{ "openapi": "3.1.0", "info": { "title": "Stack Facts", "version": "0.5.0", "description": "Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.", "contact": { "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us" } }, "servers": [ { "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us" } ], "x-discovery": { "ownershipProofs": [] }, "tags": [ { "name": "eol", "description": "Software end-of-life dates (endoflife.date)" }, { "name": "kev", "description": "CISA Known Exploited Vulnerabilities" }, { "name": "models", "description": "LLM prices and limits (LiteLLM, models.dev)" }, { "name": "stack", "description": "End-of-life status and CISA KEV hits for a whole stack in one call" }, { "name": "osv", "description": "Open-source package vulnerabilities (OSV.dev) with CISA KEV flags" }, { "name": "service", "description": "Service status, keys, licences" }, { "name": "paid", "description": "Paid per call over x402 (USDC on Base)" }, { "name": "free", "description": "Free" } ], "paths": { "/v1/eol/{product}": { "get": { "operationId": "stackfacts_eol_product", "summary": "List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.", "description": "List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_product", "x-keywords": [ "EOL", "end-of-life dates", "support status", "is still supported", "release cycles", "LTS", "endoflife.date" ], "parameters": [ { "name": "product", "in": "path", "required": true, "description": "endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)", "schema": { "type": "string", "minLength": 1, "maxLength": 200 }, "example": "nodejs" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.001" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "product": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" }, "cycles": { "type": "array", "items": { "$ref": "#/components/schemas/eol_cycle" } } }, "required": [ "product", "label", "cycles" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "product": "nodejs", "label": "Node.js", "cycles": [ { "cycle": "24", "eol": "2028-04-30", "latest": "24.21.0", "latest_date": "2026-09-08", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V24.md#24.21.0", "lts": "2025-10-28", "release_date": "2025-05-06", "support_until": "2026-10-20", "status": "supported", "days_until_eol": 569, "is_lts": true }, { "cycle": "22", "eol": "2027-04-30", "latest": "22.23.3", "latest_date": "2026-09-23", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V22.md#22.23.3", "lts": "2024-10-29", "release_date": "2024-04-24", "support_until": "2025-10-21", "status": "security-only", "days_until_eol": 203, "is_lts": true }, { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } ] }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.001 USD (1000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/{product}/{cycle}": { "get": { "operationId": "stackfacts_eol_cycle", "summary": "Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.", "description": "Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_cycle", "x-keywords": [ "is still supported", "EOL", "end-of-life date", "support status", "support until", "latest patch version", "LTS" ], "parameters": [ { "name": "product", "in": "path", "required": true, "description": "endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)", "schema": { "type": "string", "minLength": 1, "maxLength": 200 }, "example": "python" }, { "name": "cycle", "in": "path", "required": true, "description": "Release cycle, e.g. 3.12, 22 or 24.04", "schema": { "type": "string", "minLength": 1, "maxLength": 200 }, "example": "3.12" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.001" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "allOf": [ { "$ref": "#/components/schemas/eol_cycle" } ], "type": "object", "properties": { "product": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" } }, "required": [ "product", "label" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "product": "python", "label": "Python", "cycle": "3.12", "eol": "2028-10-31", "latest": "3.12.15", "latest_date": "2026-10-01", "link": "https://www.python.org/downloads/release/python-31215/", "lts": false, "release_date": "2023-10-02", "support_until": "2025-04-02", "status": "security-only", "days_until_eol": 753, "is_lts": false }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.001 USD (1000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/check": { "post": { "operationId": "stackfacts_eol_check", "summary": "Check dependencies, runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs to cycle, end-of-life date and support status.", "description": "Check dependencies, runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs to cycle, end-of-life date and support status.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_check", "x-keywords": [ "check my stack for end-of-life versions", "is still supported", "EOL", "support status", "dependency EOL audit", "batch end-of-life check" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "minItems": 1, "maxItems": 50, "description": "The versions to check, in order", "items": { "type": "object", "properties": { "product": { "type": "string", "description": "endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)", "minLength": 1, "maxLength": 200 }, "version": { "type": "string", "description": "Version string, e.g. 18.19.0 (send \"3.10\" as a string, not a number)", "minLength": 1, "maxLength": 200 } }, "required": [ "product", "version" ], "additionalProperties": false } } }, "required": [ "items" ], "additionalProperties": false }, "example": { "items": [ { "product": "nodejs", "version": "18.19.0" }, { "product": "python", "version": "3.12.4" } ] } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.01" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "matched": { "type": "integer", "minimum": 0 }, "unknown_count": { "type": "integer", "minimum": 0 }, "results": { "type": "array", "items": { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0 }, "product": { "type": "string", "description": "As sent" }, "version": { "type": "string", "description": "As sent" }, "found": { "type": "boolean" }, "resolved": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" }, "match": { "$ref": "#/components/schemas/eol_cycle" }, "reason": { "type": "string", "description": "Why it was not found", "enum": [ "unknown_product", "unknown_version" ] } }, "required": [ "index", "product", "version", "found" ] } }, "unknown": { "type": "array", "items": { "type": "object" }, "description": "The results with found:false" } }, "required": [ "count", "matched", "unknown_count", "results", "unknown" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "count": 2, "matched": 2, "unknown_count": 0, "results": [ { "index": 0, "product": "nodejs", "version": "18.19.0", "found": true, "resolved": "nodejs", "label": "Node.js", "match": { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } }, { "index": 1, "product": "python", "version": "3.12.4", "found": true, "resolved": "python", "label": "Python", "match": { "cycle": "3.12", "eol": "2028-10-31", "latest": "3.12.15", "latest_date": "2026-10-01", "link": "https://www.python.org/downloads/release/python-31215/", "lts": false, "release_date": "2023-10-02", "support_until": "2025-04-02", "status": "security-only", "days_until_eol": 753, "is_lts": false } } ], "unknown": [] }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.01 USD (10000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } }, "get": { "operationId": "stackfacts_eol_check_get", "summary": "Check dependencies, runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs to cycle, end-of-life date and support status.", "description": "Check dependencies, runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs to cycle, end-of-life date and support status.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_check", "x-keywords": [ "check my stack for end-of-life versions", "is still supported", "EOL", "support status", "dependency EOL audit", "batch end-of-life check" ], "parameters": [ { "name": "items", "in": "query", "required": true, "description": "Comma-separated product@version pairs, at most 50, e.g. nodejs@18.19.0,python@3.12.4", "schema": { "type": "string", "minLength": 3 }, "example": "nodejs@18.19.0,python@3.12.4" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.01" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "matched": { "type": "integer", "minimum": 0 }, "unknown_count": { "type": "integer", "minimum": 0 }, "results": { "type": "array", "items": { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0 }, "product": { "type": "string", "description": "As sent" }, "version": { "type": "string", "description": "As sent" }, "found": { "type": "boolean" }, "resolved": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" }, "match": { "$ref": "#/components/schemas/eol_cycle" }, "reason": { "type": "string", "description": "Why it was not found", "enum": [ "unknown_product", "unknown_version" ] } }, "required": [ "index", "product", "version", "found" ] } }, "unknown": { "type": "array", "items": { "type": "object" }, "description": "The results with found:false" } }, "required": [ "count", "matched", "unknown_count", "results", "unknown" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "count": 2, "matched": 2, "unknown_count": 0, "results": [ { "index": 0, "product": "nodejs", "version": "18.19.0", "found": true, "resolved": "nodejs", "label": "Node.js", "match": { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } }, { "index": 1, "product": "python", "version": "3.12.4", "found": true, "resolved": "python", "label": "Python", "match": { "cycle": "3.12", "eol": "2028-10-31", "latest": "3.12.15", "latest_date": "2026-10-01", "link": "https://www.python.org/downloads/release/python-31215/", "lts": false, "release_date": "2023-10-02", "support_until": "2025-04-02", "status": "security-only", "days_until_eol": 753, "is_lts": false } } ], "unknown": [] }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.01 USD (10000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/image": { "get": { "operationId": "stackfacts_eol_image", "summary": "Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.", "description": "Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_image", "x-keywords": [ "is my docker image end-of-life", "container base image EOL", "is still supported", "Dockerfile FROM audit", "EOL", "support status", "base OS end-of-life" ], "parameters": [ { "name": "image", "in": "query", "required": true, "description": "Image reference or a whole Dockerfile FROM line (FROM, --platform and AS name are dropped), e.g. node:18-alpine3.19, python:3.12-slim-bookworm, gcr.io/distroless/nodejs20-debian12, FROM --platform=linux/amd64 ubuntu:22.04 AS build", "schema": { "type": "string", "minLength": 1, "maxLength": 256 }, "example": "node:18-alpine3.19" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.005" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "image": { "type": "string", "description": "As sent" }, "registry": { "type": "string", "description": "Registry host; docker.io for Docker Hub" }, "repository": { "type": "string", "description": "Repository without registry or library/, e.g. node" }, "tag": { "type": [ "string", "null" ], "description": "Tag; latest when neither tag nor digest is given" }, "digest": { "type": [ "string", "null" ], "description": "Digest after @, if any" }, "status": { "type": [ "string", "null" ], "description": "Worst status of the matched components; when the image component itself did not match, the worse of unknown and the matched parts (eol or security-only still show; supported becomes unknown); null when none matched", "enum": [ "supported", "security-only", "eol", "unknown", null ] }, "days_until_eol": { "type": [ "integer", "null" ], "description": "Soonest days_until_eol of the matched components" }, "matched": { "type": "integer", "minimum": 0 }, "complete": { "type": "boolean", "description": "true when every component matched a cycle; false when any part (often the image product, e.g. a floating jenkins:lts tag) did not" }, "components": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string", "description": "image: the product the repository ships; runtime: a runtime the tag names (jdk17, php8.2, otp-26); base_os: the OS the tag names (alpine3.19, bookworm, jammy, ubi9)", "enum": [ "image", "runtime", "base_os" ] }, "product": { "type": [ "string", "null" ], "description": "endoflife.date product id the component maps to" }, "version": { "type": [ "string", "null" ], "description": "Version read from the tag; null when the tag names none" }, "matched_by": { "type": "string", "description": "image role only: known_image (image table) or repository_name (the repository name read as a product id)", "enum": [ "known_image", "repository_name" ] }, "found": { "type": "boolean" }, "floating": { "type": "boolean", "description": "True when a short tag (redis:7) took the newest cycle under it (7.4)" }, "older_than_listed": { "type": "boolean", "description": "True when the version is older than the oldest listed cycle of its major (elasticsearch:8.12 under 8.16), or of the product, and that cycle is eol; match is that cycle" }, "resolved": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" }, "match": { "$ref": "#/components/schemas/eol_cycle" }, "reason": { "type": "string", "description": "Why it was not found", "enum": [ "unknown_image", "unknown_product", "unknown_version", "no_version", "digest_only" ] } }, "required": [ "role", "product", "version", "found" ] } } }, "required": [ "image", "registry", "repository", "tag", "digest", "status", "days_until_eol", "matched", "complete", "components" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "image": "node:18-alpine3.19", "registry": "docker.io", "repository": "node", "tag": "18-alpine3.19", "digest": null, "status": "eol", "days_until_eol": -527, "matched": 2, "complete": true, "components": [ { "role": "image", "product": "nodejs", "version": "18", "matched_by": "known_image", "found": true, "resolved": "nodejs", "label": "Node.js", "match": { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } }, { "role": "base_os", "product": "alpine-linux", "version": "3.19", "found": true, "resolved": "alpine-linux", "label": "Alpine Linux", "match": { "cycle": "3.19", "eol": "2025-11-01", "latest": "3.19.9", "latest_date": "2025-10-08", "link": "https://alpinelinux.org/posts/Alpine-3.17.10-3.18.9-3.19.4-3.20.3-released.html", "lts": false, "release_date": "2023-12-07", "support_until": null, "status": "eol", "days_until_eol": -342, "is_lts": false } } ] }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "y-swWAWNFw94iUOowlaeykuDgZgokmTaN4yousqQUqrlvFjDqnrPeCZVSjamXO_s7vAk1LGVXDA05tW97TcdCw", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.005 USD (5000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/snapshot": { "get": { "operationId": "stackfacts_eol_snapshot", "summary": "Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.", "description": "Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.", "tags": [ "eol", "paid" ], "x-tool-name": "stackfacts_eol_snapshot", "x-keywords": [ "EOL", "end-of-life dataset download", "support status", "is still supported", "endoflife.date bulk", "signed snapshot" ], "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.05" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/snapshot" } }, "required": [ "data" ] }, "example": { "data": { "manifest": { "dataset": "eol", "version": 1, "snapshot_id": "eol-20261009T060000Z-d61970d6", "fetched_at": "2026-10-09T06:00:00Z", "source_url": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "upstream_etag": null, "record_count": 16, "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "prev_snapshot_id": null, "key_id": "sf-test-1", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA" }, "snapshot": { "dataset": "eol", "meta": { "upstream_schema_version": "1.2.1" }, "records": [ { "cycles": [ { "cycle": "24", "eol": "2028-04-30", "latest": "24.21.0", "latest_date": "2026-09-08", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V24.md#24.21.0", "lts": "2025-10-28", "release_date": "2025-05-06", "support_until": "2026-10-20" }, { "cycle": "22", "eol": "2027-04-30", "latest": "22.23.3", "latest_date": "2026-09-23", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V22.md#22.23.3", "lts": "2024-10-29", "release_date": "2024-04-24", "support_until": "2025-10-21" } ], "label": "Node.js", "product": "nodejs" } ], "version": 1 }, "licence": { "spdx": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "source": "https://raw.githubusercontent.com/endoflife-date/endoflife.date/master/LICENSE", "text": "Copyright 2020 endoflife.date contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n", "sources": [ "endoflife.date" ] }, "verify": "sha256 of the canonical JSON (RFC 8785) of data.snapshot equals data.manifest.sha256; data.manifest.signature is Ed25519 (base64url) over the canonical JSON of the manifest without \"signature\", by the key in GET /v1/keys with that key_id" }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.05 USD (50000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/{cve}": { "get": { "operationId": "stackfacts_kev_lookup", "summary": "Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.", "description": "Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.", "tags": [ "kev", "paid" ], "x-tool-name": "stackfacts_kev_lookup", "x-keywords": [ "check if a CVE is actively exploited (CISA KEV)", "known exploited vulnerability", "CISA KEV lookup", "CVE exploited in the wild" ], "parameters": [ { "name": "cve", "in": "path", "required": true, "description": "CVE id, e.g. CVE-2021-44228", "schema": { "type": "string", "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$", "maxLength": 32 }, "example": "CVE-2021-44228" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.002" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "allOf": [ { "$ref": "#/components/schemas/kev_result" } ], "type": "object", "properties": { "catalog_version": { "type": [ "string", "null" ], "description": "CISA catalogVersion the answer was read from" } }, "required": [ "catalog_version" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "cve": "CVE-2021-44228", "in_kev": true, "vendor": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "date_added": "2021-12-10", "due_date": "2021-12-24", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "known_ransomware": true, "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ], "catalog_version": "2026.10.10" }, "meta": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.002 USD (2000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/check": { "post": { "operationId": "stackfacts_kev_check", "summary": "Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.", "description": "Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.", "tags": [ "kev", "paid" ], "x-tool-name": "stackfacts_kev_check", "x-keywords": [ "check if a CVE is actively exploited (CISA KEV)", "batch CVE check", "vulnerability scan triage", "known exploited vulnerabilities" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "cves": { "type": "array", "minItems": 1, "maxItems": 100, "items": { "type": "string", "description": "CVE id, e.g. CVE-2021-44228", "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$", "maxLength": 32 }, "description": "CVE ids; duplicates are merged" } }, "required": [ "cves" ], "additionalProperties": false }, "example": { "cves": [ "CVE-2021-44228", "CVE-1999-0001" ] } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.005" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "in_kev": { "type": "integer", "minimum": 0, "description": "How many are in KEV" }, "catalog_version": { "type": [ "string", "null" ], "description": "CISA catalogVersion" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/kev_result" } } }, "required": [ "count", "in_kev", "catalog_version", "results" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "count": 2, "in_kev": 1, "catalog_version": "2026.10.10", "results": [ { "cve": "CVE-2021-44228", "in_kev": true, "vendor": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "date_added": "2021-12-10", "due_date": "2021-12-24", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "known_ransomware": true, "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ] }, { "cve": "CVE-1999-0001", "in_kev": false } ] }, "meta": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.005 USD (5000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/changes": { "get": { "operationId": "stackfacts_kev_changes", "summary": "List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.", "description": "List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.", "tags": [ "kev", "paid" ], "x-tool-name": "stackfacts_kev_changes", "x-keywords": [ "new CISA KEV entries", "newly exploited vulnerabilities", "KEV change feed", "check if a CVE is actively exploited (CISA KEV)" ], "parameters": [ { "name": "since", "in": "query", "required": true, "description": "meta.snapshot_id of an earlier kev answer, e.g. kev-20261009T060000Z-1a2b3c4d; kept for 30 snapshots", "schema": { "type": "string", "pattern": "^kev-\\d{8}T\\d{6}Z-[0-9a-f]{8}$", "maxLength": 64 }, "example": "kev-20261009T040000Z-7bd60fe8" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.01" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "since": { "type": "string", "description": "The since snapshot_id" }, "to": { "type": "string", "description": "The live snapshot_id" }, "snapshots_merged": { "type": "integer", "minimum": 0 }, "counts": { "type": "object", "properties": { "added": { "type": "integer" }, "removed": { "type": "integer" }, "modified": { "type": "integer" } }, "required": [ "added", "removed", "modified" ] }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/kev_entry" } }, "removed": { "type": "array", "items": { "type": "string" }, "description": "Ids no longer present" }, "modified": { "type": "array", "items": { "$ref": "#/components/schemas/kev_entry" } } }, "required": [ "since", "to", "snapshots_merged", "counts", "added", "removed", "modified" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "since": "kev-20261009T040000Z-7bd60fe8", "to": "kev-20261009T060000Z-f4586cc5", "snapshots_merged": 2, "counts": { "added": 2, "removed": 1, "modified": 3 }, "added": [], "removed": [ "CVE-2009-3459" ], "modified": [ { "cve": "CVE-2023-34362", "in_kev": true, "vendor": "Progress", "product": "MOVEit Transfer", "name": "Progress MOVEit Transfer SQL Injection Vulnerability", "date_added": "2023-06-02", "due_date": "2023-06-30", "required_action": "Apply updates per vendor instructions.", "known_ransomware": true, "notes_urls": [ "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] } ] }, "meta": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.01 USD (10000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/snapshot": { "get": { "operationId": "stackfacts_kev_snapshot", "summary": "Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.", "description": "Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.", "tags": [ "kev", "paid" ], "x-tool-name": "stackfacts_kev_snapshot", "x-keywords": [ "CISA KEV download", "known exploited vulnerabilities catalog", "signed snapshot" ], "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.05" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/snapshot" } }, "required": [ "data" ] }, "example": { "data": { "manifest": { "dataset": "kev", "version": 1, "snapshot_id": "kev-20261009T060000Z-f4586cc5", "fetched_at": "2026-10-09T06:00:00Z", "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "upstream_etag": null, "record_count": 31, "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "prev_snapshot_id": "kev-20261009T050000Z-013e1b3f", "key_id": "sf-test-1", "upstream_meta": { "catalogVersion": "2026.10.10", "dateReleased": "2026-10-10T02:00:00.0000Z" }, "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA" }, "snapshot": { "dataset": "kev", "records": [ { "cve": "CVE-2021-44228", "date_added": "2021-12-10", "due_date": "2021-12-24", "known_ransomware": true, "name": "Apache Log4j2 Remote Code Execution Vulnerability", "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ], "product": "Log4j2", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "vendor": "Apache" } ], "version": 1 }, "licence": { "spdx": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "source": "https://www.cisa.gov/sites/default/files/licenses/kev/license.txt", "text": "The KEV database is distributed under the Creative Commons 0 1.0 License. You may use this data in any legal manner but note that information provided at any 3rd party links included in the KEV database are bound by the policies and licenses of those 3rd party websites. Use of the information does not authorize you to use the CISA Logo or DHS Seal, nor should such use be interpreted as an endorsement by CISA or DHS.\n\nCC0 1.0 Universal legal code: https://creativecommons.org/publicdomain/zero/1.0/legalcode\n", "sources": [ "CISA KEV" ] }, "verify": "sha256 of the canonical JSON (RFC 8785) of data.snapshot equals data.manifest.sha256; data.manifest.signature is Ed25519 (base64url) over the canonical JSON of the manifest without \"signature\", by the key in GET /v1/keys with that key_id" }, "meta": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.05 USD (50000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/{provider}/{model}": { "get": { "operationId": "stackfacts_models_lookup", "summary": "Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.", "description": "Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.", "tags": [ "models", "paid" ], "x-tool-name": "stackfacts_models_lookup", "x-keywords": [ "price per million tokens", "context window", "model deprecation date", "LLM pricing", "max output tokens" ], "parameters": [ { "name": "provider", "in": "path", "required": true, "description": "Provider, e.g. openai, anthropic, google (GET /v1/models/index lists them)", "schema": { "type": "string", "minLength": 1, "maxLength": 100 }, "example": "openai" }, { "name": "model", "in": "path", "required": true, "description": "Model id at the provider, e.g. gpt-4o", "schema": { "type": "string", "minLength": 1, "maxLength": 200 }, "example": "gpt-4o" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.002" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/model" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "aliases": [], "cache_read_usd_per_mtok": 1.25, "cache_write_usd_per_mtok": null, "context_tokens": 128000, "deprecation_date": null, "id": "openai/gpt-4o", "input_modalities": [ "text", "image", "pdf" ], "input_usd_per_mtok": 2, "knowledge_cutoff": "2023-09", "max_output_tokens": 16384, "mode": "chat", "model": "gpt-4o", "name": "GPT-4o", "output_modalities": [ "text" ], "output_usd_per_mtok": 10, "provider": "openai", "reasoning": false, "release_date": "2024-05-13", "sources": { "litellm": true, "modelsdev": true }, "sources_disagree": [ "input_usd_per_mtok" ], "status": null, "tool_call": true, "vision": true, "deprecated": false, "days_until_deprecation": null }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.002 USD (2000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/estimate": { "post": { "operationId": "stackfacts_models_estimate", "summary": "Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.", "description": "Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.", "tags": [ "models", "paid" ], "x-tool-name": "stackfacts_models_estimate", "x-keywords": [ "LLM cost estimate", "price per million tokens", "token cost calculator", "how much will this prompt cost" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "model": { "type": "string", "description": "provider/model id, e.g. openai/gpt-4o", "minLength": 1, "maxLength": 200 }, "input_tokens": { "type": "integer", "minimum": 0, "maximum": 10000000000, "description": "Uncached input tokens" }, "output_tokens": { "type": "integer", "minimum": 0, "maximum": 10000000000, "description": "Output tokens" }, "cached_tokens": { "type": "integer", "minimum": 0, "maximum": 10000000000, "description": "Cached input tokens (cache reads)" } }, "required": [ "model" ], "anyOf": [ { "required": [ "input_tokens" ] }, { "required": [ "output_tokens" ] }, { "required": [ "cached_tokens" ] } ], "additionalProperties": false }, "example": { "model": "openai/gpt-4o", "input_tokens": 1000, "output_tokens": 200, "cached_tokens": 0 } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.002" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "model": { "type": "string", "description": "provider/model" }, "name": { "type": [ "string", "null" ], "description": "Display name" }, "lines": { "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string", "description": "input, output or cached", "enum": [ "input", "output", "cached" ] }, "tokens": { "type": "integer" }, "price_field": { "type": "string", "description": "Price field used" }, "usd_per_mtok": { "type": "number" }, "cost_usd": { "type": "string", "description": "Exact decimal USD" } }, "required": [ "kind", "tokens", "price_field", "usd_per_mtok", "cost_usd" ] } }, "cost_usd": { "type": "string", "description": "Exact total in USD (decimal string)" }, "cost_micro_usd": { "type": "integer", "description": "Total rounded half up to the micro-dollar" }, "formula": { "type": "string", "description": "How the cost is computed" }, "notes": { "type": "array", "items": { "type": "string" } }, "deprecated": { "type": "boolean" }, "days_until_deprecation": { "type": [ "integer", "null" ], "description": "Days until deprecation" }, "deprecation_date": { "type": [ "string", "null" ], "description": "Deprecation date" }, "sources_disagree": { "type": "array", "items": { "type": "string" } } }, "required": [ "model", "name", "lines", "cost_usd", "cost_micro_usd", "formula", "notes", "deprecated", "days_until_deprecation", "deprecation_date", "sources_disagree" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "model": "openai/gpt-4o", "name": "GPT-4o", "lines": [ { "kind": "input", "tokens": 1000, "price_field": "input_usd_per_mtok", "usd_per_mtok": 2, "cost_usd": "0.002" }, { "kind": "output", "tokens": 200, "price_field": "output_usd_per_mtok", "usd_per_mtok": 10, "cost_usd": "0.002" }, { "kind": "cached", "tokens": 0, "price_field": "cache_read_usd_per_mtok", "usd_per_mtok": 1.25, "cost_usd": "0" } ], "cost_usd": "0.004", "cost_micro_usd": 4000, "formula": "cost_usd = (input_tokens × input + output_tokens × output + cached_tokens × cached) / 1,000,000, prices in USD per million tokens; input_tokens exclude cached_tokens; cost_usd is exact, cost_micro_usd is it rounded half up to the micro-dollar", "notes": [], "deprecated": false, "days_until_deprecation": null, "deprecation_date": null, "sources_disagree": [ "input_usd_per_mtok" ] }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.002 USD (2000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/cheapest": { "post": { "operationId": "stackfacts_models_cheapest", "summary": "Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.", "description": "Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.", "tags": [ "models", "paid" ], "x-tool-name": "stackfacts_models_cheapest", "x-keywords": [ "cheapest model with tools and 128k context", "cheapest LLM", "price per million tokens", "context window", "model comparison" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "min_context": { "type": "integer", "minimum": 1, "description": "Minimum context window in tokens" }, "tools": { "type": "boolean", "description": "Require tool calling" }, "vision": { "type": "boolean", "description": "Require image input" }, "max_usd_per_mtok": { "type": "number", "minimum": 0, "description": "Max blended USD per million tokens (3:1 input:output)" }, "providers": { "type": "array", "minItems": 1, "maxItems": 20, "items": { "type": "string", "maxLength": 40 }, "description": "Only these providers" }, "include_deprecated": { "type": "boolean", "description": "Keep deprecated models (default false)" }, "include_free": { "type": "boolean", "description": "Keep models priced 0/0 (default false)" } }, "additionalProperties": false }, "example": { "min_context": 128000, "tools": true } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.008" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "results": { "type": "array", "maxItems": 10, "items": { "type": "object", "properties": { "rank": { "type": "integer", "minimum": 1 }, "id": { "type": "string", "description": "provider/model" }, "name": { "type": [ "string", "null" ], "description": "Display name" }, "blended_usd_per_mtok": { "type": "number" }, "input_usd_per_mtok": { "type": "number" }, "output_usd_per_mtok": { "type": "number" }, "cache_read_usd_per_mtok": { "type": [ "number", "null" ], "description": "Cached input price" }, "context_tokens": { "type": [ "integer", "null" ], "description": "Context window" }, "max_output_tokens": { "type": [ "integer", "null" ], "description": "Max output tokens" }, "tool_call": { "type": [ "boolean", "null" ], "description": "Tool calling" }, "vision": { "type": [ "boolean", "null" ], "description": "Image input" }, "reasoning": { "type": [ "boolean", "null" ], "description": "Reasoning" }, "deprecated": { "type": "boolean" }, "days_until_deprecation": { "type": [ "integer", "null" ], "description": "Days until deprecation" }, "sources_disagree": { "type": "array", "items": { "type": "string" } } }, "required": [ "rank", "id", "blended_usd_per_mtok", "input_usd_per_mtok", "output_usd_per_mtok" ] } }, "filter": { "type": "object", "properties": { "applied": { "type": "object" }, "considered": { "type": "integer" }, "matched": { "type": "integer" }, "returned": { "type": "integer" }, "excluded": { "type": "object" }, "reasons": { "type": "object" } }, "required": [ "applied", "considered", "matched", "returned", "excluded", "reasons" ] }, "ranking": { "type": "string", "description": "How blended_usd_per_mtok is computed" } }, "required": [ "results", "filter", "ranking" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "results": [ { "rank": 1, "id": "cohere/command-r-08-2024", "name": "Command R", "blended_usd_per_mtok": 0.2625, "input_usd_per_mtok": 0.15, "output_usd_per_mtok": 0.6, "cache_read_usd_per_mtok": null, "context_tokens": 128000, "max_output_tokens": 4000, "tool_call": true, "vision": false, "reasoning": false, "deprecated": false, "days_until_deprecation": null, "sources_disagree": [] }, { "rank": 2, "id": "deepseek/deepseek-flash", "name": "DeepSeek V4.1 Flash", "blended_usd_per_mtok": 0.2625, "input_usd_per_mtok": 0.15, "output_usd_per_mtok": 0.6, "cache_read_usd_per_mtok": 0.003, "context_tokens": 1000000, "max_output_tokens": 393216, "tool_call": true, "vision": true, "reasoning": true, "deprecated": false, "days_until_deprecation": null, "sources_disagree": [] } ], "filter": { "applied": { "min_context": 128000, "tools": true, "vision": false, "max_usd_per_mtok": null, "providers": null, "include_deprecated": false, "include_free": false }, "considered": 36, "matched": 24, "returned": 10, "excluded": { "provider": 0, "not_text": 1, "no_price": 0, "free": 1, "deprecated": 10, "context": 0, "tools": 0, "vision": 0, "price": 0 }, "reasons": { "provider": "provider is not in the providers list", "not_text": "mode is not text generation (chat, responses, completion)", "no_price": "no input or output price in the sources", "free": "input and output price are both 0 (free preview or unfilled price; send include_free:true to keep them)", "deprecated": "deprecated now (send include_deprecated:true to keep them)", "context": "context_tokens unknown or below min_context", "tools": "tool calling not confirmed (tools:true)", "vision": "image input not confirmed (vision:true)", "price": "blended price above max_usd_per_mtok" } }, "ranking": "blended_usd_per_mtok = (3 × input + 1 × output) / 4 USD per million tokens (a 3:1 input:output token mix), cheapest first, ties by id; top 10" }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.008 USD (8000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/changes": { "get": { "operationId": "stackfacts_models_changes", "summary": "List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.", "description": "List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.", "tags": [ "models", "paid" ], "x-tool-name": "stackfacts_models_changes", "x-keywords": [ "LLM price changes", "model deprecation date", "new LLM models", "price per million tokens" ], "parameters": [ { "name": "since", "in": "query", "required": true, "description": "meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots", "schema": { "type": "string", "pattern": "^models-\\d{8}T\\d{6}Z-[0-9a-f]{8}$", "maxLength": 64 }, "example": "models-20261009T050000Z-044bcb8b" }, { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.02" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "since": { "type": "string", "description": "The since snapshot_id" }, "to": { "type": "string", "description": "The live snapshot_id" }, "snapshots_merged": { "type": "integer", "minimum": 0 }, "counts": { "type": "object", "properties": { "added": { "type": "integer" }, "removed": { "type": "integer" }, "modified": { "type": "integer" } }, "required": [ "added", "removed", "modified" ] }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/model" } }, "removed": { "type": "array", "items": { "type": "string" }, "description": "Ids no longer present" }, "modified": { "type": "array", "items": { "$ref": "#/components/schemas/model" } } }, "required": [ "since", "to", "snapshots_merged", "counts", "added", "removed", "modified" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "since": "models-20261009T050000Z-044bcb8b", "to": "models-20261009T060000Z-f99d55c9", "snapshots_merged": 1, "counts": { "added": 1, "removed": 1, "modified": 2 }, "added": [], "removed": [ "perplexity/sonar" ], "modified": [ { "aliases": [], "cache_read_usd_per_mtok": 0.075, "cache_write_usd_per_mtok": null, "context_tokens": 128000, "deprecation_date": "2026-10-01", "id": "openai/gpt-4o-mini", "input_modalities": [ "text", "image", "pdf" ], "input_usd_per_mtok": 0.15, "knowledge_cutoff": "2023-09", "max_output_tokens": 16384, "mode": "chat", "model": "gpt-4o-mini", "name": "GPT-4o mini", "output_modalities": [ "text" ], "output_usd_per_mtok": 0.6, "provider": "openai", "reasoning": false, "release_date": "2024-07-18", "sources": { "litellm": true, "modelsdev": true }, "sources_disagree": [], "status": null, "tool_call": true, "vision": true, "deprecated": true, "days_until_deprecation": -8 } ] }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.02 USD (20000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/snapshot": { "get": { "operationId": "stackfacts_models_snapshot", "summary": "Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.", "description": "Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.", "tags": [ "models", "paid" ], "x-tool-name": "stackfacts_models_snapshot", "x-keywords": [ "LLM pricing dataset", "price per million tokens", "context window", "signed snapshot" ], "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.05" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/snapshot" } }, "required": [ "data" ] }, "example": { "data": { "manifest": { "dataset": "models", "version": 1, "snapshot_id": "models-20261009T060000Z-f99d55c9", "fetched_at": "2026-10-09T06:00:00Z", "source_url": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "upstream_etag": { "litellm": null, "modelsdev": null }, "record_count": 36, "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "prev_snapshot_id": "models-20261009T050000Z-044bcb8b", "key_id": "sf-test-1", "upstream_meta": { "litellm": { "bytes": 34408, "entries": 39, "kept": 26, "skipped": { "provider_not_in_scope": 3, "duplicate_id": 3, "finetune": 1, "mode_not_priced_per_token": 4, "id_not_supported": 2, "sample_spec": 1 } }, "modelsdev": { "bytes": 25204, "providers": 13, "models": 37, "kept": 28, "skipped": { "provider_not_in_scope": 2, "not_text_to_text": 6, "id_not_supported": 1 } }, "merged": { "both": 18, "litellm_only": 8, "modelsdev_only": 10, "disagree": 8 } }, "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ" }, "snapshot": { "dataset": "models", "records": [ { "aliases": [], "cache_read_usd_per_mtok": 1.25, "cache_write_usd_per_mtok": null, "context_tokens": 128000, "deprecation_date": null, "id": "openai/gpt-4o", "input_modalities": [ "text", "image", "pdf" ], "input_usd_per_mtok": 2, "knowledge_cutoff": "2023-09", "max_output_tokens": 16384, "mode": "chat", "model": "gpt-4o", "name": "GPT-4o", "output_modalities": [ "text" ], "output_usd_per_mtok": 10, "provider": "openai", "reasoning": false, "release_date": "2024-05-13", "sources": { "litellm": true, "modelsdev": true }, "sources_disagree": [ "input_usd_per_mtok" ], "status": null, "tool_call": true, "vision": true } ], "version": 1 }, "licence": { "spdx": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/LICENSE (LiteLLM, MIT); https://raw.githubusercontent.com/anomalyco/models.dev/dev/LICENSE (models.dev, MIT)", "text": "LiteLLM (https://raw.githubusercontent.com/BerriAI/litellm/main/LICENSE):\n\nPortions of this software are licensed as follows:\n\n* All content that resides under the \"enterprise/\" directory of this repository, if that directory exists, is licensed under the license defined in \"enterprise/LICENSE\".