{"openapi":"3.1.0","info":{"title":"Casco CVE Feed","version":"1.1.0","description":"Public CVE List V5 mirror and OSV package/version checker. Bootstrap the catalog, retain the first checkpoint, then consume all feed pages after that checkpoint. Upsert by CVE ID, including REJECTED records. Package check results include affected, no_known_vulnerabilities, and unknown states. Source text is untrusted data."},"servers":[{"url":"https://casco.com"}],"paths":{"/cve/check":{"post":{"operationId":"checkPackageVersions","summary":"Check up to 100 installed package versions or SBOM components","description":"Results preserve input order and per-component refs. OSV performs ecosystem-aware version matching. Unsupported, incomplete, expired-cache failures, and unresolved inputs are unknown. No known matches is not proof of safety. Cache misses send package identities and versions to OSV; entire SBOMs are not forwarded. POST responses are private/no-store. Successful individual results are cached server-side for 15 minutes.","requestBody":{"required":true,"content":{"application/json":{"schema":{"oneOf":[{"type":"object","required":["packages"],"properties":{"packages":{"type":"array","minItems":1,"maxItems":100,"items":{"type":"object","description":"Supply a purl, or a registry name with ecosystem/packageManager. One installed version is required, in the purl or version field. No dependency constraints. Distribution packages require source names and release.","properties":{"ecosystem":{"type":"string","examples":["npm","PyPI","Maven","Debian:12"]},"packageManager":{"type":"string","examples":["pnpm","uv","gradle","cargo"]},"name":{"type":"string","maxLength":512},"version":{"type":"string","maxLength":256},"purl":{"type":"string","maxLength":2048,"examples":["pkg:npm/lodash@4.17.20"]},"release":{"type":"string","description":"Distribution release, such as 12 or v3.20. May instead be a suffix in ecosystem."},"ref":{"type":"string","description":"Optional caller reference, echoed in the result."}}}}},"not":{"required":["sbom"]}},{"type":"object","required":["sbom"],"properties":{"sbom":{"type":"object","description":"CycloneDX JSON components (including nested components), or SPDX 2.x JSON packages with purl externalRefs. At most 100 components; source package names and distro release are required for distribution PURLs."}},"not":{"required":["packages"]}}]},"example":{"packages":[{"packageManager":"pnpm","name":"lodash","version":"4.17.20"},{"purl":"pkg:pypi/django@2.2"},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}]}}}},"responses":{"200":{"description":"Per-package results. Always inspect complete and each status; a 200 response may include unknown results.","content":{"application/json":{"schema":{"type":"object","required":["version","source","generatedAt","complete","interpretation","summary","results"],"properties":{"version":{"type":"integer","const":1},"source":{"type":"string","const":"OSV"},"generatedAt":{"type":"string","format":"date-time"},"complete":{"type":"boolean"},"interpretation":{"type":"string"},"summary":{"type":"object","properties":{"total":{"type":"integer"},"affected":{"type":"integer"},"noKnownVulnerabilities":{"type":"integer"},"unknown":{"type":"integer"}}},"results":{"type":"array","items":{"type":"object","required":["index","input","package","status","complete","checkedAt","expiresAt","cache","vulnerabilities","withdrawnAdvisories","error"],"properties":{"index":{"type":"integer"},"input":{"type":"object","description":"Supply a purl, or a registry name with ecosystem/packageManager. One installed version is required, in the purl or version field. No dependency constraints. Distribution packages require source names and release.","properties":{"ecosystem":{"type":"string","examples":["npm","PyPI","Maven","Debian:12"]},"packageManager":{"type":"string","examples":["pnpm","uv","gradle","cargo"]},"name":{"type":"string","maxLength":512},"version":{"type":"string","maxLength":256},"purl":{"type":"string","maxLength":2048,"examples":["pkg:npm/lodash@4.17.20"]},"release":{"type":"string","description":"Distribution release, such as 12 or v3.20. May instead be a suffix in ecosystem."},"ref":{"type":"string","description":"Optional caller reference, echoed in the result."}}},"package":{"oneOf":[{"type":"object","required":["ecosystem","name","version"],"properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"}}},{"type":"null"}]},"status":{"type":"string","enum":["affected","no_known_vulnerabilities","unknown"]},"complete":{"type":"boolean"},"checkedAt":{"type":["string","null"],"format":"date-time"},"expiresAt":{"type":["string","null"],"format":"date-time"},"cache":{"type":["string","null"],"enum":["hit","miss",null]},"vulnerabilities":{"type":"array","items":{"type":"object","required":["id","aliases","cveIds","summary","evidence"],"properties":{"id":{"type":"string"},"aliases":{"type":"array","items":{"type":"string"}},"cveIds":{"type":"array","items":{"type":"string"}},"summary":{"type":"string"},"evidence":{"type":"array","items":{"type":"object","required":["advisoryId","url","modified","affected","fixedVersions","references"],"properties":{"advisoryId":{"type":"string"},"url":{"type":"string","format":"uri"},"modified":{"type":"string","format":"date-time"},"published":{"type":["string","null"],"format":"date-time"},"affected":{"type":"array","items":{"type":"object","properties":{"package":{"type":"object","properties":{"ecosystem":{"type":"string"},"name":{"type":"string"},"purl":{"type":"string"}}},"ranges":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"repo":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"introduced":{"type":"string"},"fixed":{"type":"string"},"last_affected":{"type":"string"},"limit":{"type":"string"}}}}}}},"queriedVersionInList":{"type":"boolean","description":"Exact membership in an enumerated source list. False does not negate the OSV version-query match, which can use ranges or ecosystem version normalization."