# OSV on Onekey

> 3 endpoints for OSV (3 stable, 0 beta), 1 to 5 credits each. Category: Developer platforms. One key, one JSON shape.

Base URL: https://api.onekey.dev
Auth: header `x-api-key: <key>`. Call shape: `GET /v1/{platform}/{endpoint}?{params}`.
Every response is `{success, data, metadata, error}`; check `success` first. Cost is in `metadata.credits_charged`. Free when served from cache (0.2 credit for a cached response over 100 KB). Failed and not-found calls are refunded.
Status: stable = verified against the live source; beta = not yet verified, fields may be missing.

Page: https://onekey.dev/platforms/osv
Reference (Markdown): https://onekey.dev/docs/api/osv.md
All docs: https://onekey.dev/llms.txt

## Canonical fields returned

Unified-schema fields (same names on every platform), with how many of the 3 mapped OSV endpoints return each:

- `content.createdAt` (ISO 8601 date): 3
- `content.id` (string): 3
- `content.text` (string): 3
- `content.title` (string): 3
- `content.updatedAt` (ISO 8601 date): 3
- plus 3 platform-specific fields under `ext.`

## Endpoints

### osv.query

All known vulnerabilities for a package (OSV.dev).
- Price: 5 credits per fresh call. Status: stable. Returns: a list.
- Request: `GET https://api.onekey.dev/v1/osv/query?name=requests&ecosystem=PyPI` with header `x-api-key: YOUR_API_KEY`
- Parameters:
  - `name` (string, required): Package name in the ecosystem
  - `ecosystem` (string, required): OSV ecosystem (case-sensitive)
- Fields returned: `content.id`, `content.title`, `content.text`, `content.createdAt`, `content.updatedAt`, `ext.aliases`
- Reference: https://onekey.dev/docs/api/osv/query.md

### osv.query_version

Vulnerabilities affecting one exact package version (OSV.dev).
- Price: 5 credits per fresh call. Status: stable. Returns: a list.
- Request: `GET https://api.onekey.dev/v1/osv/query_version?name=requests&ecosystem=PyPI&version=2.19.0` with header `x-api-key: YOUR_API_KEY`
- Parameters:
  - `name` (string, required): Package name in the ecosystem
  - `ecosystem` (string, required): OSV ecosystem (case-sensitive)
  - `version` (string, required): Exact version
- Fields returned: `content.id`, `content.title`, `content.text`, `content.createdAt`, `content.updatedAt`, `ext.aliases`
- Reference: https://onekey.dev/docs/api/osv/query_version.md

### osv.vulnerability

One vulnerability record by id (OSV.dev).
- Price: 1 credit per fresh call. Status: stable. Returns: one record.
- Request: `GET https://api.onekey.dev/v1/osv/vulnerability?id=GHSA-9wx4-h78v-vm56` with header `x-api-key: YOUR_API_KEY`
- Parameters:
  - `id` (string, required): Vulnerability id, e.g. GHSA-..., CVE-..., PYSEC-...
- Fields returned: `content.id`, `content.title`, `content.text`, `content.createdAt`, `content.updatedAt`, `ext.aliases`, `ext.severity`, `ext.references`
- Reference: https://onekey.dev/docs/api/osv/vulnerability.md

## Sample request

```bash
curl "https://api.onekey.dev/v1/osv/vulnerability?id=GHSA-9wx4-h78v-vm56" \
  -H "x-api-key: YOUR_API_KEY"
```