# Software Supply Chain Security API

> Independent SBOM and dependency checks for exact package versions: OSV advisory ranges, CISA KEV exposure, open-source licence policy, and publicly documented malicious-package advisories.

- Product: https://www.brainiac.software/api/software-security
- Docs: https://www.brainiac.software/api/software-security/docs
- OpenAPI: https://www.brainiac.software/api/software-security/openapi.json
- Contact: support@brainiac.software (https://www.brainiac.software/contact)

## Operations

- POST /api/v1/software-security/sbom-vulnerability-match — $0.08 USDC — Match SBOM vulnerabilities: Parse a CycloneDX or SPDX SBOM, or a component list, and classify each exact package version against OSV advisories as affected, unaffected, or unknown. A similar package name is not a match. Docs: https://www.brainiac.software/api/software-security/docs#software-security-sbom-vulnerability-match
- POST /api/v1/software-security/dependency-risk-report — $0.08 USDC — Report dependency risk: Summarise affected, unaffected, and unknown OSV advisory counts for each exact dependency version. No risk score is calculated. Docs: https://www.brainiac.software/api/software-security/docs#software-security-dependency-risk-report
- POST /api/v1/software-security/kev-exposure-check — $0.06 USDC — Check KEV exposure: Compare exact dependency versions with OSV advisories and the CISA Known Exploited Vulnerabilities catalog. A KEV entry is reported only when that CVE applies to the same package and version range. Docs: https://www.brainiac.software/api/software-security/docs#software-security-kev-exposure-check
- POST /api/v1/software-security/license-compatibility-check — $0.05 USDC — Check licence compatibility: Read licence identifiers declared in the SBOM or published by npm, PyPI, crates.io, or RubyGems, then compare them with the caller allow and deny policy. Missing identifiers are not treated as compatible. Docs: https://www.brainiac.software/api/software-security/docs#software-security-license-compatibility-check
- POST /api/v1/software-security/malicious-dependency-check — $0.06 USDC — Check malicious dependencies: Look for OSV malicious-package advisories that name the same ecosystem and package. No advisory does not mean the package is free of malware. Docs: https://www.brainiac.software/api/software-security/docs#software-security-malicious-dependency-check
- POST /api/v1/software-security/release-precheck — $0.15 USDC — Precheck release security: Combine exact-version OSV matches, CISA KEV exposure, licence policy, and malicious-package advisories into one release report. The report never approves a release. Docs: https://www.brainiac.software/api/software-security/docs#software-security-release-precheck