\n* Content outside of the above mentioned directories or restrictions above is available under the MIT license as defined below.\n---\nMIT License\n\nCopyright (c) 2023 Berri AI\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n----------\n\nmodels.dev (https://raw.githubusercontent.com/anomalyco/models.dev/dev/LICENSE):\n\nMIT License\n\nCopyright (c) 2025 models.dev\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n", "sources": [ "LiteLLM", "models.dev" ] }, "verify": "sha256 of the canonical JSON (RFC 8785) of data.snapshot equals data.manifest.sha256; data.manifest.signature is Ed25519 (base64url) over the canonical JSON of the manifest without \"signature\", by the key in GET /v1/keys with that key_id" }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.05 USD (50000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/stack/check": { "post": { "operationId": "stackfacts_stack_check", "summary": "Check dependencies, runtimes and OS versions in one call: OSV advisories for up to 50 package purls, EOL status for 50 product@version pairs, CISA KEV hits.", "description": "Check dependencies, runtimes and OS versions in one call: OSV advisories for up to 50 package purls, EOL status for 50 product@version pairs, CISA KEV hits.", "tags": [ "stack", "paid" ], "x-tool-name": "stackfacts_stack_check", "x-keywords": [ "check my stack for end-of-life versions and exploited CVEs", "stack audit", "EOL, package vulnerabilities and KEV in one call", "is still supported", "dependency risk check", "known exploited vulnerabilities" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "minItems": 0, "maxItems": 50, "description": "The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent", "items": { "anyOf": [ { "type": "string", "description": "product@version, e.g. nodejs@18.19.0 (GET /v1/eol/index lists products)", "pattern": "^[^@]+@.+$", "minLength": 3, "maxLength": 401 }, { "type": "object", "properties": { "product": { "type": "string", "description": "endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)", "minLength": 1, "maxLength": 200 }, "version": { "type": "string", "description": "Version string, e.g. 18.19.0 (send \"3.10\" as a string, not a number)", "minLength": 1, "maxLength": 200 } }, "required": [ "product", "version" ], "additionalProperties": false } ] } }, "cves": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "type": "string", "description": "CVE id, e.g. CVE-2021-44228", "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$", "maxLength": 32 }, "description": "Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only" }, "packages": { "type": "array", "minItems": 0, "maxItems": 50, "description": "Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)", "items": { "type": "string", "description": "purl with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "pattern": "^pkg:", "minLength": 7, "maxLength": 512 } } }, "required": [], "additionalProperties": false }, "example": { "items": [ "nodejs@18.19.0", "python@3.12.4" ], "cves": [ "CVE-1999-0001", "CVE-2021-44228" ], "packages": [ "pkg:npm/lodash@4.17.20" ] } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.012" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "summary": { "type": "object", "properties": { "items": { "type": "integer", "minimum": 0, "description": "Product versions sent" }, "matched": { "type": "integer", "minimum": 0, "description": "How many matched a product and cycle" }, "unknown": { "type": "integer", "minimum": 0, "description": "How many did not" }, "by_status": { "type": "object", "description": "Matched versions per support status", "properties": { "supported": { "type": "integer", "minimum": 0 }, "security-only": { "type": "integer", "minimum": 0 }, "eol": { "type": "integer", "minimum": 0 }, "unknown": { "type": "integer", "minimum": 0 } }, "required": [ "supported", "security-only", "eol", "unknown" ] }, "cves": { "type": "integer", "minimum": 0, "description": "CVE ids checked (after merging duplicates)" }, "in_kev": { "type": "integer", "minimum": 0, "description": "How many are in CISA KEV" }, "packages": { "type": "integer", "minimum": 0, "description": "Purls sent (only when packages were sent)" }, "packages_affected": { "type": "integer", "minimum": 0, "description": "Purls with at least one affecting advisory (only when packages were sent)" }, "packages_in_kev": { "type": "integer", "minimum": 0, "description": "Purls affected by an advisory whose CVE is in CISA KEV (only when packages were sent)" } }, "required": [ "items", "matched", "unknown", "by_status", "cves", "in_kev" ] }, "eol": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "matched": { "type": "integer", "minimum": 0 }, "unknown_count": { "type": "integer", "minimum": 0 }, "results": { "type": "array", "items": { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0 }, "product": { "type": "string", "description": "As sent" }, "version": { "type": "string", "description": "As sent" }, "found": { "type": "boolean" }, "resolved": { "type": "string", "description": "Canonical product id" }, "label": { "type": "string", "description": "Display name" }, "match": { "$ref": "#/components/schemas/eol_cycle" }, "reason": { "type": "string", "description": "Why it was not found", "enum": [ "unknown_product", "unknown_version" ] } }, "required": [ "index", "product", "version", "found" ] } }, "unknown": { "type": "array", "items": { "type": "object" }, "description": "The results with found:false" } }, "required": [ "count", "matched", "unknown_count", "results", "unknown" ], "description": "The EOL check, as POST /v1/eol/check answers it" }, "kev": { "type": [ "object", "null" ], "properties": { "count": { "type": "integer", "minimum": 0 }, "in_kev": { "type": "integer", "minimum": 0, "description": "How many are in KEV" }, "catalog_version": { "type": [ "string", "null" ], "description": "CISA catalogVersion" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/kev_result" } } }, "required": [ "count", "in_kev", "catalog_version", "results" ], "description": "The CISA KEV check, as POST /v1/kev/check answers it; null when no CVE was sent" }, "osv": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "summary": { "type": "object", "properties": { "packages": { "type": "integer", "minimum": 0, "description": "Purls sent" }, "affected": { "type": "integer", "minimum": 0, "description": "Purls with at least one affecting advisory" }, "versions_unknown": { "type": "integer", "minimum": 0, "description": "Purls named by advisories whose versions cannot be checked (never counted as affected)" }, "no_known_advisories": { "type": "integer", "minimum": 0 }, "unanswered": { "type": "integer", "minimum": 0, "description": "Purls of a type or ecosystem not available" }, "advisories": { "type": "integer", "minimum": 0, "description": "Advisories returned" }, "malicious": { "type": "integer", "minimum": 0, "description": "Purls with a malicious-package report" }, "in_kev": { "type": "integer", "minimum": 0, "description": "Purls with an advisory whose CVE is in CISA KEV" } }, "required": [ "packages", "affected", "versions_unknown", "no_known_advisories", "unanswered", "advisories", "malicious", "in_kev" ] }, "kev_catalog_version": { "type": [ "string", "null" ], "description": "CISA catalogVersion" }, "results": { "type": "array", "items": { "type": "object", "properties": { "purl": { "type": "string", "description": "As sent" }, "ecosystem": { "type": [ "string", "null" ], "description": "OSV ecosystem, null for an unsupported purl type" }, "name": { "type": "string", "description": "Package name as OSV writes it" }, "version": { "type": "string" }, "status": { "type": "string", "enum": [ "affected", "versions_unknown", "no_known_advisories", "unsupported_type", "ecosystem_unavailable" ] }, "malicious": { "type": "boolean" }, "kev": { "type": "boolean" }, "advisories": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "OSV id, e.g. GHSA-35jh-r3h4-6jhm" }, "kind": { "type": "string", "description": "vuln, or malicious for a malicious-package report", "enum": [ "vuln", "malicious" ] }, "aliases": { "type": "array", "items": { "type": "string" }, "description": "Other ids for the same issue (CVE, GHSA, RUSTSEC...)" }, "summary": { "type": [ "string", "null" ], "description": "One-line summary, when the advisory has one" }, "severity": { "type": "array", "items": { "type": "object" }, "description": "OSV severity scores, e.g. {type: CVSS_V3, score}" }, "severity_label": { "type": [ "string", "null" ], "description": "Database severity label, e.g. HIGH" }, "published": { "type": [ "string", "null" ], "description": "ISO 8601" }, "modified": { "type": [ "string", "null" ], "description": "ISO 8601" }, "match": { "type": "string", "description": "affected: the version is in an affected range or list; versions_unknown: the advisory names the package but its versions cannot be checked", "enum": [ "affected", "versions_unknown" ] }, "reason": { "type": "string", "description": "Why versions are unknown", "enum": [ "no_versions_listed", "version_not_comparable" ] }, "fixed": { "type": "array", "items": { "type": "string" }, "description": "Fixed versions named by the advisory for this package" }, "kev": { "type": "boolean", "description": "True when a CVE alias is in CISA KEV" }, "kev_cves": { "type": "array", "items": { "type": "string" }, "description": "The CVE aliases in CISA KEV" }, "sources": { "type": "array", "description": "The upstream database records to credit, with their licences", "items": { "type": "object", "properties": { "id": { "type": "string" }, "prefix": { "type": "string" }, "name": { "type": "string" }, "licence": { "type": "string", "description": "SPDX id" }, "licence_url": { "type": "string" }, "url": { "type": "string" } }, "required": [ "id", "prefix", "name", "licence", "url" ] } } }, "required": [ "id", "kind", "aliases", "match", "fixed", "kev", "kev_cves", "sources" ] } } }, "required": [ "purl", "ecosystem", "name", "version", "status", "malicious", "kev", "advisories" ] } } }, "required": [ "count", "summary", "kev_catalog_version", "results" ], "description": "The OSV check, as POST /v1/osv/check answers it; only when packages were sent" } }, "required": [ "summary", "eol", "kev" ] }, "meta": { "$ref": "#/components/schemas/stack_meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "summary": { "items": 2, "matched": 2, "unknown": 0, "by_status": { "supported": 0, "security-only": 1, "eol": 1, "unknown": 0 }, "cves": 2, "in_kev": 1, "packages": 1, "packages_affected": 1, "packages_in_kev": 0 }, "eol": { "count": 2, "matched": 2, "unknown_count": 0, "results": [ { "index": 0, "product": "nodejs", "version": "18.19.0", "found": true, "resolved": "nodejs", "label": "Node.js", "match": { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } }, { "index": 1, "product": "python", "version": "3.12.4", "found": true, "resolved": "python", "label": "Python", "match": { "cycle": "3.12", "eol": "2028-10-31", "latest": "3.12.15", "latest_date": "2026-10-01", "link": "https://www.python.org/downloads/release/python-31215/", "lts": false, "release_date": "2023-10-02", "support_until": "2025-04-02", "status": "security-only", "days_until_eol": 753, "is_lts": false } } ], "unknown": [] }, "kev": { "count": 2, "in_kev": 1, "catalog_version": "2026.10.10", "results": [ { "cve": "CVE-1999-0001", "in_kev": false }, { "cve": "CVE-2021-44228", "in_kev": true, "vendor": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "date_added": "2021-12-10", "due_date": "2021-12-24", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "known_ransomware": true, "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ] } ] }, "osv": { "count": 1, "summary": { "packages": 1, "affected": 1, "versions_unknown": 0, "no_known_advisories": 0, "unanswered": 0, "advisories": 1, "malicious": 0, "in_kev": 0 }, "kev_catalog_version": "2026.10.10", "results": [ { "purl": "pkg:npm/lodash@4.17.20", "ecosystem": "npm", "name": "lodash", "version": "4.17.20", "status": "affected", "malicious": false, "kev": false, "advisories": [ { "id": "GHSA-35jh-r3h4-6jhm", "kind": "vuln", "aliases": [ "CVE-2021-23337" ], "summary": "Command Injection in lodash", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "severity_label": "HIGH", "published": "2021-05-06T16:05:51Z", "modified": "2026-09-10T03:49:04Z", "match": "affected", "fixed": [ "4.17.21" ], "kev": false, "kev_cves": [], "sources": [ { "id": "GHSA-35jh-r3h4-6jhm", "prefix": "GHSA", "name": "GitHub Advisory Database", "licence": "CC-BY-4.0", "licence_url": "https://creativecommons.org/licenses/by/4.0/", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm" } ] } ] } ] } }, "meta": { "dataset": "stack", "datasets": { "eol": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "WdWwHSWQ_G2JQhNUUOLK2-ybxeaGDIlCXACYglJPGZZTgRWpKgas13mXUMY_MLIvO-sf14hJj19OjOx-QgCXDA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "kev": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "OyjcING3gmbUyak8Lzy_uGqeNUJJal_0BqsoIIJ-bkxa2tk3bu1MsZtwSZ8xiXZllLl7UcrsLvIZMcaxVEVdAg", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "osv": { "dataset": "osv", "snapshot_id": "osv-2026-10-09T06:00:00.000Z", "as_of": "2026-10-09T06:00:00.000Z", "source": "https://osv.dev/", "attribution": "Vulnerability data from OSV.dev and the upstream databases listed, under their licences; joined and reformatted by Stack Facts (records are modified: fields trimmed and reshaped).", "licence_url": "/licences", "ecosystems": { "npm": { "imported_at": "2026-10-09T06:00:00.000Z", "checked_at": "2026-10-09T06:00:00.000Z", "records": 5, "sha256": "18381a44c0ac8924b4de17ccb980bb385ae3015a788e0f40b57e4feb0bcd2f64" } }, "retrieved_at": "2026-10-09T06:00:00.000Z", "age_hours": 1, "cadence_hours": 6, "stale_at": "2026-10-09T18:00:00.001Z", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } }, "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.012 USD (12000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/osv/check": { "post": { "operationId": "stackfacts_osv_check", "summary": "Check dependencies for known vulnerabilities: up to 50 package purls (npm, PyPI, Go, crates.io, Maven) against OSV.dev, with fixed versions and CISA KEV flags.", "description": "Check dependencies for known vulnerabilities: up to 50 package purls (npm, PyPI, Go, crates.io, Maven) against OSV.dev, with fixed versions and CISA KEV flags.", "tags": [ "osv", "paid" ], "x-tool-name": "stackfacts_osv_check", "x-keywords": [ "check my dependencies for known vulnerabilities", "is vulnerable", "OSV", "purl", "npm PyPI Go crates.io Maven advisories", "GHSA", "fixed version", "known exploited vulnerabilities", "malicious package check" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "packages": { "type": "array", "minItems": 1, "maxItems": 50, "description": "Package URLs with versions, in order. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)", "items": { "type": "string", "description": "purl with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "pattern": "^pkg:", "minLength": 7, "maxLength": 512 } } }, "required": [ "packages" ], "additionalProperties": false }, "example": { "packages": [ "pkg:npm/lodash@4.17.20", "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1" ] } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.005" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/osv_data" }, "meta": { "$ref": "#/components/schemas/osv_meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "count": 2, "summary": { "packages": 2, "affected": 2, "versions_unknown": 0, "no_known_advisories": 0, "unanswered": 0, "advisories": 2, "malicious": 0, "in_kev": 1 }, "kev_catalog_version": "2026.10.10", "results": [ { "purl": "pkg:npm/lodash@4.17.20", "ecosystem": "npm", "name": "lodash", "version": "4.17.20", "status": "affected", "malicious": false, "kev": false, "advisories": [ { "id": "GHSA-35jh-r3h4-6jhm", "kind": "vuln", "aliases": [ "CVE-2021-23337" ], "summary": "Command Injection in lodash", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "severity_label": "HIGH", "published": "2021-05-06T16:05:51Z", "modified": "2026-09-10T03:49:04Z", "match": "affected", "fixed": [ "4.17.21" ], "kev": false, "kev_cves": [], "sources": [ { "id": "GHSA-35jh-r3h4-6jhm", "prefix": "GHSA", "name": "GitHub Advisory Database", "licence": "CC-BY-4.0", "licence_url": "https://creativecommons.org/licenses/by/4.0/", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm" } ] } ] }, { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1", "status": "affected", "malicious": false, "kev": true, "advisories": [ { "id": "GHSA-jfh8-c2jp-5v3q", "kind": "vuln", "aliases": [ "CVE-2021-44228" ], "summary": "Remote code injection in Log4j", "severity": [], "severity_label": "CRITICAL", "published": "2021-12-10T00:40:56Z", "modified": "2025-10-22T19:37:02Z", "match": "affected", "fixed": [ "2.3.1", "2.12.2", "2.15.0" ], "kev": true, "kev_cves": [ "CVE-2021-44228" ], "sources": [ { "id": "GHSA-jfh8-c2jp-5v3q", "prefix": "GHSA", "name": "GitHub Advisory Database", "licence": "CC-BY-4.0", "licence_url": "https://creativecommons.org/licenses/by/4.0/", "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q" } ] } ] } ] }, "meta": { "dataset": "osv", "datasets": { "osv": { "dataset": "osv", "snapshot_id": "osv-2026-10-09T06:00:00.000Z", "as_of": "2026-10-09T06:00:00.000Z", "source": "https://osv.dev/", "attribution": "Vulnerability data from OSV.dev and the upstream databases listed, under their licences; joined and reformatted by Stack Facts (records are modified: fields trimmed and reshaped).", "licence_url": "/licences", "ecosystems": { "Maven": { "imported_at": "2026-10-09T06:00:00.000Z", "checked_at": "2026-10-09T06:00:00.000Z", "records": 1, "sha256": "0a0af280cdda1e3364b88d8cc643de8379039f8500da31908180f6bc5b64ffb6" }, "npm": { "imported_at": "2026-10-09T06:00:00.000Z", "checked_at": "2026-10-09T06:00:00.000Z", "records": 5, "sha256": "18381a44c0ac8924b4de17ccb980bb385ae3015a788e0f40b57e4feb0bcd2f64" } }, "retrieved_at": "2026-10-09T06:00:00.000Z", "age_hours": 1, "cadence_hours": 6, "stale_at": "2026-10-09T18:00:00.001Z", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "kev": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "YcR1ldc55CB3kaodZXUB9yJbMoM2JaLe-SIfVjv12-CQzVv68d76yPy2fwY_nOvKht-6zMC8BLA7QgJIwJeSAw", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } }, "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.005 USD (5000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/preflight": { "post": { "operationId": "stackfacts_preflight", "summary": "Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.", "description": "Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.", "tags": [ "preflight", "paid" ], "x-tool-name": "stackfacts_preflight", "x-keywords": [ "call before installing a package an LLM suggested", "npm install check", "pip install check", "package preflight", "malicious package check", "known exploited vulnerabilities", "OSV", "purl" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "package": { "type": "string", "description": "Package URL with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:pypi/jinja2@2.11.2. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are refused until imported). Send this, or ecosystem, name and version", "pattern": "^pkg:", "minLength": 7, "maxLength": 512 }, "ecosystem": { "type": "string", "description": "npm, pypi, golang, cargo or maven (with name and version, instead of package)", "maxLength": 200 }, "name": { "type": "string", "description": "Package name as the registry spells it, e.g. lodash, @babel/traverse, jinja2, org.apache.logging.log4j:log4j-core", "maxLength": 200 }, "version": { "type": "string", "description": "Exact version, e.g. 4.17.20", "maxLength": 200 } }, "additionalProperties": false }, "example": { "package": "pkg:npm/lodash@4.17.20" } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.008" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "package": { "type": "object", "properties": { "purl": { "type": "string", "description": "The package as asked" }, "ecosystem": { "type": "string", "description": "OSV ecosystem" }, "name": { "type": "string", "description": "Package name" }, "version": { "type": "string", "description": "Version" } }, "required": [ "purl", "ecosystem", "name", "version" ] }, "verdict": { "type": "string", "description": "block: do not install; warn: install only after reading the reasons; ok: no advisory affects this version and its cycle is not past end of life", "enum": [ "ok", "warn", "block" ] }, "reasons": { "type": "array", "items": { "type": "object", "properties": { "code": { "type": "string", "description": "block: malicious (malicious-package advisory), known_exploited (a CVE alias is in CISA KEV), critical_vuln (CRITICAL advisory); warn: vuln (other advisory affecting the version), vuln_version_unknown (affected versions cannot be read), eol (the cycle is past end of life)", "enum": [ "malicious", "known_exploited", "critical_vuln", "vuln", "vuln_version_unknown", "eol" ] }, "verdict": { "type": "string", "description": "The verdict this reason gives", "enum": [ "warn", "block" ] }, "id": { "type": "string", "description": "OSV advisory id" }, "aliases": { "type": "array", "items": { "type": "string" }, "description": "Other ids of the advisory (CVE, GHSA)" }, "summary": { "type": [ "string", "null" ], "description": "Advisory title" }, "severity": { "type": [ "string", "null" ], "description": "Severity label from the advisory database (CRITICAL, HIGH, MODERATE, LOW), or null" }, "kev_cves": { "type": "array", "items": { "type": "string" }, "description": "CVE aliases in CISA KEV (known_exploited only)" }, "fixed": { "type": "array", "items": { "type": "string" }, "description": "Versions that fix the advisory" }, "product": { "type": "string", "description": "endoflife.date product (eol only)" }, "cycle": { "type": "string", "description": "Release cycle the version belongs to (eol only)" }, "eol": { "type": [ "string", "boolean", "null" ], "description": "End-of-life date of the cycle (eol only)" } }, "required": [ "code", "verdict" ] }, "description": "Why, strongest first; empty when ok" }, "kev_catalog_version": { "type": [ "string", "null" ], "description": "CISA KEV catalog version checked against" } }, "required": [ "package", "verdict", "reasons", "kev_catalog_version" ] }, "meta": { "$ref": "#/components/schemas/preflight_meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "package": { "purl": "pkg:npm/lodash@4.17.20", "ecosystem": "npm", "name": "lodash", "version": "4.17.20" }, "verdict": "warn", "reasons": [ { "code": "vuln", "verdict": "warn", "id": "GHSA-35jh-r3h4-6jhm", "aliases": [ "CVE-2021-23337" ], "summary": "Command Injection in lodash", "severity": "HIGH", "fixed": [ "4.17.21" ] } ], "kev_catalog_version": "2026.10.10" }, "meta": { "dataset": "preflight", "datasets": { "osv": { "dataset": "osv", "snapshot_id": "osv-2026-10-09T06:00:00.000Z", "as_of": "2026-10-09T06:00:00.000Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "age_hours": 1, "cadence_hours": 6, "stale_at": "2026-10-09T18:00:00.001Z", "stale": false, "source": "https://osv.dev/", "attribution": "Vulnerability data from OSV.dev and the upstream databases listed, under their licences; joined and reformatted by Stack Facts (records are modified: fields trimmed and reshaped).", "licence_url": "/licences", "ecosystems": { "npm": { "imported_at": "2026-10-09T06:00:00.000Z", "checked_at": "2026-10-09T06:00:00.000Z", "records": 5, "sha256": "18381a44c0ac8924b4de17ccb980bb385ae3015a788e0f40b57e4feb0bcd2f64" } }, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "kev": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "67rqguwNMKyxuF_Y6jf8kVcnYzlsrMEPoeb9YjElJFA4alwIuYpkNBV-WUGGVsSZZW4fa0-eV85NorA6ooKUCw", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "eol": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "pBDE3WePUcxZVS6_mV30Hjky4sT0Zvdp8uayFdfDpg6vYb4ogv3NKLto2DAt3o1IE03BZ5p4TZRexDUPbZnlDw", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } }, "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.008 USD (8000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/stack/watch": { "post": { "operationId": "stackfacts_stack_watch", "summary": "Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.", "description": "Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.", "tags": [ "stack", "paid" ], "x-tool-name": "stackfacts_stack_watch", "x-keywords": [ "watch my stack for end-of-life and new exploited CVEs", "Use when you need to know what changed in a stack since your last check", "stack monitor", "dependency monitor", "what changed since my last check", "alert when a version reaches end of life", "new vulnerabilities in my packages" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "description": "Send either the stack (items, cves, packages, warn_days: starts a watch) or a token from the last answer (token, full: a re-check), not both", "properties": { "items": { "type": "array", "minItems": 0, "maxItems": 50, "description": "The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent", "items": { "anyOf": [ { "type": "string", "description": "product@version, e.g. nodejs@18.19.0 (GET /v1/eol/index lists products)", "pattern": "^[^@]+@.+$", "minLength": 3, "maxLength": 401 }, { "type": "object", "properties": { "product": { "type": "string", "description": "endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)", "minLength": 1, "maxLength": 200 }, "version": { "type": "string", "description": "Version string, e.g. 18.19.0 (send \"3.10\" as a string, not a number)", "minLength": 1, "maxLength": 200 } }, "required": [ "product", "version" ], "additionalProperties": false } ] } }, "cves": { "type": "array", "minItems": 0, "maxItems": 100, "items": { "type": "string", "description": "CVE id, e.g. CVE-2021-44228", "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$", "maxLength": 32 }, "description": "Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only" }, "packages": { "type": "array", "minItems": 0, "maxItems": 50, "description": "Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)", "items": { "type": "string", "description": "purl with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1", "pattern": "^pkg:", "minLength": 7, "maxLength": 512 } }, "warn_days": { "type": "integer", "minimum": 0, "maximum": 365, "description": "Start only: report an item as due soon when its EOL date is this many days away or fewer (default 90, 0 = off). Kept in the token" }, "token": { "type": "string", "description": "Re-check only: data.watch.token from your last answer. Nothing else with it but full. It holds your stack in readable form; keep it as you would the stack", "pattern": "^sfw1\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{43}$", "maxLength": 48000 }, "full": { "type": "boolean", "description": "Re-check only: also return data.check, the full current stack answer, at the same price (default false)" } }, "required": [], "additionalProperties": false }, "example": { "items": [ "nodejs@18.19.0" ], "cves": [ "CVE-2021-44228" ], "warn_days": 90 } } } }, "parameters": [ { "name": "PAYMENT-SIGNATURE", "in": "header", "required": false, "description": "x402 v2 payment payload (base64 JSON) for the accepts entry of the PAYMENT-REQUIRED header; without it (or X-PAYMENT) the route answers 402", "schema": { "type": "string" } }, { "name": "X-PAYMENT", "in": "header", "required": false, "description": "x402 v1 payment payload (base64 JSON) for the accepts entry of the 402 body; the answer carries X-PAYMENT-RESPONSE", "schema": { "type": "string" } } ], "x-payment-info": { "protocols": [ "x402" ], "price": { "mode": "fixed", "currency": "USD", "amount": "0.012" }, "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0x82527eDB6C86F7fBFAdCEA3Fc5F927cf74f34774" }, "responses": { "200": { "description": "The answer, with meta (as_of, retrieved_at, stale, snapshot_id, licence)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "watch": { "type": "object", "properties": { "kind": { "enum": [ "start", "recheck" ], "description": "start: the first call (data.check holds the full answer); recheck: a token was sent (data.changes holds what changed)" }, "token": { "type": "string", "description": "Send this as {\"token\": ...