<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing Open Source Risk Scoring — API Reference

## OpenSSF Scorecard CLI

```bash
# Score a repository
scorecard --repo=github.com/owner/repo --format json

# Specific checks
scorecard --repo=github.com/owner/repo --checks=Vulnerabilities,Maintained --format json

# Use Scorecard API
curl -s "https://api.securityscorecards.dev/projects/github.com/owner/repo"
```

## deps.dev API

```bash
# Package info
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express"

# Version info
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express/versions/4.18.2"

# Advisory info
curl -s "https://api.deps.dev/v3alpha/advisories/GHSA-xxxx"
```

## GitHub API for Project Metrics

```bash
# Repository stats
gh api repos/owner/repo --jq '{stars: .stargazers_count, forks: .forks_count, issues: .open_issues_count}'

# Contributor count
gh api "repos/owner/repo/contributors?per_page=1" -i | grep -i 'link:' | grep -oP 'page=\K[0-9]+(?=>; rel="last")'

# Recent commits
gh api "repos/owner/repo/commits?since=$(date -d'-90 days' -Iseconds 2>/dev/null || date -v-90d +%Y-%m-%dT%H:%M:%SZ)&per_page=1" -i | grep -i 'link:'
```

