OP
Identity & Enrichment · x402 · early usage
Batch dependency vulnerability check — check ordered exact package versions in OSV with…
Batch dependency vulnerability check — check ordered exact package versions in OSV with deduplicated CVE enrichment, explicit completeness, and CISA KEV known-exploited signals.
by dependency-risk.use.x402atlas.com · discovered, not yet claimed by its owner · updated 2026-10-01
30d calls3
30d payers2
MethodPOST
Outputjson
Mirrored from Coinbase's public x402 Bazaar. The description is the provider's own text and has not been reviewed here; the payment requirements are copied as published.
What it does
Batch dependency vulnerability check — check ordered exact package versions in OSV with deduplicated CVE enrichment, explicit completeness, and CISA KEV known-exploited signals.
Tags: batch-vulnerability-check · osv · cve · cisa-kev · software-supply-chain · bazaar
Call contract
- Method
- POST
- Input
- json
- Output
- json
- Last paid call
- 2026-10-01
Input example from Bazaar metadata
{
"packages": [
{
"purl": "pkg:golang/golang.org/x/[email protected]"
},
{
"purl": "pkg:golang/golang.org/x/[email protected]"
}
]
}Output example
{
"operation": "batch-check",
"partial": false,
"results": [
{
"findings": [
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2022-32149",
"GO-2022-1059"
],
"fixed_versions": [
"0.3.8"
],
"id": "GHSA-69ch-w2m2-3vjp",
"max_severity": "high",
"modified": "2026-02-04T03:11:34.199431Z",
"published": "2022-10-14T19:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149"
},
{
"type": "WEB",
"url": "https://github.com/golang/go/issues/56152"
},
{
"type": "WEB",
"url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c"
},
{
"type": "PACKAGE",
"url": "https://github.com/golang/text"
},
{
"type": "WEB",
"url": "https://go.dev/cl/442235"
},
{
"type": "WEB",
"url": "https://go.dev/issue/56152"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-1059"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230203-0006"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header",
"withdrawn": false
},
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2022-32149",
"GHSA-69ch-w2m2-3vjp"
],
"fixed_versions": [
"0.3.8"
],
"id": "GO-2022-1059",
"max_severity": "unknown",
"modified": "2026-02-04T03:39:03.311488Z",
"published": "2022-10-11T18:16:24Z",
"references": [
{
"type": "REPORT",
"url": "https://go.dev/issue/56152"
},
{
"type": "FIX",
"url": "https://go.dev/cl/442235"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
}
],
"severity": [],
"summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language",
"withdrawn": false
},
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.39.0"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2026-56852"
],
"fixed_versions": [
"0.39.0"
],
"id": "GO-2026-5970",
"max_severity": "unknown",
"modified": "2026-07-22T20:59:36.034292423Z",
"published": "2026-07-14T17:29:56Z",
"references": [
{
"type": "REPORT",
"url": "https://go.dev/issue/80142"
},
{
"type": "FIX",
"url": "https://go.dev/cl/794100"
}
],
"severity": [],
"summary": "Infinite loop on invalid input in golang.org/x/text",
"withdrawn": false
}
],
"input": {
"ecosystem": "golang",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/[email protected]",
"version": "v0.3.7"
},
"status": "vulnerabilities_found",
"summary": {
"finding_count": 3,
"kev_count": 0,
"max_severity": "high"
}
},
{
"findings": [
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2022-32149",
"GO-2022-1059"
],
"fixed_versions": [
"0.3.8"
],
"id": "GHSA-69ch-w2m2-3vjp",
"max_severity": "high",
"modified": "2026-02-04T03:11:34.199431Z",
"published": "2022-10-14T19:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149"
},
{
"type": "WEB",
"url": "https://github.com/golang/go/issues/56152"
},
{
"type": "WEB",
"url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c"
},
{
"type": "PACKAGE",
"url": "https://github.com/golang/text"
},
{
"type": "WEB",
"url": "https://go.dev/cl/442235"
},
{
"type": "WEB",
"url": "https://go.dev/issue/56152"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-1059"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230203-0006"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header",
"withdrawn": false
},
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2022-32149",
"GHSA-69ch-w2m2-3vjp"
],
"fixed_versions": [
"0.3.8"
],
"id": "GO-2022-1059",
"max_severity": "unknown",
"modified": "2026-02-04T03:39:03.311488Z",
"published": "2022-10-11T18:16:24Z",
"references": [
{
"type": "REPORT",
"url": "https://go.dev/issue/56152"
},
{
"type": "FIX",
"url": "https://go.dev/cl/442235"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ"
