so ^4.17.1 is checked as 4.17.1. A package-lock.json gives the exact installed versions." }, "requirementsTxt": { "title": "requirements.txt", "type": "string", "description": "Paste the content of a Python requirements.txt file. The Actor checks lines pinned with == (for example django==3.2.0) and skips the rest." }, "includeDevDependencies": { "title": "Include devDependencies", "type": "boolean", "description": "Check devDependencies from package.json and dev packages from package-lock.json.", "default": true }, "products": { "title": "Products for end-of-life checks", "type": "array", "description": "Runtimes, frameworks, databases or operating systems to check on endoflife.date. Use the endoflife.date product name and a version, for example nodejs@18, python@3.8, postgresql@12, ubuntu@20.04 or php@7.4.", "items": { "type": "string" } }, "checkEol": { "title": "Check end-of-life status", "type": "boolean", "description": "Add endoflife.date status to products and to packages that endoflife.date tracks (for example django, express, angular, spring-boot).", "default": true }, "includeKev": { "title": "Check CISA KEV", "type": "boolean", "description": "Flag CVEs that are in the CISA Known Exploited Vulnerabilities catalog.", "default": true }, "includePackageInfo": { "title": "Add latest version, license and deprecation", "type": "boolean", "description": "Read the latest version, license and deprecation flag from the public npm and PyPI registries. PyPI yanked releases count as deprecated. Other ecosystems return empty fields.", "default": true }, "includeEpss": { "title": "Add EPSS scores", "type": "boolean", "description": "Add the FIRST EPSS exploit probability for each CVE.", "default": true }, "onlyAtRisk": { "title": "Only packages at risk", "type": "boolean", "description": "Save only rows with at least one known vulnerability or an end-of-life release. Clean rows are not saved and not charged.", "default": false }, "monitorMode": { "title": "Monitor mode (only changes)", "type": "boolean", "description": "Return a package or product only when its advisories, KEV status or end-of-life status changed since earlier monitor-mode runs with the same state key. Schedule the Actor with this on to get alerts.", "default": false }, "stateKey": { "title": "Monitor state key", "type": "string", "description": "Name of the memory that monitor mode uses. Use a different key for each project.", "default": "default" }, "maxItems": { "title": "Maximum rows", "minimum": 0, "type": "integer", "description": "Stop after saving this many rows. Set 0 for no limit.", "default": 100 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }