{"openapi":"3.1.0","info":{"title":"Software Supply Chain Security API","version":"1.0.0","description":"Independent SBOM and dependency checks for exact package versions: OSV advisory ranges, CISA KEV exposure, open-source licence policy, and publicly documented malicious-package advisories. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/software-security/sbom-vulnerability-match":{"post":{"operationId":"match_sbom_vulnerabilities","summary":"Match SBOM vulnerabilities","description":"Parse a CycloneDX or SPDX SBOM, or a component list, and classify each exact package version against OSV advisories as affected, unaffected, or unknown. A similar package name is not a match.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}}},"additionalProperties":false},"example":{"sbom":"{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"log4j-core\",\"version\":\"2.14.1\",\"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1\"}]}"}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"components":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"purl":{"type":"string"},"problem":{"type":"null"},"advisoriesOmitted":{"type":"number"},"advisories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"aliases":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"summary":{"type":"string"},"modified":{"type":"string"},"severity":{"type":"string"},"malicious":{"type":"boolean"}},"additionalProperties":true}}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"components":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","problem":null,"advisoriesOmitted":0,"advisories":[{"id":"GHSA-jfh8-c2jp-5v3q","aliases":["CVE-2021-44228"],"status":"affected","summary":"Remote code execution in Log4j","modified":"2021-12-18T00:00:00Z","severity":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","malicious":false}]}],"warnings":["4 advisories were not read."],"sources":[{"source":"OSV","url":"https://api.osv.dev/v1/querybatch","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"Public source response."}],"limitations":["Matching uses the exact ecosystem, package name, and exact version. A similar package name is not a match."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.08"},"protocols":[{"x402":{}}]}}},"/api/v1/software-security/dependency-risk-report":{"post":{"operationId":"report_dependency_risk","summary":"Report dependency risk","description":"Summarise affected, unaffected, and unknown OSV advisory counts for each exact dependency version. No risk score is calculated.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}}},"additionalProperties":false},"example":{"components":[{"ecosystem":"npm","name":"lodash","version":"4.17.21"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"components":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"purl":{"type":"string"},"problem":{"type":"null"},"versionState":{"type":"string"},"affectedCount":{"type":"number"},"unaffectedCount":{"type":"number"},"unknownCount":{"type":"number"},"affectedIds":{"type":"array","items":{"type":"string"}}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"components":[{"ecosystem":"npm","name":"lodash","version":"4.17.21","purl":"pkg:npm/lodash@4.17.21","problem":null,"versionState":"affected","affectedCount":1,"unaffectedCount":2,"unknownCount":0,"affectedIds":["GHSA-35jh-r3h4-6jhm"]}],"warnings":["Only the first 25 components were checked."],"sources":[{"source":"OSV","url":"https://api.osv.dev/v1/querybatch","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"Public source response."}],"limitations":["This report counts advisory statuses. It does not produce a risk score."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.08"},"protocols":[{"x402":{}}]}}},"/api/v1/software-security/kev-exposure-check":{"post":{"operationId":"check_kev_exposure","summary":"Check KEV exposure","description":"Compare exact dependency versions with OSV advisories and the CISA Known Exploited Vulnerabilities catalog. A KEV entry is reported only when that CVE applies to the same package and version range.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}}},"additionalProperties":false},"example":{"components":[{"purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"catalogVersion":{"type":"string"},"catalogReleasedAt":{"type":"string"},"exposures":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"advisoryId":{"type":"string"},"cveId":{"type":"string"},"versionStatus":{"type":"string"},"dateAdded":{"type":"string"},"vulnerabilityName":{"type":"string"},"knownRansomware":{"type":"string"}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"catalogVersion":"2026.11.02","catalogReleasedAt":"2026-11-02T00:00:00.000Z","exposures":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1","advisoryId":"GHSA-jfh8-c2jp-5v3q","cveId":"CVE-2021-44228","versionStatus":"affected","dateAdded":"2021-12-10","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","knownRansomware":"Known"}],"warnings":["Only the first 25 components were checked."],"sources":[{"source":"OSV","url":"https://api.osv.dev/v1/querybatch","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"Public source response."}],"limitations":["A KEV entry is reported only when an advisory for the exact package also carries that CVE id."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.06"},"protocols":[{"x402":{}}]}}},"/api/v1/software-security/license-compatibility-check":{"post":{"operationId":"check_licence_compatibility","summary":"Check licence compatibility","description":"Read licence identifiers declared in the SBOM or published by npm, PyPI, crates.io, or RubyGems, then compare them with the caller allow and deny policy. Missing identifiers are not treated as compatible.