}
],
"severity": [],
"summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language",
"withdrawn": false
},
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/text"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.39.0"
}
],
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2026-56852"
],
"fixed_versions": [
"0.39.0"
],
"id": "GO-2026-5970",
"max_severity": "unknown",
"modified": "2026-07-22T20:59:36.034292423Z",
"published": "2026-07-14T17:29:56Z",
"references": [
{
"type": "REPORT",
"url": "https://go.dev/issue/80142"
},
{
"type": "FIX",
"url": "https://go.dev/cl/794100"
}
],
"severity": [],
"summary": "Infinite loop on invalid input in golang.org/x/text",
"withdrawn": false
}
],
"input": {
"ecosystem": "golang",
"name": "golang.org/x/text",
"purl": "pkg:golang/golang.org/x/[email protected]",
"version": "v0.3.7"
},
"status": "vulnerabilities_found",
"summary": {
"finding_count": 3,
"kev_count": 0,
"max_severity": "high"
}
}
],
"retrieved_at": "2026-08-02T00:00:00Z",
"schema_version": "dependency-risk-v1",
"source": {
"cisa_kev": {
"catalog_version": "2026.07.29",
"date_released": "2026-07-29T18:45:59.5809Z",
"name": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog",
"retrieved_at": "2026-08-02T00:00:00Z"
},
"osv": {
"name": "OSV.dev"
}
},
"stale": false,
"warnings": []
}Use with an agent
- Discover. Agents find this listing with
GET https://bazaar.saylorinnovations.com/discovery/search?query=…, the MCP toolsearch_resources, or/discovery/resources. - Inspect. Fetch
/resources/30546.jsonfor the price and payment options. - Pay. Call
GET https://dependency-risk.use.x402atlas.com/batch. The provider answers402with its payment requirements. An x402 client signs one of the options below and retries withPAYMENT-SIGNATURE. - Execute. The provider returns
200with the data. Agent Bazaar is not in the request path and never sees your payment.
For humans
You don't need an account or an API key; you need a wallet holding a small amount of USDC on Base, Polygon, Arbitrum One, and an x402-capable client (see the examples below). Call the endpoint unpaid first to see exactly what it asks for.
Pricing & payment
- Price
- $0.01 / request
- Protocol
- x402 v2
- Auth
- No account or API key. Pay per request.
- Networks
- Base, Polygon, Arbitrum One
- Demand
- 3 calls · 2 unique payers in 30d (public x402 Bazaar data)
x402 payment requirements
| Scheme | Network | Asset | Amount | Pay to | Timeout |
|---|---|---|---|---|---|
| exact | Base eip155:8453 | USDC | $0.01 | 0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2 | 300s |
| exact | Polygon eip155:137 | USDC | $0.01 | 0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2 | 300s |
| exact | Arbitrum One eip155:42161 | USDC | $0.01 | 0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2 | 300s |
accepts[] (raw JSON)
[
{
"scheme": "exact",
"network": "eip155:8453",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"amount": "10000",
"amountUsd": 0.01,
"maxTimeoutSeconds": 300
},
{
"scheme": "exact",
"network": "eip155:137",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"amount": "10000",
"amountUsd": 0.01,
"maxTimeoutSeconds": 300
},
{
"scheme": "exact",
"network": "eip155:42161",
"payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"amount": "10000",
"amountUsd": 0.01,
"maxTimeoutSeconds": 300
}
]Schemas
Output schema (JSON Schema)
{
"properties": {
"example": {
"additionalProperties": false,
"description": "Complete transactional Dependency Risk response, limited to the native budget reserved below the 512 KiB deployed wire ceiling",
"properties": {
"_atlas": {
"additionalProperties": false,
"description": "Atlas documentation and related-route metadata added after deployment",
"properties": {
"docs": {
"description": "Documentation URL for this bridge",
"format": "uri",
"maxLength": 512,
"type": "string"
},
"related": {
"description": "Bounded related Atlas routes",
"items": {
"additionalProperties": false,
"description": "One related Atlas route",
"properties": {
"bridge": {
"description": "Related bridge name",
"maxLength": 64,
"type": "string"
},
"docs": {
"description": "Related bridge documentation URL",
"format": "uri",
"maxLength": 512,
"type": "string"
},
"summary": {
"description": "Short capability summary",
"maxLength": 256,
"type": "string"
},
"url": {
"description": "Related route URL",
"format": "uri",
"maxLength": 512,
"type": "string"
}
},
"required": [
"bridge",
"url",
"docs",
"summary"
],
"type": "object"
},
"maxItems": 3,
"type": "array"
}
},
"required": [
"docs"
],
"type": "object"
},
"operation": {
"const": "batch-check",
"description": "Stable route operation identifier",
"type": "string"
