Ossprey OpenAPI Overview

You can use the Ossprey OpenAPI spec to submit SBOMs (software bills of materials), generate SBOMs from Package URLs (PURLs), track scan progress, and retrieve findings.

For a narrative walkthrough of the same flow, see the API Quickstart; for authentication, quotas, and error envelopes, see API and Development.

Start here

1. Open Submit an SBOM for scanning to review the request body and response format.
2. Use Get the current status of a queued/running scan after submission to track progress.
3. Read Get one SBOM with all its scans, vulnerabilities and findings to inspect completed results.
4. Use List all SBOMs for the API-key holder to review previously submitted SBOMs.

What you can do with the API

• Submit an SBOM for analysis.
• Generate an SBOM from a Package URL.
• Poll scan status for queued and running work.
• Retrieve SBOMs, scans, and findings.
• Delete an SBOM along with its scans and finding records.
• Consume the malware feed as threat intelligence.
• Give AI agents scan access over the Model Context Protocol.
• Ingest observed package pulls from an artifact-cache collector.
• Confirm an alert email address via a one-time token.

Additional endpoints