deps.dev API
Free Google deps.dev API with no key: transitive dependency graphs, licences, advisories and OpenSSF scorecards across npm, PyPI, Go, Maven and Cargo. Tested.
Endpoint tested and returned HTTP 200 on 2026-08-20
What is the deps.dev API?
deps.dev is a free, key-free API from Google providing dependency graph data for open source packages — full transitive dependencies, licences, security advisories and OpenSSF Scorecard results across major ecosystems.
Most registry APIs list a package's direct dependencies. deps.dev resolves the full transitive graph, which is what actually determines your risk surface — the vulnerability that bites you is usually four levels down, not in your package.json.
It also surfaces OpenSSF Scorecard results: automated checks on whether a project signs releases, runs fuzzing, requires code review and so on. That is a supply-chain health signal you cannot get from download counts.
Quick facts
- Base URL
https://api.deps.dev/v3alpha- Authentication
- No API key required.
- Rate limit
- No published hard limit; fair use expected.
- Pricing
- Free, operated by Google.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the deps.dev API
Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.
1. Fetch package metadata and versions
GET https://api.deps.dev/v3alpha/systems/npm/packages/react
curl 'https://api.deps.dev/v3alpha/systems/npm/packages/react'const res = await fetch("https://api.deps.dev/v3alpha/systems/npm/packages/react");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://api.deps.dev/v3alpha/systems/npm/packages/react", timeout=20)
res.raise_for_status()
print(res.json()){
"packageKey": {
"system": "NPM",
"name": "react"
},
"purl": "pkg:npm/react",
"versions": [
{
"versionKey": {
"system": "NPM",
"name": "react",
"version": "0.0.0-00d4f95c2"
},
"purl": "pkg:npm/react@0.0.0-00d4f95c2",
"publishedAt": "2021-03-15T16:12:35Z",
"isDefault": false,
"isDeprecated": false,
"deprecatedReason": ""
},
{
"versionKey": {
"system": "NPM",
"name": "react",
"version": "0.0.0-0203b6567"
},
"purl": "pkg:npm/react@0.0.0-0203b6567",
"publishedAt": "2021-03-16T16:13:04Z",
"isDefault": false,
"isDeprecated": false,
"deprecatedReason": ""
},
{
"versionKey": {
"system": "NPM",
"name": "react",
"version": "0.0.0-0935a1db3"
},
"purl": "pkg:npm/react@0.0.0-0935a1db3",
"publishedAt": "2021-02-03T18:09:51Z",
"isDefault": false,
"isDeprecated": false,
"deprecatedReason": ""
},
{
"versionKey": {
"system": "NPM",
"name": "react",
"version": "0.0.0-0c756fb-697f004"
},
"purl": "pkg:npm/react@0.0.0-0c756fb-697f004",
"publishedAt": "2018-11-13T02:17:19Z",
"isDefault": false,
"isDeprecated": false,
"deprecatedReason": ""
},
{
"versionKey": {
"system": "NPM",
"name": "react",
"version": "0.0.0-0c756fb-f7f79fd"
},
"purl": "pkg:npm/react@0.0.0-0c756fb-f7f79fd",
"publishedAt": "2018-11-13T03:47:32Z",
"isDefault": falsParameters
| Parameter | Type | Required | Description |
|---|---|---|---|
systems/<system>/packages/<name> | path | Required | Ecosystem and package name. systems/npm/packages/react |
<system> | path | Required | npm, pypi, go, maven or cargo. npm |
versions/<version> | path | Optional | A specific version's details. versions/18.2.0 |
dependencies | path | Optional | Full transitive dependency graph for a version. dependencies |
Response fields
packageKeyobject- System and name identifying the package.
purlstring- Package URL identifier, e.g. pkg:npm/react.
versionsarray- Published versions with their own keys.
versions[].isDefaultboolean- Whether this is the current default version.
(dependencies) nodesarray- Every package in the resolved graph, including transitive.
(dependencies) edgesarray- Which package depends on which.
(version) advisoryKeysarray- Security advisories affecting the version.
What you can build with the deps.dev API
- Visualise a project's full transitive dependency tree
- Audit licences across every indirect dependency
- Assess supply chain health with OpenSSF Scorecard data
- Find which transitive dependency introduces a vulnerability
Common errors and how to fix them
v3alpha in the path
The API is still alpha.
Fix: Expect the path and schema to change; pin behaviour with tests.
Huge dependency graphs
Transitive graphs for large packages contain thousands of nodes.
Fix: Traverse edges rather than loading everything into memory at once.
System name case
Systems are lowercase in the path.
Fix: Use npm, pypi, go, maven, cargo.
deps.dev API — frequently asked questions
Is deps.dev free?
Yes, completely free with no API key. It is operated by Google as part of its open source security work.
How is it different from an npm registry lookup?
The registry gives direct dependencies. deps.dev resolves the full transitive graph, which is where most real supply-chain risk actually lives.
What is an OpenSSF Scorecard?
An automated assessment of a project's security practices — whether it signs releases, runs fuzzing, requires code review, pins dependencies. It is a health signal that download counts cannot give you.
Is the API stable?
It is still labelled v3alpha, so the path and schema may change. Pin your integration with tests and expect occasional churn.
Tools that pair with this API
JSON Formatter
Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.
JSON Validator
Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.
deps.dev is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.