# apiacre.com Dependency Vulnerability Audit

> apiacre.com Dependency Vulnerability Audit is a paid API for AI agents from apiacre.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Scans exact dependency versions against the OSV vulnerability database and returns affected packages and security advisories.

## Facts

- Endpoint: POST https://apiacre.com/v1/developer/dependency-audit
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/apiacre-com-dependency-vulnerability-audit-2c4e69d3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ezGxJSgFwmx0y9JuUXEyP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability apiacre-com-dependency-vulnerability-audit-2c4e69d3 -d '<json body>'
```

Example prompt: Can you audit these dependencies for known vulnerabilities: lodash 4.17.20, axios 0.21.1, and express 4.17.1 in the npm ecosystem — I want to see any OSV advisories and severity ratings.

## When to prefer this

Use this endpoint when you need to programmatically check exact pinned dependency versions against the OSV vulnerability database in an automated or agentic workflow, especially when integrating security checks into CI/CD pipelines or software supply chain audits. It is preferable to manual OSV.dev lookups when processing multiple packages at once or when building automated advisory alerting systems.

## Known failure modes

- Unknown ecosystem or package name returns no matches or an error
- Malformed version string causes validation failure
- Package not found in OSV database returns empty advisory list
- Rate limiting or quota exceeded returns payment/quota error
- Network timeout if OSV database is temporarily unavailable

## How this service works

Audit exact Python/PyPI, npm, Go, Maven, NuGet, crates.io, or RubyGems dependencies against OSV and return affected packages and vulnerabilities.

## Output

Returns a list of affected packages with matched vulnerability advisories from the OSV database, including advisory IDs, CVE references, severity levels, affected version ranges, and remediation recommendations where available.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ecosystem": {
   "enum": [
    "PyPI",
    "npm",
    "Go",
    "Maven",
    "NuGet",
    "crates.io",
    "RubyGems"
   ],
   "type": "string"
  },
  "dependencies": {
   "type": "array",
   "items": {
    "type": "object",
    "properties": {
     "name": {
      "type": "string"
     },
     "version": {
      "type": "string"
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "clean": false,
   "source": "https://osv.dev",
   "findings": [
    {
     "name": "requests",
     "version": "2.32.3",
     "vulnerabilities": [
      {
       "id": "GHSA-9hjg-9r4m-mvj7",
       "aliases": [],
       "summary": null,
       "modified": "2026-07-07T17:56:56.234172Z"
      }
     ]
    }
   ],
   "ecosystem": "PyPI",
   "dependencies": 1,
   "vulnerabilityCount": 4
  },
  "meta": {
   "cached": false,
   "sources": [],
   "warnings": [],
   "duration_ms": 42,
   "next_actions": []
  },
  "service": "developer.dependency-audit",
  "version": "1",
  "request_id": "018f1f54-7f38-7ba2-8dc3-5f90272d9f1a"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/apiacre-com-dependency-vulnerability-audit-2c4e69d3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from apiacre.com](https://www.zero.xyz/host/apiacre.com/llms.txt)