},
"partial": {
"description": "True only when at least one complete item succeeded and another detail lookup transiently failed",
"type": "boolean"
},
"results": {
"description": "Complete or explicitly failed results in original caller input order, including duplicate positions; all items collectively reference at most eight distinct OSV IDs",
"items": {
"additionalProperties": false,
"description": "One position-preserving package result",
"oneOf": [
{
"not": {
"required": [
"error_code"
]
},
"properties": {
"status": {
"description": "A complete named-source conclusion requires summary and omits error_code",
"enum": [
"no_known_vulnerabilities",
"vulnerabilities_found"
]
}
},
"required": [
"summary"
]
},
{
"not": {
"required": [
"summary"
]
},
"properties": {
"status": {
"const": "query_failed",
"description": "An incomplete upstream result requires error_code and omits summary so it cannot resemble a risk conclusion"
}
},
"required": [
"error_code"
]
}
],
"properties": {
"error_code": {
"const": "upstream_error",
"description": "Generic non-sensitive code present only when status is query_failed",
"type": "string"
},
"findings": {
"description": "Complete findings for this exact input; collectively all response items reference at most eight distinct OSV IDs; always [] for no_known_vulnerabilities or query_failed",
"items": {
"additionalProperties": false,
"description": "One complete normalized OSV vulnerability finding, limited to 48 KiB after JSON encoding, with optional exact CISA KEV enrichment",
"properties": {
"affected": {
"description": "Bounded OSV affected package/range/event data in source order",
"items": {
"additionalProperties": false,
"description": "One OSV affected package entry retained in source order",
"properties": {
"package": {
"additionalProperties": false,
"description": "Exact affected package identity published by OSV",
"properties": {
"ecosystem": {
"description": "Exact OSV ecosystem identifier",
"type": "string"
},
"name": {
"description": "Exact package name published by OSV",
"type": "string"
},
"purl": {
"description": "Package URL published by OSV when supplied",
"type": "string"
}
},
"type": "object"
},
"ranges": {
"description": "Affected ranges retained in OSV source order",
"items": {
"additionalProperties": false,
"description": "One affected version range published by OSV",
"properties": {
"events": {
"description": "Ordered OSV range events; the bridge does not infer ecosystem version ordering",
"items": {
"additionalProperties": false,
"description": "One OSV range event; exactly one event field is normally supplied by the source",
"properties": {
"fixed": {
"description": "OSV range event explicitly marking a fixed version",
"type": "string"
},
"introduced": {
"description": "OSV range event marking an introduced version",
"type": "string"
},
"last_affected": {
"description": "OSV range event marking the last affected version",
"type": "string"
},
"limit": {
"description": "OSV range event upper limit when supplied",
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"repo": {
"description": "Repository identifier published by OSV for a GIT range",
"type": "string"
},
"type": {
"description": "OSV range type such as SEMVER, ECOSYSTEM, or GIT",
"type": "string"
}
},
"required": [
"type",
"events"
],
"type": "object"
},
"type": "array"
},
"severity": {
"description": "Severity vectors attached to this affected package entry",
"items": {
"additionalProperties": false,
"description": "One severity vector exactly as published by OSV",
"properties": {
"score": {
"description": "Original published vector; malformed or mismatched vectors are retained but score as unknown",
"type": "string"
},
"type": {
"description": "OSV-declared score type such as CVSS_V3",
"type": "string"
}
},
"required": [
"type",
"score"
],
"type": "object"
},
"type": "array"
},
"versions": {
"description": "Affected versions explicitly enumerated by OSV",
"items": {
"type": "string"
},
"type": "array"
}
},
"required": [
"package",
"ranges",
"versions",
"severity"
],
"type": "object"
},
"type": "array"
},
"aliases": {
"description": "Deduplicated lexical aliases published by OSV",
"items": {
"type": "string"
},
"type": "array"
},
"fixed_versions": {
"description": "Only explicit fixed events for the matching package, deduplicated in OSV source order; [] means OSV supplied no fixed event, not that no fix exists",
"items": {
"type": "string"
},
"type": "array"
},
"id": {
"description": "Authoritative OSV record identifier",
"type": "string"
},
"kev": {
"additionalProperties": false,
"description": "Exact CISA KEV match on a syntactically valid CVE ID or alias; omitted rather than null when no exact match exists",
