openapi: 3.1.0
info:
  title: OSV (Open Source Vulnerabilities) Projects API
  description: OSV is a distributed open source vulnerability database and triage infrastructure project hosted by the Open Source Security Foundation (OpenSSF). The OSV API exposes vulnerability records keyed to specific package versions or commits across multiple ecosystems (npm, PyPI, Maven, Go, NuGet, RubyGems, Cargo, Packagist, Hex, OSS-Fuzz, Linux, Android, GitHub Actions, etc.).
  version: '1'
  contact:
    name: OSV
    url: https://osv.dev/
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://api.osv.dev
  description: OSV production API
tags:
- name: Projects
paths:
  /projects/{platform}/{org}/{repo}:
    get:
      operationId: getProjectScorecard
      summary: Get Scorecard report for a repository
      description: Return the most recent Scorecard report for a public repository on a supported source-control platform. Reports include the aggregate score, the date of evaluation, the Scorecard version, and per-check scores with documentation URLs.
      parameters:
      - name: platform
        in: path
        required: true
        schema:
          type: string
          enum:
          - github.com
      - name: org
        in: path
        required: true
        schema:
          type: string
      - name: repo
        in: path
        required: true
        schema:
          type: string
      - name: commit
        in: query
        required: false
        schema:
          type: string
        description: Optional commit hash to retrieve a historical report.
      responses:
        '200':
          description: Scorecard report.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScorecardResult'
        '404':
          description: No report available for this repository.
      tags:
      - Projects
components:
  schemas:
    ScorecardResult:
      type: object
      properties:
        date:
          type: string
          format: date
        repo:
          type: object
          properties:
            name:
              type: string
            commit:
              type: string
        scorecard:
          type: object
          properties:
            version:
              type: string
            commit:
              type: string
        score:
          type: number
          minimum: 0
          maximum: 10
          description: Aggregate Scorecard score (0-10).
        checks:
          type: array
          items:
            $ref: '#/components/schemas/ScorecardCheck'
        metadata:
          type: array
          items:
            type: string
    ScorecardCheck:
      type: object
      properties:
        name:
          type: string
          description: Check name (e.g., Branch-Protection, Code-Review, Vulnerabilities).
        score:
          type: integer
          minimum: -1
          maximum: 10
          description: Check score, or -1 when not applicable.
        reason:
          type: string
        details:
          type: array
          items:
            type: string
        documentation:
          type: object
          properties:
            short:
              type: string
            url:
              type: string
              format: uri
externalDocs:
  description: OSV API documentation
  url: https://google.github.io/osv.dev/api/