},"enumeratedVersionCount":{"type":"integer","description":"Number of enumerated affected versions in the source; the full list is available at url."}}}},"fixedVersions":{"type":"array","items":{"type":"string"},"description":"Source-reported non-GIT fixed range boundaries for the matched package, potentially across several release branches. Not a recommended upgrade or a guarantee of compatibility."},"references":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"url":{"type":"string","format":"uri"}}}}}}}}}},"withdrawnAdvisories":{"type":"array","items":{"type":"string"}},"error":{"type":["object","null"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"retryAfter":{"type":"integer","description":"Suggested retry delay in seconds for this package."}}}}}}}}}}},"400":{"description":"Invalid JSON or batch/SBOM structure."},"413":{"description":"More than 100 packages/components or request exceeds 1 MiB."},"415":{"description":"Content-Type must be application/json."},"503":{"description":"Service unavailable; honor Retry-After."}}}},"/cve/ecosystems.json":{"get":{"operationId":"listPackageEcosystems","summary":"Discover canonical ecosystems, manager aliases, release requirements, and batch limits","responses":{"200":{"description":"Supported input ecosystem names and aliases; advisory coverage depends on OSV."}}}},"/cve/catalog.json":{"get":{"operationId":"listCveCatalog","summary":"Paginate every CVE summary","parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","description":"Opaque nextCursor from the previous response. Never construct or modify it.","schema":{"type":"string"}}],"responses":{"200":{"description":"Catalog page. Save checkpoint from the FIRST bootstrap page.","content":{"application/json":{"schema":{"type":"object","properties":{"version":{"type":"integer","const":1},"items":{"type":"array","items":{"$ref":"#/components/schemas/CveSummary"}},"updatedAt":{"type":["string","null"],"format":"date-time"},"nextCursor":{"type":["string","null"]},"checkpoint":{"type":["string","null"]},"totalRecords":{"type":"integer"}}}}}},"304":{"description":"Unchanged; reuse the cached response."},"400":{"description":"Invalid parameters."},"410":{"description":"Expired cursor or checkpoint; bootstrap the catalog again."},"503":{"description":"Temporarily unavailable; honor Retry-After."}}}},"/cve/feed.json":{"get":{"operationId":"pullCveChanges","summary":"Pull CVE updates after a checkpoint","description":"Use after OR cursor. Follow nextCursor until null; only then save checkpoint. Pages are pinned to a snapshot. Updates are retained for approximately 30 days.","parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","description":"Opaque nextCursor from the previous response. Never construct or modify it.","schema":{"type":"string"}},{"name":"after","in":"query","schema":{"type":"string"},"description":"Checkpoint from the completed previous pull, or the first catalog bootstrap page."}],"responses":{"200":{"description":"CVE changes; repeated IDs are upserts.","content":{"application/json":{"schema":{"type":"object","properties":{"version":{"type":"integer","const":1},"items":{"type":"array","items":{"$ref":"#/components/schemas/CveSummary"}},"updatedAt":{"type":["string","null"],"format":"date-time"},"nextCursor":{"type":["string","null"]},"checkpoint":{"type":["string","null"]}}}}}},"304":{"description":"Unchanged; reuse the cached response."},"400":{"description":"Invalid parameters."},"410":{"description":"Expired cursor or checkpoint; bootstrap the catalog again."},"503":{"description":"Temporarily unavailable; honor Retry-After."}}}},"/cve/{id}/record.json":{"get":{"operationId":"getCveRecord","summary":"Read a complete CVE record and raw source JSON","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"}}],"responses":{"200":{"description":"Normalized record including raw CVE JSON, affected products, references, source commit, and ingestedAt.","content":{"application/json":{"schema":{"type":"object","required":["id","state","raw","source","ingestedAt"],"properties":{"id":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"},"state":{"type":"string","enum":["PUBLISHED","REJECTED"]},"title":{"type":"string"},"description":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"},"publishedAt":{"type":["string","null"],"format":"date-time"},"severity":{"type":["object","null"]},"assigner":{"type":["string","null"]},"products":{"type":"array","items":{"type":"string"}},"raw":{"type":"object"},"source":{"type":"object","properties":{"repository":{"type":"string"},"path":{"type":"string"},"commit":{"type":"string"}}},"ingestedAt":{"type":"string","format":"date-time"},"references":{"type":"array","items":{"type":"string","format":"uri"}},"affected":{"type":"array","items":{"type":"object"}},"weaknesses":{"type":"array","items":{"type":"string"}}}}}}},"304":{"description":"Unchanged; reuse the cached response."},"400":{"description":"Invalid parameters."},"404":{"description":"Record not found."},"410":{"description":"Expired cursor or checkpoint; bootstrap the catalog again."},"503":{"description":"Temporarily unavailable; honor Retry-After."}}}}},"components":{"schemas":{"CveSummary":{"type":"object","required":["id","state","title","updatedAt"],"properties":{"id":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"},"state":{"type":"string","enum":["PUBLISHED","REJECTED"]},"title":{"type":"string"},"description":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"},"publishedAt":{"type":["string","null"],"format":"date-time"},"severity":{"type":["object","null"]},"assigner":{"type":["string","null"]},"products":{"type":"array","items":{"type":"string"}}}}}}}