# OSPulse

> OSPulse is a dependency drift and open-source supply-chain intelligence platform. It scores the health of open-source packages, detects compromised dependencies across 10+ threat-intelligence feeds, and enforces policy gates in CI. This file maps the documentation for LLMs and coding agents.

The REST API is at https://api.ospulse.app, versioned under /api/v1/, and authenticates
with `Authorization: Bearer {token}`. The machine-readable contract is at
https://ospulse.app/openapi.json (OpenAPI 3.0.1, 246 operations).

Every documentation page is available as Markdown by appending `index.md` to its URL.

## Documentation

- [API overview](https://ospulse.app/docs/api/index.md): Reference entry point for the OSPulse REST API: base URL, versioning prefix, authentication, content types, resource groups, and the OpenAPI source.
- [Conventions](https://ospulse.app/docs/api/conventions/index.md): Rules that hold across every OSPulse API endpoint: JSON encoding, camelCase fields, ISO-8601 UTC timestamps, GUID identifiers, enum handling, and HTTP verb semantics.
- [Errors](https://ospulse.app/docs/api/errors/index.md): Every status code the OSPulse API returns, the RFC 7807 problem details body, validation error shapes, worked examples, and a safe retry strategy with backoff.
- [Filtering & sorting](https://ospulse.app/docs/api/filtering/index.md): How OSPulse collection endpoints narrow results with per-endpoint query parameters, how filters combine with pagination, ordering behaviour, and URL-encoding rules.
- [Retries & idempotency](https://ospulse.app/docs/api/idempotency/index.md): Which OSPulse API requests are safe to repeat, how to retry transient failures without creating duplicates, and how to recover from an ambiguous response.
- [Pagination](https://ospulse.app/docs/api/pagination/index.md): How OSPulse collection endpoints page results with take and skip, what the items and totalEstimate envelope guarantees, and how to iterate a full collection safely.
- [Rate limits](https://ospulse.app/docs/api/rate-limits/index.md): How the OSPulse API rate limiter works — per-tenant and per-token buckets, the RateLimit response headers, exempt endpoints, and how to back off correctly.
- [Versioning & deprecation](https://ospulse.app/docs/api/versioning/index.md): How the OSPulse API is versioned, what counts as a breaking change, how to build a forward-compatible client, and what we commit to before removing anything.
- [Webhooks](https://ospulse.app/docs/api/webhooks/index.md): Inbound source-control webhooks that trigger OSPulse rescans on push, the headers and signatures each provider must send, and outbound webhook integrations.
- [Authentication](https://ospulse.app/docs/authentication/index.md): How OSPulse API tokens work: creating, listing, revoking and rotating bearer tokens, storing them safely, and interpreting 401 and 403 responses.
- [OSPulse CLI](https://ospulse.app/docs/cli/index.md): Scan projects, watch dependencies, and gate builds from a terminal or CI runner — authentication, output formats, exit codes, and pipeline usage.
- [Alerts & severity](https://ospulse.app/docs/concepts/alerts/index.md): How OSPulse turns findings into alerts: where alerts come from, the severity model, why exposure changes urgency, and the lifecycle from raised to resolved.
- [Dependency drift](https://ospulse.app/docs/concepts/dependency-drift/index.md): Dependencies you vetted once decay silently. The five kinds of drift, why CVE scanners cannot see them, and how OSPulse measures change over time.
- [Ecosystems and parsing](https://ospulse.app/docs/concepts/ecosystems/index.md): Which package ecosystems OSPulse understands, why lockfiles give exact transitive resolution, and what can and cannot be determined from a manifest alone.
- [How health scoring works](https://ospulse.app/docs/concepts/health-scoring/index.md): The signal categories behind an OSPulse package health score, how confidence is reported separately, and how to read a score as evidence rather than a verdict.
- [Policies & gates](https://ospulse.app/docs/concepts/policies/index.md): Policies encode your risk appetite as machine-checkable rules: what they can assert, warn versus block, time-boxed exceptions, and how they power CI gates.