"properties": {
"cve_id": {
"description": "Exact CVE identifier matched in the CISA KEV catalog",
"type": "string"
},
"cwes": {
"description": "CWE identifiers published by CISA",
"items": {
"type": "string"
},
"type": "array"
},
"date_added": {
"description": "Date CISA added the CVE to KEV",
"type": "string"
},
"due_date": {
"description": "CISA KEV due date for covered federal agencies",
"type": "string"
},
"known_ransomware_campaign_use": {
"description": "CISA's published ransomware-campaign-use value when supplied",
"type": "string"
},
"notes": {
"description": "Additional CISA KEV notes when supplied",
"type": "string"
},
"product": {
"description": "Affected product label published by CISA",
"type": "string"
},
"required_action": {
"description": "Required action text published by CISA; caller remediation review is still required",
"type": "string"
},
"short_description": {
"description": "Short vulnerability description published by CISA",
"type": "string"
},
"vendor_project": {
"description": "Vendor or project label published by CISA",
"type": "string"
},
"vulnerability_name": {
"description": "CISA KEV vulnerability name",
"type": "string"
}
},
"required": [
"cve_id",
"vendor_project",
"product",
"vulnerability_name",
"date_added",
"short_description",
"required_action",
"due_date",
"cwes"
],
"type": "object"
},
"max_severity": {
"description": "Highest severity derived only from a parseable declared CVSS vector",
"enum": [
"unknown",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"modified": {
"description": "OSV modification time string",
"type": "string"
},
"published": {
"description": "OSV publication time string when supplied",
"type": "string"
},
"references": {
"description": "Bounded references published by OSV; URLs are untrusted data returned for provenance and are never fetched by this bridge",
"items": {
"additionalProperties": false,
"description": "One OSV-published reference retained as provenance data",
"properties": {
"type": {
"description": "OSV reference classification such as ADVISORY, FIX, REPORT, or WEB",
"type": "string"
},
"url": {
"description": "Reference URL supplied by OSV as untrusted provenance data; never fetched by this bridge",
"type": "string"
}
},
"required": [
"type",
"url"
],
"type": "object"
},
"type": "array"
},
"severity": {
"description": "At most 16 published top-level OSV severity vectors",
"items": {
"additionalProperties": false,
"description": "One severity vector exactly as published by OSV",
"properties": {
"score": {
"description": "Original published vector; malformed or mismatched vectors are retained but score as unknown",
"type": "string"
},
"type": {
"description": "OSV-declared score type such as CVSS_V3",
"type": "string"
}
},
"required": [
"type",
"score"
],
"type": "object"
},
"maxItems": 16,
"type": "array"
},
"summary": {
"description": "Bounded OSV summary",
"type": "string"
},
"withdrawn": {
"description": "Whether OSV withdrew the record; withdrawn findings remain visible but do not count in the active summary",
"type": "boolean"
},
"withdrawn_at": {
"description": "OSV withdrawal time string, present only when supplied",
"type": "string"
}
},
"required": [
"id",
"aliases",
"modified",
"withdrawn",
"affected",
"references",
"severity",
"max_severity",
"fixed_versions"
],
"type": "object"
},
"maxItems": 8,
"type": "array"
},
"input": {
"additionalProperties": false,
"description": "Canonical exact package/version identity",
"properties": {
"ecosystem": {
"description": "Exact package ecosystem; purl types remain canonical lowercase identifiers",
"type": "string"
},
"name": {
"description": "Exact package-manager name",
"type": "string"
},
"purl": {
"description": "Canonical input purl when the caller used purl form; otherwise omitted",
"type": "string"
},
"version": {
"description": "Exact queried package version",
"type": "string"
}
},
"required": [
"ecosystem",
"name",
"version"
],
"type": "object"
},
"status": {
"description": "Named-source conclusion: query_failed is explicit incompleteness and never a clean result",
"enum": [
"no_known_vulnerabilities",
"vulnerabilities_found",
"query_failed"
],
"type": "string"
},
"summary": {
"additionalProperties": false,
"description": "Summary of active non-withdrawn findings",
"properties": {
"finding_count": {
"description": "Active non-withdrawn finding count",
"maximum": 8,
"minimum": 0,
"type": "integer"
},
"kev_count": {
"description": "Active findings with an exact KEV CVE match",
"maximum": 8,
"minimum": 0,
"type": "integer"
},
"max_severity": {
"description": "Highest parseable published CVSS severity among active findings",
