{ "openapi": "3.0.1", "info": { "title": "Package Vulnerabilities Scanner - OSV (npm, PyPI, Maven, Go)", "description": "Check open source packages or a lockfile against the OSV vulnerability database. One result per package: known vulnerabilities with CVE/GHSA ids, severity, fixed versions and a recommended upgrade. Free of API keys.", "version": "0.1", "x-build-id": "jza2iOOTKuXmEqu9s" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/far003~package-vulnerabilities-osv/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-far003-package-vulnerabilities-osv", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/far003~package-vulnerabilities-osv/runs": { "post": { "operationId": "runs-sync-far003-package-vulnerabilities-osv", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/far003~package-vulnerabilities-osv/run-sync": { "post": { "operationId": "run-sync-far003-package-vulnerabilities-osv", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "packages": { "title": "Packages", "type": "array", "description": "Packages to check, each with the EXACT version installed. Either an object {\"ecosystem\", \"name\", \"version\"} or a text line such as \"npm lodash 4.17.15\", \"PyPI django==3.2.0\", \"Maven org.apache.logging.log4j:log4j-core 2.14.1\" or a package URL \"pkg:npm/lodash@4.17.15\". Ecosystems: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex, Hackage, CRAN. A range (^1.2, >=2) or \"latest\" cannot be checked: you get a free error record telling you so. Names are normalised (PyPI case and underscores, Packagist case, spaces)." }, "manifestUrls": { "title": "Manifest or lockfile URLs", "type": "array", "description": "Public URLs of dependency files: package-lock.json, package.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, go.mod, Cargo.lock, Gemfile.lock, composer.lock. Use the raw file (GitHub and GitLab \"blob\" page links are converted to raw automatically). Lockfiles give exact versions and are the best input; package.json and requirements.txt only help for exact pins. Files must be public: a URL that asks for a login returns a free error record.", "items": { "type": "string" } }, "manifestText": { "title": "Pasted manifest or lockfile", "type": "string", "description": "Paste the content of a dependency file here (up to 8 MB). The format is detected from the content; set \"Manifest format\" if it cannot be told." }, "manifestFormat": { "title": "Manifest format", "enum": [ "auto", "package-lock.json", "package.json", "yarn.lock", "pnpm-lock.yaml", "requirements.txt", "poetry.lock", "Pipfile.lock", "go.mod", "Cargo.lock", "Gemfile.lock", "composer.lock" ], "type": "string", "description": "Format of the pasted text (and of URLs whose file name does not tell it). Auto-detect works for almost every file.", "default": "auto" }, "ecosystems": { "title": "Only these ecosystems", "type": "array", "description": "Check only packages of these ecosystems and skip the others (useful for a repository with several languages). Empty = all.", "items": { "type": "string", "enum": [ "npm", "PyPI", "Go", "Maven", "crates.io", "RubyGems", "NuGet", "Packagist", "Pub", "Hex", "Hackage", "CRAN" ] } }, "minSeverity": { "title": "Minimum severity", "enum": [ "any", "low", "medium", "high", "critical" ], "type": "string", "description": "Keep only vulnerabilities of at least this severity (low, medium, high, critical). Severity is the CVSS rating computed from the advisory's vector (or the database's own label when there is no vector). Advisories with NO severity at all are kept, because they cannot be shown to be low.", "default": "any" }, "onlyVulnerable": { "title": "Only packages with vulnerabilities", "type": "boolean", "description": "Leave out packages that have no vulnerability to show (clean ones, and ones whose advisories are all under the minimum severity). They are not delivered and not charged. Off by default, because \"checked and clean\" is a useful answer.", "default": false }, "includeDevDependencies": { "title": "Include dev dependencies", "type": "boolean", "description": "Lockfiles that mark development-only packages (package-lock.json, poetry.lock, Pipfile.lock, composer.lock, package.json). Turn off to check only what ships to production.", "default": true }, "includeWithdrawn": { "title": "Include withdrawn advisories", "type": "boolean", "description": "OSV already leaves withdrawn advisories out of its answers. If one is withdrawn between the lookup and the read of its details it is dropped here unless this is on.", "default": false }, "includeDetails": { "title": "Include full advisory text", "type": "boolean", "description": "Add the long description (first 4,000 characters) of each advisory. Off by default to keep results small; every advisory always has its summary and links.", "default": false }, "dedupePackages": { "title": "Merge duplicate packages", "type": "boolean", "description": "A package that appears several times (in different files or at different places of a lockfile) with the same version is checked and charged once, and lists where it was found. Turn off to get one record per occurrence.", "default": true }, "maxPackages": { "title": "Maximum packages", "minimum": 1, "maximum": 20000, "type": "integer", "description": "Upper limit of different packages checked in one run (1 to 20,000). Packages above the limit are not checked and not charged; a free record tells you how many were left out.", "default": 1000 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }