OSPulse documentation
OSPulse finds the open-source dependencies that are drifting, decaying, or compromised — across your entire estate, before a CVE exists. These docs cover the REST API, the CLI, and the concepts behind the platform.
Quickstart
Create a token and make your first authenticated call in under five minutes.
Authentication
How API tokens work — creating, scoping, using, and rotating them.
Scan a repository
Import a repository, trigger a scan, and read the risk summary.
API Reference
Every endpoint, request, and response — interactive and always current.
Base URL
All API requests go to https://api.ospulse.app. Every endpoint is versioned under /api/v1/.
Browse the documentation
Get Started
From zero to your first authenticated API call.
- IntroductionWhat OSPulse is and how the platform fits together.
- QuickstartMake your first authenticated API call in under five minutes.
- AuthenticationCreate, use, scope, and rotate API tokens.
- Scan your first repositoryImport a repository, run a scan, and read the results.
Concepts
The mental model behind the platform.
- How health scoring worksThe signals behind a package health score and how to read one.
- Dependency driftWhy healthy dependencies quietly become liabilities.
- Threat intelligenceThe feeds OSPulse aggregates and how compromises are detected.
- Ecosystems & parsingSupported registries, manifests, and lockfiles.
- Alerts & severityHow findings become alerts, and how severity is assigned.
- Policies & gatesEncode your risk appetite and enforce it in CI.
- Scans & the scan lifecycleWhat happens between triggering a scan and reading results.
- Tenancy & accessTenants, users, roles, and how isolation works.
Guides
Task-oriented recipes for common integrations.
- Import a repositoryConnect GitHub, GitLab, Azure DevOps, or Bitbucket.
- Scan in CI/CDFail builds on risky dependencies with GitHub Actions and friends.
- Monitor packages continuouslyWatch packages and react to health changes over time.
- Consume and triage alertsPull alerts, filter by severity, and resolve them.
- Enforce policy gatesAuthor policies, test them, and grant exceptions.
- Generate an SBOMProduce CycloneDX and SPDX bills of materials.
- CRA compliance workflowMap obligations, track duties, and export evidence.
- Quantum readiness auditInventory quantum-vulnerable cryptography across your estate.
- Export data to a warehouseStream OSPulse data into your analytics stack.
- SSO & SCIM provisioningWire up enterprise identity and automated user lifecycle.
API Reference
The complete, generated reference for every endpoint.
- OverviewBase URL, environments, and how to read this reference.
- Explore all endpointsFull interactive reference for all endpoints.
- ConventionsJSON shapes, casing, dates, IDs, and correlation IDs.
- ErrorsStatus codes and the RFC 7807 problem-details body.
- PaginationPaging through large collections with take and skip.
- Filtering & sortingNarrow and order collection responses.
- Rate limitsLimits, headers, and how to back off correctly.
- Retries & idempotencyWhich requests are safe to retry, and how to retry them.
- WebhooksInbound source-control ingest and signature verification.
- Versioning & deprecationWhat we promise about breaking changes.
SDKs & Tools
Client libraries, the CLI, and CI integrations.
- SDK overviewChoosing a client library and what each supports.
- OSPulse CLIScan, watch, and gate from your terminal or CI runner.
- OpenAPI specificationThe machine-readable contract behind this reference.
Resources
Support, status, and machine-readable docs.
- SupportHow to get help and report security issues.
- Docs for AI agentsllms.txt, markdown endpoints, and agent-friendly access.