"enum": [
"unknown",
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
},
"required": [
"finding_count",
"kev_count",
"max_severity"
],
"type": "object"
}
},
"required": [
"input",
"status",
"findings"
],
"type": "object"
},
"maxItems": 50,
"type": "array"
},
"retrieved_at": {
"description": "UTC time this bridge completed the response; this is not an OSV publication or modification time",
"format": "date-time",
"type": "string"
},
"schema_version": {
"const": "dependency-risk-v1",
"description": "Version of the normalized Dependency Risk response contract",
"type": "string"
},
"source": {
"additionalProperties": false,
"description": "Named public sources and the exact CISA KEV snapshot used for this response",
"properties": {
"cisa_kev": {
"additionalProperties": false,
"description": "Validated CISA Known Exploited Vulnerabilities snapshot used for exact CVE enrichment",
"properties": {
"catalog_version": {
"description": "Catalog version published in the validated CISA feed",
"type": "string"
},
"date_released": {
"description": "Release time published in the validated CISA feed",
"type": "string"
},
"name": {
"const": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog",
"description": "Official CISA KEV source name",
"type": "string"
},
"retrieved_at": {
"description": "UTC time this exact validated KEV snapshot was retrieved",
"format": "date-time",
"type": "string"
}
},
"required": [
"name",
"catalog_version",
"date_released",
"retrieved_at"
],
"type": "object"
},
"osv": {
"additionalProperties": false,
"description": "OSV source identity; individual finding times carry record publication and modification semantics",
"properties": {
"name": {
"const": "OSV.dev",
"description": "Official OSV.dev vulnerability record aggregator",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
}
},
"required": [
"osv",
"cisa_kev"
],
"type": "object"
},
"stale": {
"description": "True only when a prior validated CISA KEV snapshot is served after refresh failure; OSV result completeness is never silently marked stale",
"type": "boolean"
},
"warnings": {
"description": "Freshness and interpretation warnings; always [] when none",
"items": {
"description": "Bounded warning intended for caller action or interpretation",
"type": "string"
},
"type": "array"
}
},
"required": [
"operation",
"schema_version",
"source",
"retrieved_at",
"stale",
"warnings",
"results",
"partial"
],
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}Example shape — generated from the schema, not a captured live response
{
"example": {
"_atlas": {
"docs": "https://example.com",
"related": [
{
"bridge": "string",
"docs": "https://example.com",
"summary": "string",
"url": "https://example.com"
}
]
},
"operation": "string",
"partial": true,
"results": [
{
"error_code": "string",
"findings": [
{
"affected": [
"value"
],
"aliases": [
"value"
],
"fixed_versions": [
"value"
],
"id": "string",
"kev": {
"cve_id": null,
"cwes": null,
"date_added": null,
"due_date": null,
"known_ransomware_campaign_use": null,
"notes": null,
"product": null,
"required_action": null,
"short_description": null,
"vendor_project": null,
"vulnerability_name": null
},
"max_severity": "unknown",
"modified": "string",
"published": "string",
"references": [
"value"
],
"severity": [
"value"
],
"summary": "string",
"withdrawn": true,
"withdrawn_at": "string"
}
],
"input": {
"ecosystem": "string",
"name": "string",
"purl": "string",
"version": "string"
},
"status": "no_known_vulnerabilities",
"summary": {
"finding_count": 0,
"kev_count": 0,
"max_severity": "unknown"
}
}
],
"retrieved_at": "2026-01-01T00:00:00Z",
"schema_version": "string",
"source": {
"cisa_kev": {
"catalog_version": "string",
"date_released": "string",
"name": "string",
"retrieved_at": "2026-01-01T00:00:00Z"
},
"osv": {
"name": "string"
}
},
"stale": true,
"warnings": [
"string"
]
},
"type": "string"
}Examples
curl
curl "https://dependency-risk.use.x402atlas.com/batch"
# -> 402 Payment Required, accepts[] lists how to pay
# retry with a PAYMENT-SIGNATURE (or PAYMENT header) once paidJavaScript
const res = await fetch("https://dependency-risk.use.x402atlas.com/batch");
if (res.status === 402) {
const { accepts } = await res.json();
// pay one of accepts[] via an x402 client, then retry with the payment header
}Python
import httpx
res = httpx.get("https://dependency-risk.use.x402atlas.com/batch")
if res.status_code == 402:
accepts = res.json()["accepts"]
# pay one of accepts[] via an x402 client, then retry with the payment headerDetails
- Provider
- dependency-risk.use.x402atlas.com
- Endpoint
- https://dependency-risk.use.x402atlas.com/batch
- Machine-readable
/resources/30546.json