osv.query

stable Advanced

All known vulnerabilities for a package (OSV.dev).

GET /v1/osv/query

What you get#

A list of Osv results in Onekey's unified shape, in data (an array). An empty array is a normal, successful answer and is charged like any other; a source that reports "nothing found" as an error returns a free 404 not_found instead.

What it costs#

Advanced · 5 credits for a fresh fetch, charged only when it succeeds.
Free when served from cache (0.2 credit for a cached response over 100 KB).
Free if the request is invalid (never charged) or the source fails or reports not found (refunded).

Parameters#

Name	Type	Required	Default	What it is	Constraints
`name`	string	yes	(required)	Package name in the ecosystem	max 200 chars; must match `[A-Za-z0-9@][A-Za-z0-9@_./:+-]{0,199}`; trimmed
`ecosystem`	string	yes	(required)	OSV ecosystem (case-sensitive)	max 12 chars; must match `npm\|PyPI\|Go\|crates\.io\|Maven\|NuGet\|RubyGems\|Packagist\|Pub\|Hex\|Debian\|Alpine\|Ubuntu`; trimmed

Request#

curl "https://api.onekey.dev/v1/osv/query?name=requests&ecosystem=PyPI" \
  -H "x-api-key: YOUR_API_KEY"

Try it

Add your key to run this call right here. No key? Get one free. The key stays in this tab.

Recorded response#

A real Osv response, recorded and returned in Onekey's shape. Fields the platform does not provide are null.

json

{
  "success": true,
  "data": [
    {
      "content": {
        "id": "GHSA-652x-xj99-gmcc",
        "title": "Exposure of Sensitive Information to an Unauthorized Actor in Requests",
        "text": "Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.",
        "createdAt": "2022-05-14T02:09:22Z",
        "updatedAt": "2024-10-21T22:22:54Z"
      },
      "ext": {
        "aliases": [
          "CVE-2014-1830",
          "PYSEC-2014-14"
        ]
      }
    },
    {
      "content": {
        "id": "GHSA-9hjg-9r4m-mvj7",
        "title": "Requests vulnerable to .netrc credentials leak via malicious URLs",
        "text": "### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2",
        "createdAt": "2025-06-09T19:06:08Z",
        "updatedAt": "2026-09-10T03:50:25Z"
      },
      "ext": {
        "aliases": [
          "CVE-2024-47081",
          "PYSEC-2026-1872"
        ]
      }
    }
  ],
  "metadata": {
    "platform": "osv",
    "endpoint": "query",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 5,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}

Field mapping#

How this endpoint's source fields become Onekey's unified schema. Fields the source lacks come back as null.

Source path	Onekey field	Transform
`id`	`content.id`	-
`summary`	`content.title`	-
`details`	`content.text`	-
`published`	`content.createdAt`	`toIsoDate`
`modified`	`content.updatedAt`	`toIsoDate`
`aliases`	`ext.aliases`	-

Caching and freshness#

Fresh for about 2 minutes. Repeat calls in that window are served from cache and are free.
Between 2 minutes and 15 minutes the cached copy is still served instantly and marked stale: true while Onekey refreshes it in the background.
If the source is down when a refresh is needed, the last copy can be served for up to 1 hour more (marked stale).
A "not found" is remembered for 1 minute and is free.
The cache is shared across all customers, which is what keeps repeat calls cheap.

What can go wrong#

Status	Code	What to do
401	`unauthorized`	Check the `x-api-key` header.
402	`insufficient_credits`	Add credits; your balance must cover the price.
404	`not_found`	Unknown endpoint path.
422	`invalid_params`	Fix the parameters using the table above. Free.
429	`rate_limited`	Wait `Retry-After` seconds, then retry.
502	`upstream_error`	The source failed. Refunded; retry with backoff.

See Errors for the full list and retry guidance.

Status: stable (verified against the live source).