Software Supply Chain Security API Documentation

Independent SBOM and dependency checks for exact package versions: OSV advisory ranges, CISA KEV exposure, open-source licence policy, and publicly documented malicious-package advisories. Payment is the exact USDC price on Base with x402.

{
  "sbom": "{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"log4j-core\",\"version\":\"2.14.1\",\"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"}]}"
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "components": [
    {
      "ecosystem": "Maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "version": "2.14.1",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
      "problem": null,
      "advisoriesOmitted": 0,
      "advisories": [
        {
          "id": "GHSA-jfh8-c2jp-5v3q",
          "aliases": [
            "CVE-2021-44228"
          ],
          "status": "affected",
          "summary": "Remote code execution in Log4j",
          "modified": "2021-12-18T00:00:00Z",
          "severity": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "malicious": false
        }
      ]
    }
  ],
  "warnings": [
    "4 advisories were not read."
  ],
  "sources": [
    {
      "source": "OSV",
      "url": "https://api.osv.dev/v1/querybatch",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "Public source response."
    }
  ],
  "limitations": [
    "Matching uses the exact ecosystem, package name, and exact version. A similar package name is not a match."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/sbom-vulnerability-match" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "sbom": "{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"log4j-core\",\"version\":\"2.14.1\",\"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"}]}"
}
JSON

{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ]
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "problem": null,
      "versionState": "affected",
      "affectedCount": 1,
      "unaffectedCount": 2,
      "unknownCount": 0,
      "affectedIds": [
        "GHSA-35jh-r3h4-6jhm"
      ]
    }
  ],
  "warnings": [
    "Only the first 25 components were checked."
  ],
  "sources": [
    {
      "source": "OSV",
      "url": "https://api.osv.dev/v1/querybatch",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "Public source response."
    }
  ],
  "limitations": [
    "This report counts advisory statuses. It does not produce a risk score."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/dependency-risk-report" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ]
}
JSON

{
  "components": [
    {
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
    }
  ]
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "catalogVersion": "2026.11.02",
  "catalogReleasedAt": "2026-11-02T00:00:00.000Z",
  "exposures": [
    {
      "ecosystem": "Maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "version": "2.14.1",
      "advisoryId": "GHSA-jfh8-c2jp-5v3q",
      "cveId": "CVE-2021-44228",
      "versionStatus": "affected",
      "dateAdded": "2021-12-10",
      "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
      "knownRansomware": "Known"
    }
  ],
  "warnings": [
    "Only the first 25 components were checked."
  ],
  "sources": [
    {
      "source": "OSV",
      "url": "https://api.osv.dev/v1/querybatch",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "Public source response."
    }
  ],
  "limitations": [
    "A KEV entry is reported only when an advisory for the exact package also carries that CVE id."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/kev-exposure-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "components": [
    {
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
    }
  ]
}
JSON

{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ],
  "policy": {
    "allow": [
      "MIT",
      "Apache-2.0"
    ],
    "deny": [
      "GPL-3.0-only"
    ]
  }
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "problem": null,
      "declaredLicense": "MIT",
      "registryLicense": "MIT",
      "registryStatus": "retrieved",
      "registryDetail": null,
      "policy": "allowed"
    }
  ],
  "warnings": [
    "Only the first 25 components were checked."
  ],
  "sources": [
    {
      "source": "Package registry",
      "url": "https://registry.npmjs.org",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "npm, PyPI, crates.io, and RubyGems records are read when the ecosystem matches."
    }
  ],
  "limitations": [
    "Without an allow or deny policy, licences are reported and not judged compatible."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/license-compatibility-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ],
  "policy": {
    "allow": [
      "MIT",
      "Apache-2.0"
    ],
    "deny": [
      "GPL-3.0-only"
    ]
  }
}
JSON

{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ]
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "components": [
    {
      "ecosystem": "npm",
      "name": "flatmap-stream",
      "version": "0.1.1",
      "purl": "pkg:npm/flatmap-stream@0.1.1",
      "problem": null,
      "status": "advisory_matches_version",
      "advisories": [
        {
          "id": "MAL-2025-20690",
          "aliases": [
            "MAL-2025-20690"
          ],
          "status": "affected",
          "summary": "Malicious code in flatmap-stream (npm)",
          "modified": "2025-08-14T18:52:04Z",
          "severity": "No severity score was published.",
          "malicious": true
        }
      ]
    }
  ],
  "warnings": [
    "4 advisories were not read."
  ],
  "sources": [
    {
      "source": "OSV",
      "url": "https://api.osv.dev/v1/querybatch",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "Public source response."
    }
  ],
  "limitations": [
    "no_advisory_found means no such advisory was returned. It does not mean the package is free of malware."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/malicious-dependency-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "components": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ]
}
JSON

{
  "sbom": "{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"lodash\",\"version\":\"4.17.21\",\"purl\":\"pkg:npm/lodash@4.17.21\",\"licenses\":[{\"license\":{\"id\":\"MIT\"}}]}]}",
  "policy": {
    "allow": [
      "MIT"
    ],
    "deny": [
      "GPL-3.0-only"
    ]
  }
}

{
  "retrievedAt": "2026-11-02T18:00:00.000Z",
  "truncated": false,
  "approvesRelease": false,
  "assessment": "issues_observed",
  "components": [
    {
      "ecosystem": "Maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "version": "2.14.1",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
      "problem": null,
      "affectedIds": [
        "GHSA-jfh8-c2jp-5v3q"
      ],
      "unknownAdvisoryCount": 2,
      "kevCves": [
        "CVE-2021-44228"
      ],
      "declaredLicense": "Apache-2.0",
      "registryLicense": "Apache-2.0",
      "registryStatus": "retrieved",
      "policy": "allowed",
      "maliciousStatus": "no_advisory_found"
    }
  ],
  "warnings": [
    "2 advisory documents were not read."
  ],
  "sources": [
    {
      "source": "OSV",
      "url": "https://api.osv.dev/v1/querybatch",
      "retrievedAt": "2026-11-02T18:00:00.000Z",
      "status": "ok",
      "detail": "Public source response."
    }
  ],
  "limitations": [
    "no_issues_observed means the completed checks did not observe an affected advisory, KEV exposure, licence conflict, or malicious-package match. It is not a release approval."
  ],
  "guidance": "Do not release, deploy, or mark a dependency safe because an advisory was absent or a version range was unknown."
}

curl -i -X POST "https://brainiac.software/api/v1/software-security/release-security-precheck" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "sbom": "{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"lodash\",\"version\":\"4.17.21\",\"purl\":\"pkg:npm/lodash@4.17.21\",\"licenses\":[{\"license\":{\"id\":\"MIT\"}}]}]}",
  "policy": {
    "allow": [
      "MIT"
    ],
    "deny": [
      "GPL-3.0-only"
    ]
  }
}
JSON