Skip to main content
fastcrw
All providers

OSV.dev

DeveloperUS

api.osv.dev

Open-source vulnerability records across npm, PyPI, Go, Maven, crates.io and more.

Try it nowRead the docs

Capabilities (3)

GET /v1/data/osv/ecosystem-advisories1 credit

Lists the advisory record filenames OSV publishes for one ecosystem, as {"items":[{"name":"PyPI/GHSA-xxxx.json"}, ...], "nextPageToken": "..."} - strip the prefix and the .json suffix to get ids you can pass to the vulnerability capability.

ecosystemmaxResults?pageToken?
GET /v1/data/osv/ecosystems1 credit

Lists every ecosystem partition in OSV's public vulnerability bucket as a GCS prefix array - AlmaLinux/, Alpine:v3.19/, Debian:12/, PyPI/, Red Hat/, crates.io-style names and so on - 102 of them as of 2026-10-21, split over two pages.

pageToken?
GET /v1/data/osv/vulnerability1 credit

Returns one vulnerability record in OSV schema: summary and details, aliases and related ids across databases, severity vectors, references, database-specific metadata, and the affected package list with per-ecosystem introduced/fixed version ranges.

id

Licence

OSV data is published under CC BY 4.0 by the Open Source Vulnerabilities project (Google OSS).

https://github.com/google/osv.dev

Attribution

Display this wherever you show the data. It arrives on every response as provenance.attribution_text.

Source: OSV.dev

Cache: up to 3600s

Read the docsBack to the catalog