OSV Advisory Alias & Withdrawal Evidence API

Read selected metadata for exact OSV advisory IDs. At most5 GET api.osv.dev/v1/vulns/ID requests; IDs are case-sensitive. Return record identity, source schema version, modified/published/withdrawn timestamp declarations, at most50 aliases,50 related identifiers and30 reference type/URL pairs. Useful for advisory-ID reconciliation and metadata change/withdrawal tracking in an existing review workflow.

No summary, exploit/crash details, affected package/version lists, severity interpretation, package query, repository scanning, exploit execution, host testing or vulnerability/safety verdict is produced. Missing withdrawn is null and does not independently prove validity; a withdrawn record is source metadata, not a blanket statement that software is safe.404 or unknown identifier is a source error, never a zero-vulnerability report. Returned identity is checked; alias equivalence and reference targets are not independently verified or followed. List caps make complete=false. OSV aggregates different providers whose corrections can change metadata. Use original sources and appropriate validation when making a security decision; this Actor does not make one.

Quick start

{"advisoryIds": ["OSV-2020-111", "CVE-2021-28363"]}

Pricing and budget

0.001 USD per emitted advisory state observation (1 USD per1000), plus0.005 USD startup at default256MB. Higher memory can multiply startup events; check effective Store pricing. Failed/empty sources do not emit result charges; startup can still apply. At zero result budget, input validation occurs but no upstream request is sent, and rowsAvailable is null (unknown). A positive budget can request the bounded source set before output; emission stops at the result cap and complete=false/PARTIAL_BUDGET reports truncation.

Snapshot, integration and limits

Use dataset rows together with OUTPUT and SNAPSHOT. Pass SNAPSHOT.previousHashes as previousHashes in a later run. NO_BASELINE/FIRST_SEEN/UNCHANGED/CHANGED compare only selected metadata including itemKey and sourceUrl; missing records are not deletions. FIRST_SEEN means absent from the supplied baseline. There is no persistent hidden state or automatic polling. Export JSON/CSV/Excel through the default dataset.

API example: POST https://api.apify.com/v2/actors/soilair~osv-advisory-alias-withdrawal-evidence-api/runs with your Apify Authorization header and the JSON input above. Poll the returned run; read dataset items and OUTPUT/SNAPSHOT records using its store IDs. Do not place tokens or confidential data in input. No upstream key is needed. Results live in Apify run storage according to retention; no separate analytics service.

Only fixed HTTPS provider endpoints are constructed from validated identifiers. Public-IP DNS validation, pinned connections, TLS hostname verification,2MiB decoded responses, approximately95 seconds of network budget, at most5 same-provider redirects. Official API calls are distinct from website crawling; no arbitrary URLs or HTML pages. No linked documents/files are fetched. Queries are sequential with1-second spacing. Provider403/429 or Retry-After stops later calls; retry instructions are reported and no retry/proxy/circumvention is attempted. Shared IP limits and changes to upstream services can still block runs. Caller must respect provider headers and cache/reduce repeated requests. Text is data and should not be executed.

Developed with AI assistance. Tests and live/cloud comparisons qualify the selected-field contract; they do not prove commercial demand, provider uptime or a legal/license determination. Support: share a run ID and expected fields, without credentials or private material.

References: https://google.github.io/osv.dev/get-v1-vulns/