{ "openapi": "3.0.1", "info": { "title": "Upgrade X-Ray: npm & PyPI dependency update security diff", "description": "Supply-chain security check for npm & PyPI dependency updates (Dependabot, Renovate PRs). Diffs the published files of two versions or two lockfiles (package-lock, pnpm, uv, poetry, requirements): new install scripts, network, shell or eval calls, removed functions, new dependencies. Nothing is run.", "version": "0.1", "x-build-id": "LGEVfLucVdgUiGb2q" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/cybernative-ai~upgrade-xray/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/cybernative-ai~upgrade-xray/runs": { "post": { "operationId": "runs-sync-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/cybernative-ai~upgrade-xray/run-sync": { "post": { "operationId": "run-sync-cybernative-ai-upgrade-xray", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "packages": { "title": "Package updates", "type": "array", "description": "One update per line. Formats: \"npm:chalk@5.6.2..6.0.0\", \"pypi:requests@2.31.0..2.32.0\", \"pypi:requests==2.32.0\" (compared with the release before it) or just \"axios\" (previous release vs latest). Charged per package analysed.", "items": { "type": "string" } }, "ecosystem": { "title": "Default ecosystem", "enum": [ "npm", "pypi" ], "type": "string", "description": "Used for package lines without an \"npm:\" or \"pypi:\" prefix.", "default": "npm" }, "lockfileBefore": { "title": "Lockfile before the update (text)", "type": "string", "description": "Paste the old package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, uv.lock, poetry.lock or requirements.txt (up to 20 MB). With both lockfiles the run makes one lockfile report covering every changed package. Paste only a lockfile you are allowed to process, with credentials, tokens and signed URLs removed. It stays in this run's storage in your account; the names of packages proven to come from the public registry are sent to that registry, and nothing else is looked up." }, "lockfileAfter": { "title": "Lockfile after the update (text)", "type": "string", "description": "The new version of the same lockfile, under the same rules." }, "lockfileName": { "title": "Lockfile file name (optional)", "type": "string", "description": "Helps format detection, e.g. \"uv.lock\". Usually detected automatically." }, "assumePublicRegistry": { "title": "Entries without a recorded source come from the public registry", "type": "boolean", "description": "pnpm, Poetry, requirements files without an --index-url line and some npm lockfiles do not record where a package came from. Those entries are skipped (and listed) unless you confirm here that they all come from the public npm registry or PyPI. Leave this off if the project uses a private registry or mirror: their names would be sent to the public registry.", "default": false }, "includeAddedPackages": { "title": "Also scan packages that are new to the lockfile", "type": "boolean", "description": "New transitive packages are checked for install scripts and high-risk indicators.", "default": true }, "maxPackages": { "title": "Maximum packages per lockfile report", "minimum": 1, "maximum": 300, "type": "integer", "description": "Changes beyond this number are listed but not analysed.", "default": 150 }, "concurrency": { "title": "Parallel downloads", "minimum": 1, "maximum": 8, "type": "integer", "description": "How many packages are fetched and analysed at the same time.", "default": 4 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }