OSSVulns API

Read the feed's findings from your own tools, for example to pull them into DefectDojo, a SIEM or a ticket system. The API is read-only and returns JSON.

Authentication

Create a key under Settings (sign in first) and send it in an Authorization: Bearer header. Each key can make 1,000 requests a day (UTC); the X-RateLimit-Remaining header says how many are left.

GET /api/v1/findings

Findings in the order they were found, oldest first, a page at a time. To keep up with new findings, store each response's next_cursor and pass it as cursor next time; has_more says whether to ask again straight away. Findings are deleted 30 days after they're found (after 7 days when the AI review judged them not security, after half a year for commits it judged a vulnerability fix), so ask at least once a week.

curl -H "Authorization: Bearer $OSSVULNS_KEY" \
  "https://ossvulns.com/api/v1/findings?tracked=true&verdicts=vulnerability_fix,vulnerability_report&since=2026-10-01"

Parameter	Meaning
`since`	Findings found after this date or time (ISO 8601, e.g. 2026-10-01 or 2026-10-01T12:00:00Z). Default: the last 7 days.
`cursor`	The next_cursor of a previous response: the findings found after the last one it returned. Takes the place of since.
`limit`	Findings per page, 1 to 100. Default 50.
`repos`	Comma-separated repositories (owner/name). Default: all.
`tracked`	true: only your tracked repositories.
`verdicts`	Comma-separated AI verdicts: vulnerability_fix, vulnerability_report, dependency_security_update, hardening, not_security, unreviewed.
`severity`	Comma-separated severities: high, medium, low, unknown.
`source`	commit or notification. Default: both.

{
  "data": [
    {
      "id": "6ae344ae6a3c5187bf785bfb",
      "source": "commit",
      "repo": "apache/camel",
      "packages": ["pkg:maven/org.apache.camel/camel-core"],
      "title": "CAMEL-21234: Disable external entities in the XML route parser",
      "url": "https://github.com/apache/camel/commit/...",
      "details_url": "https://ossvulns.com/feed/6ae344ae6a3c5187bf785bfb",
      "date": "2026-10-28T14:02:00.000Z",
      "found_at": "2026-10-28T19:31:10.000Z",
      "severity": "high",
      "regex_severity": "high",
      "verdict": "vulnerability_fix",
      "cwe": "CWE-611",
      "ai_severity": "high",
      "confidence": "high",
      "summary": "Disables external XML entities in Camel's route parser, closing an XXE.",
      "fixed_in": "camel-4.8.2",
      "fixed_in_date": "2026-10-29T09:00:00.000Z",
      "matched_regexes": ["\\bXXE\\b"],
      "matching_text": "XXE",
      "commit": "..."
    }
  ],
  "next_cursor": "6ae344ae6a3c5187bf785bfb",
  "has_more": false
}

An example with made-up values.

Field	Meaning
`id`	The finding's id; its page is details_url.
`source`	commit (a commit message matched) or notification (a GitHub issue or pull request notification matched).
`repo, packages`	The GitHub repository, and the package URLs (purl) of the packages it publishes, from deps.dev.
`title, url, date`	The commit's first line or the notification's subject, its GitHub link, and its date.
`found_at`	When OSSVulns found it; results are in this order.
`verdict, summary, cwe, ai_severity, confidence`	The AI review (Claude Haiku), made from the text alone: it can be wrong. verdict is unreviewed until the review is done, usually within an hour.
`severity`	The AI's severity once reviewed (none for hardening or not security), the regex's until then; regex_severity is the regex's.
`fixed_in, fixed_in_date`	For a vulnerability fix: the first release tag that contains the commit, once there is one.
`matched_regexes, matching_text`	The security keyword regexes that matched, and the text they matched.
`suspected_manipulation`	true when the AI review suspects the text tries to steer automated tools, or pushes readers to install or run something. Alerts leave these out.
`commit / thread, author, author_association`	The commit hash; for a notification, its issue or pull request link, who wrote it, and their role in the repo from GitHub (OWNER, MEMBER and COLLABORATOR are maintainers; NONE and FIRST_TIMER are outside users, whose claims nobody has checked).

GET /api/v1/findings/{id}

One finding, with the same fields and text, the full commit message or notification text.

RSS feeds

/api/rss is an RSS feed of the newest 50 findings, filtered with repos, verdicts, severity (numbers: 3 high, 2 medium, 1 low, 0 unknown) and kinds (commit, email). The feed page's RSS button gives the link for its current filters. Signed in, Settings has a personal feed of your tracked repositories.

Alerts, Slack and Teams

To be told about new findings instead of asking, switch on alerts: an email, and a Slack or Microsoft Teams webhook message, after each scan that finds something new.