Using the API

The audit API returns advisories matched to a conda-forge package version. The query endpoints follow the OSV API conventions.

• Base URL: https://api.basilisk.prefix.dev
• Authentication: none
• Format: JSON

Query one package

Send a conda package URL in the CEP 63 form to POST /v1/query. The channel is the PURL namespace:

curl -X POST "https://api.basilisk.prefix.dev/v1/query" \
  -H "Content-Type: application/json" \
  -d '{"package": {"purl": "pkg:conda/conda-forge/pillow@10.2.0"}}'

The response uses the OSV schema. If you leave the version out of the PURL, Basilisk returns advisories matched to any known version of the package.

Use POST /v1/querybatch to query several packages at once. Use GET /v1/vulns/{id} to fetch one advisory by ID.

Endpoint reference

The generated reference comes from the same OpenAPI document served by the API at /openapi.json. Each endpoint page includes a request form and examples for cURL, Python, JavaScript, Rust, Go, Java, and C#.

Reading the response

Matches come from advisory ranges and package identity mappings. Their metadata includes the source advisory, the identity used for matching, and the matcher version.

See Terminology for the applicability and confidence fields, or Traceability for the provenance model.