- [Scans & the scan lifecycle](https://ospulse.app/docs/concepts/scans/index.md): What an OSPulse scan does end to end, why it is asynchronous, how scan states progress, and why results reflect a scan plus continuously updated intelligence.
- [Tenancy & access](https://ospulse.app/docs/concepts/tenancy/index.md): The tenant is the isolation boundary in OSPulse: how users, roles, tokens, SSO, settings, usage, audit logging and data export are all scoped to it.
- [Threat intelligence](https://ospulse.app/docs/concepts/threat-intelligence/index.md): How OSPulse aggregates supply-chain threat feeds, cross-references them against your dependency graph, and turns a world-wide advisory into your specific blast radius.
- [Scan your first repository](https://ospulse.app/docs/first-scan/index.md): A step-by-step walkthrough: connect a source-control provider, import a repository, trigger an OSPulse scan, and read the dependency risk results.
- [Docs for AI agents](https://ospulse.app/docs/for-ai-agents/index.md): Machine-readable OSPulse docs: llms.txt, llms-full.txt, a Markdown twin of every page, the OpenAPI spec, and prompt patterns for coding agents.
- [Consume and triage alerts](https://ospulse.app/docs/guides/alerts/index.md): Pull OSPulse alerts, filter by severity, run a repeatable triage workflow over vulnerability exposures, and route them into Slack, Jira or PagerDuty.
- [Scan in CI/CD](https://ospulse.app/docs/guides/ci-cd/index.md): Gate a build on dependency risk with OSPulse: trigger a scan, poll to completion, read policy violations, and fail the pipeline on a threshold you choose.
- [CRA compliance workflow](https://ospulse.app/docs/guides/cra/index.md): Register products, track EU Cyber Resilience Act duties, run reporting clocks against exploited vulnerabilities, and export a signed evidence pack.
- [Import a repository](https://ospulse.app/docs/guides/import-repository/index.md): Connect GitHub, GitLab, Azure DevOps or Bitbucket to OSPulse, import repositories in bulk, and wire up webhooks so pushes trigger a rescan.
- [Monitor packages continuously](https://ospulse.app/docs/guides/monitoring/index.md): Choose which packages to watch in OSPulse, track health scores over time, detect score degradation early, and find replacements for decaying dependencies.
- [Enforce policy gates](https://ospulse.app/docs/guides/policy-gates/index.md): Author an OSPulse policy, test it against real data before enforcing, wire it into CI as a build gate, and manage violations and time-boxed exceptions.
- [Quantum readiness audit](https://ospulse.app/docs/guides/quantum/index.md): Inventory quantum-vulnerable cryptography across dependencies, certificates, source, and TLS endpoints, then prioritise and gate migration in CI.
- [Generate an SBOM](https://ospulse.app/docs/guides/sbom/index.md): Produce CycloneDX and SPDX bills of materials from scanned repositories, attach them to product releases, and ingest SBOMs you receive from suppliers.
- [SSO & SCIM provisioning](https://ospulse.app/docs/guides/sso-scim/index.md): Configure OIDC or SAML single sign-on for your tenant and automate the user lifecycle with the SCIM 2.0 directory endpoints.
- [Export data to a warehouse](https://ospulse.app/docs/guides/warehouse-export/index.md): Stream OSPulse datasets into Snowflake, BigQuery, or Synapse on a schedule, with a versioned schema contract, incremental runs, and replayable failures.
- [OpenAPI specification](https://ospulse.app/docs/openapi/index.md): The machine-readable OSPulse API contract: where the spec lives, what it covers, and how to use it for client generation, mocking, and contract testing.
- [Quickstart](https://ospulse.app/docs/quickstart/index.md): Create an OSPulse API token and make your first authenticated API call in under five minutes.
- [SDK overview](https://ospulse.app/docs/sdks/index.md): What OSPulse clients exist today, how to generate a typed client for any language from the OpenAPI spec, and how to hand-roll a solid direct-HTTP client.
- [Support](https://ospulse.app/docs/support/index.md): How to get help with OSPulse: what to include in a request, where to send it, how to check platform status, and how to report a security issue privately.

## Optional

- [OpenAPI specification](https://ospulse.app/openapi.json): the full machine-readable API contract
- [Full documentation corpus](https://ospulse.app/llms-full.txt): every page inlined into one file