{ "openapi": "3.0.1", "info": { "title": "Upgrade X-Ray: npm & PyPI dependency update security diff", "description": "In seconds, at $0.02 per package diff or $0.25 per lockfile report, see what a dependency update changes in its published files (install scripts; network, shell or eval calls; removed exports; new dependencies) without installing it. Supply-chain security for Dependabot/Renovate and package-lock.", "version": "0.1", "x-build-id": "8CyTxsA9npfLXXdmp" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/cybernative-ai~upgrade-xray/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/cybernative-ai~upgrade-xray/runs": { "post": { "operationId": "runs-sync-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/cybernative-ai~upgrade-xray/run-sync": { "post": { "operationId": "run-sync-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "packages": { "title": "Package updates", "type": "array", "description": "One update per line. Formats: \"npm:chalk@5.6.2..6.0.0\", \"pypi:requests@2.31.0..2.32.0\", \"pypi:requests==2.32.0\" (compared with the release before it) or just \"axios\" (previous release vs latest). $0.02 per package analysed; a package that cannot be analysed is not charged.", "items": { "type": "string" } }, "ecosystem": { "title": "Default ecosystem", "enum": [ "npm", "pypi" ], "type": "string", "description": "Used for package lines without an \"npm:\" or \"pypi:\" prefix.", "default": "npm" }, "lockfileBefore": { "title": "Lockfile before the update (text)", "type": "string", "description": "Paste the old package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, uv.lock, poetry.lock or requirements.txt (up to 20 MB). With both lockfiles the run makes one lockfile report covering every changed package ($0.25, charged only if at least one package is analysed). From an AI agent or MCP client, the whole text of both files goes into the call; for lockfiles over about 20 KB, list the changed packages in \"packages\" instead (one per line, e.g. \"npm:chalk@5.6.2..6.0.0\"). Paste only a lockfile you are allowed to process, with credentials, tokens and signed URLs removed. It stays in this run's storage in your account; the names of packages proven to come from the public registry are sent to that registry, and nothing else is looked up." }, "lockfileAfter": { "title": "Lockfile after the update (text)", "type": "string", "description": "The new version of the same lockfile, under the same rules." }, "lockfileName": { "title": "Lockfile file name (optional)", "type": "string", "description": "Helps format detection, e.g. \"uv.lock\". Usually detected automatically." }, "assumePublicRegistry": { "title": "Entries without a recorded source come from the public registry", "type": "boolean", "description": "pnpm, Yarn 2 and later, bun, Poetry, requirements files without an --index-url line and some npm lockfiles do not record where a package came from. Those entries are skipped (and listed) unless you confirm here that they all come from the public npm registry or PyPI. Leave this off if the project uses a private registry or mirror: their names would be sent to the public registry.", "default": false }, "includeAddedPackages": { "title": "Also scan packages that are new to the lockfile", "type": "boolean", "description": "New transitive packages are checked for install scripts and high-risk indicators.", "default": true }, "maxPackages": { "title": "Maximum packages per lockfile report", "minimum": 1, "maximum": 300, "type": "integer", "description": "Changes beyond this number are listed but not analysed.", "default": 150 }, "concurrency": { "title": "Parallel downloads", "minimum": 1, "maximum": 8, "type": "integer", "description": "How many packages are fetched and analysed at the same time.", "default": 4 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }