Developer and open-source intelligence

The problem#

A dependency review touches GitHub, npm and PyPI, each with a different API and rate limit. Answering "is this project still maintained, and is my pinned version safe?" for dozens of packages becomes a maintenance job of its own.

Onekey puts those registries behind one key and one schema.

Endpoints to call#

Each endpoint name links to its reference page with every parameter, the caching window and a recorded response.

Your first call#

This is github.repo (1 credit). Replace YOUR_API_KEY with your key; sign up, no card. 1,000 free credits cover the open-platform endpoints. Hard-to-reach platforms (X, TikTok, Instagram, Reddit, and others marked on their page) need a verified email and a purchased pack.

curl "https://api.onekey.dev/v1/github/repo?owner=facebook&repo=react" \
  -H "x-api-key: YOUR_API_KEY"

A working script#

A dependency report: repository health from GitHub, adoption from npm, and vulnerability checks for pinned Python versions.

import os
import requests

API = "https://api.onekey.dev"
HEADERS = {"x-api-key": os.environ["ONEKEY_KEY"]}


def call(path, **params):
    """GET /v1/<platform>/<endpoint>; returns the data or raises with the error code."""
    r = requests.get(f"{API}/v1/{path}", params=params, headers=HEADERS, timeout=30)
    body = r.json()
    if not body["success"]:
        raise RuntimeError(f"{path}: {body['error']['code']}")
    return body["data"]


def get(item, field):
    """get(item, 'content.title'): a field of the unified schema, or None."""
    for key in field.split("."):
        item = (item or {}).get(key)
    return item


for owner, repo in [("facebook", "react"), ("psf", "requests")]:
    r = call("github/repo", owner=owner, repo=repo)
    rel = call("github/latest_release", owner=owner, repo=repo)
    print(
        get(r, "entity.name"),
        "stars", get(r, "entity.stats.stars"),
        "open issues", get(r, "entity.stats.openIssues"),
        "last push", get(r, "package.pushedAt"),
        "latest release", get(rel, "content.title"),
    )

print("react downloads:", get(call("npm/downloads", name="react"), "entity.stats.downloads"))

PINNED = {"requests": "2.31.0"}
for name, version in PINNED.items():
    latest = get(call("pypi/package", name=name), "package.version")
    vulns = call("pypi/vulnerabilities", name=name, version=version)
    print(f"{name} {version} (latest {latest}): {len(vulns)} known vulnerabilities")
    for v in vulns:
        print("  ", get(v, "content.id"), get(v, "content.title"), "fixed in", get(v, "ext.fixedIn"))

What a month costs#

Illustrative volume, not a benchmark: 40 dependencies, each with a GitHub repository and an npm package, checked daily for 30 days; the 40 pinned Python packages checked for vulnerabilities once a week.

About 4,400 credits: the Starter pack (5,000 credits, $9) covers it, at $1.80 per 1,000 credits. Prices are in USD (regional pricing is planned); credits never expire. See pricing.

Every figure above assumes every call is a fresh fetch. These endpoints cache for 30 seconds to 1 hour. Free when served from cache (0.2 credit for a cached response over 100 KB). Repeating a call inside that window costs nothing. Invalid, failed and not-found calls are not charged either.

Good to know#

• Vulnerability data is whatever the public source lists for the exact release you ask about; an empty list means none are recorded, not that the release is proven safe.
• Reading your own private repositories is not something this API does. It serves public data only.

Keep reading#

• Idempotency
• Rate limits
• Unified schema
• Platform pages: GitHub, npm, PyPI