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}},"policy":{"type":"object","properties":{"allow":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}},"deny":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}}},"additionalProperties":false}},"additionalProperties":false},"example":{"components":[{"ecosystem":"npm","name":"lodash","version":"4.17.21"}],"policy":{"allow":["MIT","Apache-2.0"],"deny":["GPL-3.0-only"]}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"components":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"purl":{"type":"string"},"problem":{"type":"null"},"declaredLicense":{"type":"string"},"registryLicense":{"type":"string"},"registryStatus":{"type":"string"},"registryDetail":{"type":"null"},"policy":{"type":"string"}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"components":[{"ecosystem":"npm","name":"lodash","version":"4.17.21","purl":"pkg:npm/lodash@4.17.21","problem":null,"declaredLicense":"MIT","registryLicense":"MIT","registryStatus":"retrieved","registryDetail":null,"policy":"allowed"}],"warnings":["Only the first 25 components were checked."],"sources":[{"source":"Package registry","url":"https://registry.npmjs.org","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"npm, PyPI, crates.io, and RubyGems records are read when the ecosystem matches."}],"limitations":["Without an allow or deny policy, licences are reported and not judged compatible."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/software-security/malicious-dependency-check":{"post":{"operationId":"check_malicious_dependencies","summary":"Check malicious dependencies","description":"Look for OSV malicious-package advisories that name the same ecosystem and package. No advisory does not mean the package is free of malware.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}}},"additionalProperties":false},"example":{"components":[{"ecosystem":"npm","name":"lodash","version":"4.17.21"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"components":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"purl":{"type":"string"},"problem":{"type":"null"},"status":{"type":"string"},"advisories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"aliases":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"summary":{"type":"string"},"modified":{"type":"string"},"severity":{"type":"string"},"malicious":{"type":"boolean"}},"additionalProperties":true}}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"components":[{"ecosystem":"npm","name":"flatmap-stream","version":"0.1.1","purl":"pkg:npm/flatmap-stream@0.1.1","problem":null,"status":"advisory_matches_version","advisories":[{"id":"MAL-2025-20690","aliases":["MAL-2025-20690"],"status":"affected","summary":"Malicious code in flatmap-stream (npm)","modified":"2025-08-14T18:52:04Z","severity":"No severity score was published.","malicious":true}]}],"warnings":["4 advisories were not read."],"sources":[{"source":"OSV","url":"https://api.osv.dev/v1/querybatch","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"Public source response."}],"limitations":["no_advisory_found means no such advisory was returned. It does not mean the package is free of malware."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.06"},"protocols":[{"x402":{}}]}}},"/api/v1/software-security/release-precheck":{"post":{"operationId":"precheck_release_security","summary":"Precheck release security","description":"Combine exact-version OSV matches, CISA KEV exposure, licence policy, and malicious-package advisories into one release report. The report never approves a release.","tags":["software-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"sbom":{"type":"string","minLength":2,"maxLength":400000},"components":{"minItems":1,"maxItems":25,"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string","minLength":1,"maxLength":40},"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","minLength":1,"maxLength":100},"purl":{"type":"string","minLength":4,"maxLength":500},"license":{"type":"string","minLength":1,"maxLength":200}},"additionalProperties":false}},"policy":{"type":"object","properties":{"allow":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}},"deny":{"maxItems":30,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}}},"additionalProperties":false}},"additionalProperties":false},"example":{"sbom":"{\"bomFormat\":\"CycloneDX\",\"specVersion\":\"1.5\",\"components\":[{\"name\":\"lodash\",\"version\":\"4.17.21\",\"purl\":\"pkg:npm/lodash@4.17.21\",\"licenses\":[{\"license\":{\"id\":\"MIT\"}}]}]}","policy":{"allow":["MIT"],"deny":["GPL-3.0-only"]}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"retrievedAt":{"type":"string"},"truncated":{"type":"boolean"},"approvesRelease":{"type":"boolean"},"assessment":{"type":"string"},"components":{"type":"array","items":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"purl":{"type":"string"},"problem":{"type":"null"},"affectedIds":{"type":"array","items":{"type":"string"}},"unknownAdvisoryCount":{"type":"number"},"kevCves":{"type":"array","items":{"type":"string"}},"declaredLicense":{"type":"string"},"registryLicense":{"type":"string"},"registryStatus":{"type":"string"},"policy":{"type":"string"},"maliciousStatus":{"type":"string"}},"additionalProperties":true}},"warnings":{"type":"array","items":{"type":"string"}},"sources":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string"},"url":{"type":"string"},"retrievedAt":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}},"guidance":{"type":"string"}},"additionalProperties":true},"example":{"retrievedAt":"2026-11-02T18:00:00.000Z","truncated":false,"approvesRelease":false,"assessment":"issues_observed","components":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","problem":null,"affectedIds":["GHSA-jfh8-c2jp-5v3q"],"unknownAdvisoryCount":2,"kevCves":["CVE-2021-44228"],"declaredLicense":"Apache-2.0","registryLicense":"Apache-2.0","registryStatus":"retrieved","policy":"allowed","maliciousStatus":"no_advisory_found"}],"warnings":["2 advisory documents were not read."],"sources":[{"source":"OSV","url":"https://api.osv.dev/v1/querybatch","retrievedAt":"2026-11-02T18:00:00.000Z","status":"ok","detail":"Public source response."}],"limitations":["no_issues_observed means the completed checks did not observe an affected advisory, KEV exposure, licence conflict, or malicious-package match. It is not a release approval."],"guidance":"Do not release, deploy, or mark a dependency safe because an advisory was absent or a version range was unknown."}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.15"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}