What you get#
Onekey exposes deps.dev as 5 endpoints behind one API key: 3 endpoints return one record (data is an object) and 2 endpoints return a list (data is an array). Every answer uses the same envelope (success, data, metadata, error), the cost is reported in metadata.credits_charged, and fields are mapped onto the unified schema so the code you write for deps.dev also works for the rest of the developer platforms category.
Endpoints#
| Endpoint | What it does | Parameters | Credits | Status |
|---|---|---|---|---|
advisory | Details of a security advisory by id (deps.dev). | id* | 1 | stable |
dependencies | Resolved dependency graph nodes of a package version (deps.dev). | system*, name*, version* | 5 | stable |
package | Versions of a package with publish dates (deps.dev). | system*, name* | 5 | stable |
project | Repository health, stars and OpenSSF scorecard of a source project (deps.dev). | project* | 1 | stable |
version | Metadata of one package version incl. licenses and advisories (deps.dev). | system*, name*, version* | 1 | stable |
A * marks a required parameter. Each endpoint name links to its reference page with the full parameter table, caching window and a recorded response.
Make a request#
This calls depsdev.advisory (1 credit, stable). Replace YOUR_API_KEY with your key; sign up, no card. 1,000 free credits cover the open-platform endpoints. Hard-to-reach platforms (X, TikTok, Instagram, Reddit, and others marked on their page) need a verified email and a purchased pack.
curl "https://api.onekey.dev/v1/depsdev/advisory?id=GHSA-9wx4-h78v-vm56" \
-H "x-api-key: YOUR_API_KEY"Fields you get back#
These unified fields come back from deps.dev, with the same names as on every other platform. The count is how many of its 5 mapped endpoints return the field; a field the source lacks is null, never missing. 10 platform-specific fields (ext.<name>) come on top, documented on each endpoint page.
| Field | Type | Endpoints |
|---|---|---|
entity.name | string | 3 |
package.version | string | 3 |
entity.createdAt | ISO 8601 date | 2 |
content.id | string | 1 |
content.title | string | 1 |
content.url | URL | 1 |
entity.description | string | 1 |
entity.id | string | 1 |
entity.stats.forks | integer | 1 |
entity.stats.openIssues | integer | 1 |
entity.stats.stars | integer | 1 |
package.deprecated | boolean | 1 |
package.homepageUrl | URL | 1 |
package.license | string | 1 |
The full schema is in Unified schema.
Pricing#
deps.dev calls cost 1 to 5 credits, flat per endpoint. Free when served from cache (0.2 credit for a cached response over 100 KB). Invalid, failed or not-found calls are not charged. See pricing for credit packs.