} next time; it replaces the one you sent. Readable, not encrypted; valid until expires_at" }, "since": { "type": "string", "description": "Re-check only: when the token you sent was made", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" }, "checked_at": { "type": "string", "description": "When this answer was made (the new baseline)", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" }, "expires_at": { "type": "string", "description": "The new token is refused (410 token_expired) after this, 180 days on", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" }, "warn_days": { "type": "integer", "minimum": 0, "maximum": 365 }, "stack": { "type": "object", "description": "The stack inside the token, normalised: product@version strings, CVE ids in upper case, purls as parsed. Send it to start again", "properties": { "items": { "type": "array", "items": { "type": "string" } }, "cves": { "type": "array", "items": { "type": "string" } }, "packages": { "type": "array", "items": { "type": "string" } } }, "required": [ "items", "cves", "packages" ] }, "datasets_updated": { "type": "array", "items": { "enum": [ "eol", "kev", "osv" ] }, "description": "Re-check only: the datasets refreshed since the token was made" }, "suggested_recheck_at": { "type": "string", "description": "The next scheduled refresh of a dataset this stack uses (a hint; KEV 4 h, OSV 6 h, EOL 24 h)", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" }, "next": { "type": "string" } }, "required": [ "kind", "token", "checked_at", "expires_at", "warn_days", "stack" ] }, "check": { "type": "object", "description": "Start, or a re-check with full: the data POST /v1/stack/check gives for the stack (stackfacts_stack_check)" }, "changed": { "type": "boolean", "description": "Re-check only: whether anything changed" }, "change_count": { "type": "integer", "minimum": 0 }, "worst": { "anyOf": [ { "enum": [ "high", "medium", "low" ] }, { "type": "null" } ], "description": "Re-check only: the highest severity of any change, null for none" }, "changes": { "type": "array", "items": { "$ref": "#/components/schemas/watch_change" }, "description": "Re-check only: sorted by severity, then eol, kev, osv, then position in the stack" }, "summary": { "type": "object", "description": "Re-check only: the current /v1/stack/check summary" } }, "required": [ "watch" ] }, "meta": { "$ref": "#/components/schemas/stack_meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "watch": { "kind": "start", "token": "sfw1.eyJleHAiOiIyMDI3LTA0LTA3VDA3OjAwOjAwLjAwMFoiLCJpYXQiOiIyMDI2LTEwLTA5VDA3OjAwOjAwLjAwMFoiLCJzZWVuIjp7ImVvbCI6W3siYyI6IjE4IiwiZCI6ZmFsc2UsImUiOiIyMDI1LTA0LTMwIiwiZiI6dHJ1ZSwicyI6ImVvbCJ9XSwia2V2IjpbIkNWRS0yMDIxLTQ0MjI4Il0sIm9zdiI6W119LCJzbmFwIjp7ImVvbCI6ImVvbC0yMDI2MTAwOVQwNjAwMDBaLWQ2MTk3MGQ2Iiwia2V2Ijoia2V2LTIwMjYxMDA5VDA2MDAwMFotZjQ1ODZjYzUiLCJvc3YiOm51bGx9LCJzdGFjayI6eyJjdmVzIjpbIkNWRS0yMDIxLTQ0MjI4Il0sIml0ZW1zIjpbWyJub2RlanMiLCIxOC4xOS4wIl1dLCJwYWNrYWdlcyI6W119LCJ2IjoxLCJ3YXJuX2RheXMiOjkwfQ.4N2Rycs29lHafmTmjyUrsaPTvnSvl6SkaVV8t3FoGd0", "checked_at": "2026-10-09T07:00:00.000Z", "expires_at": "2027-04-07T07:00:00.000Z", "warn_days": 90, "stack": { "items": [ "nodejs@18.19.0" ], "cves": [ "CVE-2021-44228" ], "packages": [] }, "suggested_recheck_at": "2026-10-09T10:00:00.000Z", "next": "POST /v1/stack/watch {\"token\":\"\"} returns only what changed ($0.012)" }, "check": { "summary": { "items": 1, "matched": 1, "unknown": 0, "by_status": { "supported": 0, "security-only": 0, "eol": 1, "unknown": 0 }, "cves": 1, "in_kev": 1 }, "eol": { "count": 1, "matched": 1, "unknown_count": 0, "results": [ { "index": 0, "product": "nodejs", "version": "18.19.0", "found": true, "resolved": "nodejs", "label": "Node.js", "match": { "cycle": "18", "eol": "2025-04-30", "latest": "18.20.8", "latest_date": "2025-03-27", "link": "https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.20.8", "lts": "2022-10-25", "release_date": "2022-04-19", "support_until": "2023-10-18", "status": "eol", "days_until_eol": -527, "is_lts": true } } ], "unknown": [] }, "kev": { "count": 1, "in_kev": 1, "catalog_version": "2026.10.10", "results": [ { "cve": "CVE-2021-44228", "in_kev": true, "vendor": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "date_added": "2021-12-10", "due_date": "2021-12-24", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "known_ransomware": true, "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ] } ] } } }, "meta": { "dataset": "stack", "datasets": { "eol": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "HZa2ZQYvoVydMgALXWhElZo5pGC2cSVCSQAbSsw_sPIbVMTzlaYwtox3x-eNGOqRpX3l4fXQBjea6Yh7reN6CA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." }, "kev": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "HbxWSMcHi65db2FpbS55iqUePmJ0l9jQMyBe9Eqkkr0BCM-u1ILMjOGJpCDCeZEjF7i3rp-LUYR3aUqEQddsAw", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } }, "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } }, "headers": { "PAYMENT-RESPONSE": { "description": "Base64 JSON settle result (transaction, network, payer)", "schema": { "type": "string" } }, "X-PAYMENT-RESPONSE": { "description": "The same for an X-PAYMENT (x402 v1) payment", "schema": { "type": "string" } } } }, "402": { "description": "Payment required: 0.012 USD (12000 atomic USDC) via x402 exact on Base. The body is the x402 v1 offer (pay with X-PAYMENT); the PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON; pay with PAYMENT-SIGNATURE)", "headers": { "PAYMENT-REQUIRED": { "description": "Base64 of the x402 v2 PaymentRequired JSON", "schema": { "type": "string" } } }, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PaymentRequired" }, { "$ref": "#/components/schemas/Error" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/preview": { "get": { "operationId": "stackfacts_preview_eol", "summary": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "description": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "tags": [ "eol", "free" ], "x-tool-name": "stackfacts_preview", "x-keywords": [ "free sample", "end-of-life dates", "CISA KEV", "price per million tokens" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "next": { "type": "string", "description": "The paid route that answers in full" } }, "required": [ "next" ], "description": "eol: products[]; kev: rows[] and catalog_version; models: models[]" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/preview": { "get": { "operationId": "stackfacts_preview_kev", "summary": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "description": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "tags": [ "kev", "free" ], "x-tool-name": "stackfacts_preview", "x-keywords": [ "free sample", "end-of-life dates", "CISA KEV", "price per million tokens" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "next": { "type": "string", "description": "The paid route that answers in full" } }, "required": [ "next" ], "description": "eol: products[]; kev: rows[] and catalog_version; models: models[]" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/preview": { "get": { "operationId": "stackfacts_preview_models", "summary": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "description": "Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.", "tags": [ "models", "free" ], "x-tool-name": "stackfacts_preview", "x-keywords": [ "free sample", "end-of-life dates", "CISA KEV", "price per million tokens" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "next": { "type": "string", "description": "The paid route that answers in full" } }, "required": [ "next" ], "description": "eol: products[]; kev: rows[] and catalog_version; models: models[]" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "models": [ { "id": "openai/gpt-5", "name": "GPT-5", "input_usd_per_mtok": 1.25, "output_usd_per_mtok": 10, "cache_read_usd_per_mtok": 0.125, "context_tokens": 400000, "deprecated": false }, { "id": "openai/gpt-4o", "name": "GPT-4o", "input_usd_per_mtok": 2, "output_usd_per_mtok": 10, "cache_read_usd_per_mtok": 1.25, "context_tokens": 128000, "deprecated": false } ], "next": "GET /v1/models/{provider}/{model} returns every price, limit, capability and deprecation field (paid); GET /v1/try/models shows that shape for openai/gpt-4o (free)" }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/try/eol": { "get": { "operationId": "stackfacts_try_eol", "summary": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "description": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "tags": [ "eol", "free" ], "x-tool-name": "stackfacts_try", "x-keywords": [ "free example", "try before paying", "check if a CVE is actively exploited (CISA KEV)" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "description": "Same shape as stackfacts_eol_product, stackfacts_kev_lookup or stackfacts_models_lookup" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/try/kev": { "get": { "operationId": "stackfacts_try_kev", "summary": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "description": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "tags": [ "kev", "free" ], "x-tool-name": "stackfacts_try", "x-keywords": [ "free example", "try before paying", "check if a CVE is actively exploited (CISA KEV)" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "description": "Same shape as stackfacts_eol_product, stackfacts_kev_lookup or stackfacts_models_lookup" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "cve": "CVE-2021-44228", "in_kev": true, "vendor": "Apache", "product": "Log4j2", "name": "Apache Log4j2 Remote Code Execution Vulnerability", "date_added": "2021-12-10", "due_date": "2021-12-24", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "known_ransomware": true, "notes_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ], "catalog_version": "2026.10.10" }, "meta": { "dataset": "kev", "snapshot_id": "kev-20261009T060000Z-f4586cc5", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "licence": "CC0-1.0", "attribution": "Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.", "sha256": "f4586cc54bee30640f4364100eb70b7f25e4927f1d41d1ae92c0fea298508e74", "signature": "Tne7KlsSRbohZK45rjItkYBKFOd8sEdJNcaYd7c6TSr7AfZsT996F8pd-fqDeB67MijhEWw6aCgiuZl5TYk5AA", "key_id": "sf-test-1", "manifest_url": "/v1/kev/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/try/models": { "get": { "operationId": "stackfacts_try_models", "summary": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "description": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "tags": [ "models", "free" ], "x-tool-name": "stackfacts_try", "x-keywords": [ "free example", "try before paying", "check if a CVE is actively exploited (CISA KEV)" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "description": "Same shape as stackfacts_eol_product, stackfacts_kev_lookup or stackfacts_models_lookup" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/index": { "get": { "operationId": "stackfacts_index_eol", "summary": "List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.", "description": "List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.", "tags": [ "eol", "free" ], "x-tool-name": "stackfacts_index", "x-keywords": [ "product list", "model list", "valid ids", "aliases" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "products": { "type": "array", "items": { "type": "object", "properties": { "product": { "type": "string", "description": "Product id" }, "label": { "type": "string", "description": "Display name" } }, "required": [ "product", "label" ] } }, "aliases": { "type": "object", "description": "alias -> product id" }, "providers": { "type": "array", "items": { "type": "string" } }, "models": { "type": "array", "items": { "type": "string" } } }, "required": [ "count" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/index": { "get": { "operationId": "stackfacts_index_models", "summary": "List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.", "description": "List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.", "tags": [ "models", "free" ], "x-tool-name": "stackfacts_index", "x-keywords": [ "product list", "model list", "valid ids", "aliases" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "products": { "type": "array", "items": { "type": "object", "properties": { "product": { "type": "string", "description": "Product id" }, "label": { "type": "string", "description": "Display name" } }, "required": [ "product", "label" ] } }, "aliases": { "type": "object", "description": "alias -> product id" }, "providers": { "type": "array", "items": { "type": "string" } }, "models": { "type": "array", "items": { "type": "string" } } }, "required": [ "count" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "count": 36, "providers": [ "anthropic", "cerebras", "cohere", "deepseek", "google", "groq", "mistral", "moonshotai", "openai", "xai" ], "models": [ "anthropic/claude-haiku-4-5", "openai/gpt-4o" ] }, "meta": { "dataset": "models", "snapshot_id": "models-20261009T060000Z-f99d55c9", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json", "licence": "MIT", "attribution": "Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages. Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.", "sha256": "f99d55c9aa420561de698d63d70d9163afe8e0571c9c1fb8d4b5dae33423351a", "signature": "AvlI5FXM8fD9oncZAr9velQseOBO9X7KTRSgeKGrdFtJwHrmWJhWAqGQ__I5kLf90y307OHgPecfzO7ALf1_DQ", "key_id": "sf-test-1", "manifest_url": "/v1/models/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/validate": { "get": { "operationId": "stackfacts_validate", "summary": "Validate an id for free before paying: whether a product, product/cycle or provider/model exists, or a CVE id is well formed.", "description": "Validate an id for free before paying: whether a product, product/cycle or provider/model exists, or a CVE id is well formed.", "tags": [ "service", "free" ], "x-tool-name": "stackfacts_validate", "x-keywords": [ "validate id", "check before paying", "product exists" ], "parameters": [ { "name": "dataset", "in": "query", "required": true, "description": "Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)", "schema": { "type": "string", "enum": [ "eol", "kev", "models" ] }, "example": "eol" }, { "name": "id", "in": "query", "required": true, "description": "Id to check: nodejs, nodejs/22, CVE-2021-44228 or openai/gpt-4o", "schema": { "type": "string", "minLength": 1, "maxLength": 200 }, "example": "nodejs" } ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "dataset": { "type": "string", "description": "Dataset" }, "id": { "type": "string", "description": "As sent" }, "valid": { "type": "boolean" }, "resolved": { "type": [ "string", "null" ], "description": "Canonical id" }, "checked": { "type": "string", "description": "exists, or syntax for kev (membership is the paid answer)", "enum": [ "exists", "syntax" ] } }, "required": [ "dataset", "id", "valid", "checked" ] }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "dataset": "eol", "id": "nodejs", "valid": true, "resolved": "nodejs", "checked": "exists" }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/eol/manifest": { "get": { "operationId": "stackfacts_manifest_eol", "summary": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "description": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "tags": [ "eol", "free" ], "x-tool-name": "stackfacts_manifest", "x-keywords": [ "signed manifest", "snapshot_id", "data freshness", "provenance" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/manifest" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] }, "example": { "data": { "dataset": "eol", "version": 1, "snapshot_id": "eol-20261009T060000Z-d61970d6", "fetched_at": "2026-10-09T06:00:00Z", "source_url": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "upstream_etag": null, "record_count": 16, "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "prev_snapshot_id": null, "key_id": "sf-test-1", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA" }, "meta": { "dataset": "eol", "snapshot_id": "eol-20261009T060000Z-d61970d6", "as_of": "2026-10-09T06:00:00Z", "retrieved_at": "2026-10-09T06:00:00.000Z", "source": "https://endoflife.date", "licence": "MIT", "attribution": "Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.", "sha256": "d61970d601c71df4855979790737437ee743889c55474b5406ef99be9d4de2ef", "signature": "8vBLWTyZaLEaHiY2z9B6rRGXZeZgvVHVHasvD89lLxOUHFbJXgX4aT5Aau38spDDXMwkoSl7rn7o-hAqemqmBA", "key_id": "sf-test-1", "manifest_url": "/v1/eol/manifest", "stale": false, "notice": "Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source." } } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/kev/manifest": { "get": { "operationId": "stackfacts_manifest_kev", "summary": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "description": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "tags": [ "kev", "free" ], "x-tool-name": "stackfacts_manifest", "x-keywords": [ "signed manifest", "snapshot_id", "data freshness", "provenance" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/manifest" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/models/manifest": { "get": { "operationId": "stackfacts_manifest_models", "summary": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "description": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "tags": [ "models", "free" ], "x-tool-name": "stackfacts_manifest", "x-keywords": [ "signed manifest", "snapshot_id", "data freshness", "provenance" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/manifest" }, "meta": { "$ref": "#/components/schemas/meta" } }, "required": [ "data", "meta" ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/v1/keys": { "get": { "operationId": "stackfacts_keys", "summary": "Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.", "description": "Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.", "tags": [ "service", "free" ], "x-tool-name": "stackfacts_keys", "x-keywords": [ "public key", "verify signature", "JWKS", "Ed25519" ], "responses": { "200": { "description": "The answer (free)", "content": { "application/json": { "schema": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "kty": { "type": "string", "description": "OKP", "const": "OKP" }, "crv": { "type": "string", "description": "Ed25519", "const": "Ed25519" }, "alg": { "type": "string", "description": "EdDSA" }, "use": { "type": "string", "description": "sig" }, "kid": { "type": "string", "description": "Matches meta.key_id" }, "x": { "type": "string", "description": "Public key (base64url)" } }, "required": [ "kty", "crv", "kid", "x" ] } } }, "required": [ "keys" ] }, "example": { "keys": [ { "kty": "OKP", "crv": "Ed25519", "alg": "EdDSA", "use": "sig", "kid": "sf-test-1", "x": "dVm4zPfjsbjc4NUFEW_nssyz8u_IN9Vy5frOhJyWoOY" } ] } } } }, "default": { "$ref": "#/components/responses/Error" } } } }, "/health": { "get": { "operationId": "health", "summary": "Get the service status: ok, version, dataset freshness and payments held for review. Free, not a tool.", "description": "Get the service status: ok, version, dataset freshness and payments held for review. Free, not a tool.", "tags": [ "service", "free" ], "responses": { "200": { "description": "ok" }, "default": { "$ref": "#/components/responses/Error" } } } }, "/licences": { "get": { "operationId": "licences", "summary": "Get the licence, attribution and source of every dataset as HTML, Markdown or JSON. Free, not a tool.", "description": "Get the licence, attribution and source of every dataset as HTML, Markdown or JSON. Free, not a tool.", "tags": [ "service", "free" ], "responses": { "200": { "description": "ok" }, "default": { "$ref": "#/components/responses/Error" } } } } }, "components": { "schemas": { "meta": { "type": "object", "properties": { "dataset": { "type": "string", "description": "eol, kev or models", "enum": [ "eol", "kev", "models" ] }, "snapshot_id": { "type": "string", "description": "Id of the signed snapshot this answer was read from; pass it as since to the change feeds" }, "as_of": { "type": "string", "description": "When the source was fetched (ISO 8601 UTC)" }, "retrieved_at": { "type": "string", "description": "When this snapshot was published (ISO 8601 UTC)" }, "source": { "type": "string", "description": "Upstream source URL" }, "licence": { "type": "string", "description": "SPDX id of the upstream licence" }, "attribution": { "type": "string", "description": "Attribution text to keep with the data" }, "sha256": { "type": "string", "description": "sha256 of the canonical snapshot (RFC 8785)", "pattern": "^[0-9a-f]{64}$" }, "signature": { "type": "string", "description": "Ed25519 signature (base64url) of the snapshot manifest" }, "key_id": { "type": "string", "description": "kid of the public key in GET /v1/keys that verifies signature" }, "manifest_url": { "type": "string", "description": "Free route with the signed manifest" }, "stale": { "type": "boolean", "description": "True when the snapshot is older than the freshness limit" }, "notice": { "type": "string", "description": "Modified-from-source and no-warranty notice" } }, "required": [ "dataset", "snapshot_id", "as_of", "retrieved_at", "source", "licence", "attribution", "sha256", "signature", "key_id", "manifest_url", "stale", "notice" ] }, "eol_cycle": { "type": "object", "properties": { "cycle": { "type": "string", "description": "Release cycle, e.g. 22 or 3.12" }, "eol": { "type": [ "string", "boolean", "null" ], "description": "End-of-life date (YYYY-MM-DD), true = end of life (date unknown), false = not end of life" }, "latest": { "type": [ "string", "null" ], "description": "Latest version in this cycle" }, "latest_date": { "type": [ "string", "null" ], "description": "Release date of latest" }, "link": { "type": [ "string", "null" ], "description": "Release notes URL" }, "lts": { "type": [ "string", "boolean", "null" ], "description": "LTS from this date, or true/false; null = unknown" }, "release_date": { "type": [ "string", "null" ], "description": "First release of the cycle" }, "support_until": { "type": [ "string", "boolean", "null" ], "description": "End of active support (date or boolean); null = unknown" }, "status": { "type": "string", "description": "Support status today", "enum": [ "supported", "security-only", "eol", "unknown" ] }, "days_until_eol": { "type": [ "integer", "null" ], "description": "Days until the EOL date (negative = already end of life); null when there is no date" }, "is_lts": { "type": "boolean", "description": "True when the cycle is LTS today" } }, "required": [ "cycle", "eol", "status", "days_until_eol", "is_lts" ] }, "kev_entry": { "type": "object", "properties": { "cve": { "type": "string", "description": "CVE id" }, "in_kev": { "type": "boolean", "const": true }, "vendor": { "type": "string", "description": "Vendor or project" }, "product": { "type": "string", "description": "Product" }, "name": { "type": "string", "description": "Vulnerability name as CISA lists it" }, "date_added": { "type": "string", "description": "Date added to KEV (YYYY-MM-DD)" }, "due_date": { "type": "string", "description": "Remediation due date for US federal agencies (YYYY-MM-DD)" }, "required_action": { "type": "string", "description": "Action CISA requires" }, "known_ransomware": { "type": "boolean", "description": "Known use in ransomware campaigns" }, "notes_urls": { "type": "array", "items": { "type": "string" }, "description": "Advisory and reference URLs" } }, "required": [ "cve", "in_kev", "vendor", "product", "name", "date_added", "due_date", "required_action", "known_ransomware", "notes_urls" ] }, "kev_result": { "type": "object", "description": "A KEV entry, or {cve, in_kev:false} when the CVE is not in KEV", "properties": { "cve": { "type": "string", "description": "CVE id" }, "in_kev": { "type": "boolean" } }, "required": [ "cve", "in_kev" ] }, "model": { "type": "object", "properties": { "id": { "type": "string", "description": "provider/model" }, "provider": { "type": "string", "description": "Provider, e.g. openai" }, "model": { "type": "string", "description": "Model id at the provider" }, "name": { "type": [ "string", "null" ], "description": "Display name" }, "mode": { "type": [ "string", "null" ], "description": "chat, responses or completion" }, "input_usd_per_mtok": { "type": [ "number", "null" ], "description": "Input price, USD per million tokens" }, "output_usd_per_mtok": { "type": [ "number", "null" ], "description": "Output price, USD per million tokens" }, "cache_read_usd_per_mtok": { "type": [ "number", "null" ], "description": "Cached input price, USD per million tokens" }, "cache_write_usd_per_mtok": { "type": [ "number", "null" ], "description": "Cache write price, USD per million tokens" }, "context_tokens": { "type": [ "integer", "null" ], "description": "Context window in tokens" }, "max_output_tokens": { "type": [ "integer", "null" ], "description": "Max output tokens" }, "input_modalities": { "type": "array", "items": { "type": "string" }, "description": "e.g. text, image, pdf" }, "output_modalities": { "type": "array", "items": { "type": "string" } }, "tool_call": { "type": [ "boolean", "null" ], "description": "Supports tool calling" }, "vision": { "type": [ "boolean", "null" ], "description": "Accepts image input" }, "reasoning": { "type": [ "boolean", "null" ], "description": "Reasoning model" }, "knowledge_cutoff": { "type": [ "string", "null" ], "description": "Training data cutoff" }, "release_date": { "type": [ "string", "null" ], "description": "Release date" }, "deprecation_date": { "type": [ "string", "null" ], "description": "Deprecation date (YYYY-MM-DD) when announced" }, "status": { "type": [ "string", "null" ], "description": "Upstream status, e.g. deprecated or beta" }, "aliases": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "object", "properties": { "litellm": { "type": "boolean" }, "modelsdev": { "type": "boolean" } }, "required": [ "litellm", "modelsdev" ] }, "sources_disagree": { "type": "array", "items": { "type": "string" }, "description": "Fields where LiteLLM and models.dev differ by more than 1 %" }, "deprecated": { "type": "boolean", "description": "Deprecated today" }, "days_until_deprecation": { "type": [ "integer", "null" ], "description": "Days until deprecation_date (negative = past)" } }, "required": [ "id", "provider", "model", "input_usd_per_mtok", "output_usd_per_mtok", "context_tokens", "deprecation_date", "deprecated", "sources", "sources_disagree" ] }, "manifest": { "type": "object", "properties": { "dataset": { "type": "string", "description": "eol, kev or models" }, "version": { "type": "integer" }, "snapshot_id": { "type": "string", "description": "Snapshot id" }, "fetched_at": { "type": "string", "description": "When the source was fetched (ISO 8601 UTC)" }, "source_url": { "type": "string", "description": "Upstream source URL" }, "licence": { "type": "string", "description": "SPDX id" }, "attribution": { "type": "string", "description": "Attribution text" }, "upstream_etag": { "type": [ "string", "object", "null" ] }, "record_count": { "type": "integer", "minimum": 0 }, "sha256": { "type": "string", "description": "sha256 of the canonical JSON (RFC 8785) of the snapshot", "pattern": "^[0-9a-f]{64}$" }, "prev_snapshot_id": { "type": [ "string", "null" ], "description": "The snapshot before this one" }, "key_id": { "type": "string", "description": "kid of the verifying key in GET /v1/keys" }, "upstream_meta": { "type": "object", "description": "Upstream version and counts (signed, not hashed)" }, "signature": { "type": "string", "description": "Ed25519 signature (base64url) over the canonical JSON of the manifest without signature" } }, "required": [ "dataset", "version", "snapshot_id", "fetched_at", "record_count", "sha256", "prev_snapshot_id", "key_id", "signature" ] }, "snapshot": { "type": "object", "properties": { "manifest": { "$ref": "#/components/schemas/manifest" }, "snapshot": { "type": "object", "properties": { "dataset": { "type": "string", "description": "Dataset" }, "version": { "type": "integer" }, "records": { "type": "array", "items": { "type": "object" } } }, "required": [ "dataset", "version", "records" ] }, "licence": { "type": "object", "properties": { "spdx": { "type": "string", "description": "SPDX id(s), joined with AND" }, "attribution": { "type": "string", "description": "Attribution" }, "source": { "type": "string", "description": "Licence source(s)" }, "text": { "type": "string", "description": "Full licence text(s)" }, "sources": { "type": "array", "items": { "type": "string" }, "description": "Names of the upstream sources" } }, "required": [ "spdx", "attribution", "source", "text", "sources" ] }, "verify": { "type": "string", "description": "How to verify the download" } }, "required": [ "manifest", "snapshot", "licence", "verify" ] }, "stack_meta": { "type": "object", "description": "meta of an answer read from more than one dataset: each snapshot's own meta, keyed by dataset", "properties": { "dataset": { "type": "string", "description": "stack: the answer combines the datasets below", "const": "stack" }, "datasets": { "type": "object", "properties": { "eol": { "$ref": "#/components/schemas/meta" }, "kev": { "$ref": "#/components/schemas/meta" }, "osv": { "$ref": "#/components/schemas/osv_import" } }, "required": [ "eol", "kev" ], "additionalProperties": false, "description": "eol and kev always; osv only when packages were sent" }, "stale": { "type": "boolean", "description": "True when any of the snapshots is older than its freshness limit" }, "notice": { "type": "string", "description": "Modified-from-source and no-warranty notice" } }, "required": [ "dataset", "datasets", "stale", "notice" ] }, "osv_import": { "type": "object", "properties": { "dataset": { "type": "string", "const": "osv" }, "snapshot_id": { "type": "string", "description": "Id of the OSV index import this answer was read from" }, "as_of": { "type": "string", "description": "When the OSV index was imported (ISO 8601 UTC)" }, "source": { "type": "string", "description": "Upstream source URL" }, "attribution": { "type": "string", "description": "Attribution text to keep with the data" }, "licence_url": { "type": "string", "description": "Free route with the licence of every upstream database" }, "ecosystems": { "type": "object", "description": "Per ecosystem asked about: imported_at, checked_at, records, sha256 of the index file" }, "notice": { "type": "string", "description": "Modified-from-source and no-warranty notice" } }, "required": [ "dataset", "snapshot_id", "as_of", "source", "attribution", "licence_url", "ecosystems", "notice" ], "description": "The OSV index import (not signed: check sha256 per ecosystem)" }, "osv_meta": { "type": "object", "description": "meta of an OSV answer: the OSV index import and the KEV snapshot the CVE aliases were checked against", "properties": { "dataset": { "type": "string", "description": "osv: the answer combines the datasets below", "const": "osv" }, "datasets": { "type": "object", "properties": { "osv": { "$ref": "#/components/schemas/osv_import" }, "kev": { "$ref": "#/components/schemas/meta" } }, "required": [ "osv", "kev" ], "additionalProperties": false }, "stale": { "type": "boolean", "description": "True when the KEV snapshot is older than its freshness limit" }, "notice": { "type": "string", "description": "Modified-from-source and no-warranty notice" } }, "required": [ "dataset", "datasets", "stale", "notice" ] }, "osv_data": { "type": "object", "properties": { "count": { "type": "integer", "minimum": 0 }, "summary": { "type": "object", "properties": { "packages": { "type": "integer", "minimum": 0, "description": "Purls sent" }, "affected": { "type": "integer", "minimum": 0, "description": "Purls with at least one affecting advisory" }, "versions_unknown": { "type": "integer", "minimum": 0, "description": "Purls named by advisories whose versions cannot be checked (never counted as affected)" }, "no_known_advisories": { "type": "integer", "minimum": 0 }, "unanswered": { "type": "integer", "minimum": 0, "description": "Purls of a type or ecosystem not available" }, "advisories": { "type": "integer", "minimum": 0, "description": "Advisories returned" }, "malicious": { "type": "integer", "minimum": 0, "description": "Purls with a malicious-package report" }, "in_kev": { "type": "integer", "minimum": 0, "description": "Purls with an advisory whose CVE is in CISA KEV" } }, "required": [ "packages", "affected", "versions_unknown", "no_known_advisories", "unanswered", "advisories", "malicious", "in_kev" ] }, "kev_catalog_version": { "type": [ "string", "null" ], "description": "CISA catalogVersion" }, "results": { "type": "array", "items": { "type": "object", "properties": { "purl": { "type": "string", "description": "As sent" }, "ecosystem": { "type": [ "string", "null" ], "description": "OSV ecosystem, null for an unsupported purl type" }, "name": { "type": "string", "description": "Package name as OSV writes it" }, "version": { "type": "string" }, "status": { "type": "string", "enum": [ "affected", "versions_unknown", "no_known_advisories", "unsupported_type", "ecosystem_unavailable" ] }, "malicious": { "type": "boolean" }, "kev": { "type": "boolean" }, "advisories": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "OSV id, e.g. GHSA-35jh-r3h4-6jhm" }, "kind": { "type": "string", "description": "vuln, or malicious for a malicious-package report", "enum": [ "vuln", "malicious" ] }, "aliases": { "type": "array", "items": { "type": "string" }, "description": "Other ids for the same issue (CVE, GHSA, RUSTSEC...)" }, "summary": { "type": [ "string", "null" ], "description": "One-line summary, when the advisory has one" }, "severity": { "type": "array", "items": { "type": "object" }, "description": "OSV severity scores, e.g. {type: CVSS_V3, score}" }, "severity_label": { "type": [ "string", "null" ], "description": "Database severity label, e.g. HIGH" }, "published": { "type": [ "string", "null" ], "description": "ISO 8601" }, "modified": { "type": [ "string", "null" ], "description": "ISO 8601" }, "match": { "type": "string", "description": "affected: the version is in an affected range or list; versions_unknown: the advisory names the package but its versions cannot be checked", "enum": [ "affected", "versions_unknown" ] }, "reason": { "type": "string", "description": "Why versions are unknown", "enum": [ "no_versions_listed", "version_not_comparable" ] }, "fixed": { "type": "array", "items": { "type": "string" }, "description": "Fixed versions named by the advisory for this package" }, "kev": { "type": "boolean", "description": "True when a CVE alias is in CISA KEV" }, "kev_cves": { "type": "array", "items": { "type": "string" }, "description": "The CVE aliases in CISA KEV" }, "sources": { "type": "array", "description": "The upstream database records to credit, with their licences", "items": { "type": "object", "properties": { "id": { "type": "string" }, "prefix": { "type": "string" }, "name": { "type": "string" }, "licence": { "type": "string", "description": "SPDX id" }, "licence_url": { "type": "string" }, "url": { "type": "string" } }, "required": [ "id", "prefix", "name", "licence", "url" ] } } }, "required": [ "id", "kind", "aliases", "match", "fixed", "kev", "kev_cves", "sources" ] } } }, "required": [ "purl", "ecosystem", "name", "version", "status", "malicious", "kev", "advisories" ] } } }, "required": [ "count", "summary", "kev_catalog_version", "results" ] }, "watch_change": { "type": "object", "description": "One change since the token was made", "properties": { "type": { "enum": [ "eol_passed", "security_only", "eol_due_soon", "eol_date_changed", "eol_status_changed", "item_matched", "item_unmatched", "kev_added", "kev_removed", "advisory_added", "advisory_kev", "advisory_removed", "package_status_changed" ] }, "severity": { "enum": [ "high", "medium", "low" ] }, "part": { "enum": [ "eol", "kev", "osv" ] }, "index": { "type": "integer", "minimum": 0, "description": "Position in stack.items (eol) or stack.packages (osv)" }, "subject": { "type": "string", "description": "product@version, CVE id or purl" }, "from": { "anyOf": [ { "type": "string" }, { "type": "boolean" }, { "type": "null" } ], "description": "The value at the token: a status, cycle, eol date or flag" }, "to": { "anyOf": [ { "type": "string" }, { "type": "boolean" }, { "type": "null" } ], "description": "The value now" }, "detail": { "type": "object", "description": "Current fields to act on: cycle, eol, days_until_eol, latest (eol); date_added, due_date, known_ransomware (kev); id, aliases, summary, severity_label, fixed, kev_cves (osv)" } }, "required": [ "type", "severity", "part", "subject", "from", "to", "detail" ] }, "preflight_meta": { "type": "object", "description": "meta of a preflight answer: the OSV index import, the KEV snapshot and the EOL snapshot it was judged from", "properties": { "dataset": { "type": "string", "description": "preflight: the answer combines the datasets below", "const": "preflight" }, "datasets": { "type": "object", "properties": { "osv": { "$ref": "#/components/schemas/osv_import" }, "kev": { "$ref": "#/components/schemas/meta" }, "eol": { "$ref": "#/components/schemas/meta" } }, "required": [ "osv", "kev", "eol" ], "additionalProperties": false }, "stale": { "type": "boolean", "description": "True when any of the datasets is older than its freshness limit" }, "notice": { "type": "string", "description": "Modified-from-source and no-warranty notice" } }, "required": [ "dataset", "datasets", "stale", "notice" ] }, "Error": { "type": "object", "properties": { "error": { "type": "object", "properties": { "code": { "type": "string", "enum": [ "payment_required", "payment_invalid", "payment_replayed", "payment_underpaid", "payment_expired", "payment_wrong_network", "payment_wrong_asset", "payment_wrong_payto", "payment_wrong_resource", "facilitator_unavailable", "settlement_unknown", "payment_in_progress", "rate_limited", "bad_request", "unknown_id", "too_many_items", "snapshot_expired", "paused", "stale_data", "payer_blocked", "l402_invalid", "internal", "dataset_unavailable", "payments_unconfigured", "payment_id_conflict", "no_match", "not_implemented", "token_invalid", "token_expired", "watch_unavailable", "not_found", "method_not_allowed", "body_too_large", "headers_too_large" ] }, "message": { "type": "string" }, "next": { "type": "string", "description": "What to do next" }, "docs": { "type": "string", "description": "Link to the error code on /docs/errors" } }, "required": [ "code", "message", "docs" ] } }, "required": [ "error" ] }, "PaymentRequired": { "type": "object", "description": "x402 v1 offer (pay with X-PAYMENT). The PAYMENT-REQUIRED header holds the x402 v2 offer (base64 JSON: network eip155:8453, amount, extensions); pay that with PAYMENT-SIGNATURE", "properties": { "x402Version": { "const": 1 }, "error": { "type": "string" }, "accepts": { "type": "array", "minItems": 1, "items": { "type": "object", "properties": { "scheme": { "const": "exact" }, "network": { "const": "base" }, "maxAmountRequired": { "type": "string", "description": "Atomic USDC units (6 decimals)" }, "resource": { "type": "string" }, "description": { "type": "string" }, "mimeType": { "type": "string" }, "payTo": { "type": "string" }, "maxTimeoutSeconds": { "type": "integer" }, "asset": { "const": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }, "outputSchema": { "type": "object" }, "extra": { "type": "object" } }, "required": [ "scheme", "network", "maxAmountRequired", "resource", "description", "mimeType", "payTo", "maxTimeoutSeconds", "asset" ] } } }, "required": [ "x402Version", "accepts" ] } }, "responses": { "Error": { "description": "Error (never charged)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }