<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Supply Chain SBOM Enrichment — API Reference

## deps.dev API

```bash
# Get package version info
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express/versions/4.18.2"

# Get advisory info
curl -s "https://api.deps.dev/v3alpha/advisories/GHSA-xxxx-xxxx-xxxx"

# Get dependency graph
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express/versions/4.18.2:dependencies"
```

## EPSS API

```bash
# Get EPSS score for a CVE
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234"

# Batch query
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234,CVE-2024-5678"
```

## OpenSSF Scorecard API

```bash
# Get project scorecard
curl -s "https://api.securityscorecards.dev/projects/github.com/owner/repo"

# Check specific check
curl -s "https://api.securityscorecards.dev/projects/github.com/owner/repo" | jq '.checks[] | select(.name == "Vulnerabilities")'
```

