OpenSSF Scorecard API

Free OpenSSF Scorecard API with no key: automated supply-chain security scores for open source repositories across 18 checks, with reasons and evidence for each.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the OpenSSF Scorecard API?

The OpenSSF Scorecard API is a free, key-free service returning pre-computed security posture scores for open source repositories. It gives an overall score out of 10 plus per-check results across roughly eighteen supply-chain security practices, each with a reason and supporting evidence.

Scorecard turns a set of security questions you would otherwise ask by hand — is there a security policy, are dependencies pinned, is CI running static analysis, do maintainers require code review — into automated checks with reproducible answers. The API serves results from a weekly scan of a large set of repositories, so lookups are instant and cost nothing: the analysis already ran.

Read the checks, not the headline. An overall score of 9 tells you very little about which risks remain, whereas the per-check breakdown shows exactly where the gaps are, with `reason` and `details` explaining each verdict and a documentation link for the criterion. Two caveats matter. Coverage is limited to repositories in the scan set — critical projects and their dependents — so an obscure library returns 404 rather than a low score. And a score measures observable process, not code quality or absence of vulnerabilities: a well-run project with a serious bug scores high, and that is the metric working as designed.

Quick facts

Base URL: https://api.securityscorecards.dev
Authentication: No API key or account. Scorecard is an OpenSSF project under the Linux Foundation; both the tool and the results are open, licensed Apache 2.0.
Rate limit: No published limit. Results are pre-computed weekly, so caching for a week loses nothing.
Pricing: Free, with no registration.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the OpenSSF Scorecard API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch the Scorecard result for a GitHub repository

GET https://api.securityscorecards.dev/projects/github.com/ossf/scorecard

curl

curl 'https://api.securityscorecards.dev/projects/github.com/ossf/scorecard' \
  -H 'Accept: application/json'

JavaScript (fetch)

const res = await fetch("https://api.securityscorecards.dev/projects/github.com/ossf/scorecard", {
  headers: {
    "Accept": "application/json",
  },
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Accept": "application/json",
}

res = requests.get("https://api.securityscorecards.dev/projects/github.com/ossf/scorecard", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "date": "2026-08-15T06:01:40Z",
  "repo": {
    "name": "github.com/ossf/scorecard",
    "commit": "d1fab88f54636ff366076edfc5c239f97b3c8e66"
  },
  "scorecard": {
    "version": "v5.5.0",
    "commit": "c395761df6afe1a69e476bc60a013a94bcbc153f"
  },
  "score": 9,
  "checks": [
    {
      "name": "Security-Policy",
      "score": 10,
      "reason": "security policy file detected",
      "details": [
        "Info: security policy file detected: SECURITY.md:1",
        "Info: Found linked content: SECURITY.md:1",
        "Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1",
        "Info: Found text in security policy: SECURITY.md:1"
      ],
      "documentation": {
        "short": "Determines if the project has published a security policy.",
        "url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
      }
    },
    {
      "name": "Code-Review",
      "score": 10,
      "reason": "all changesets reviewed",
      "details": null,
      "documentation": {
        "short": "Determines if the project requires human code review before pull requests (aka merge requests) are merged.",
        "url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
      }
    },
    {
      "name": "Maintained",
      "score": 10,
      "reason": "14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
      "details": null,
      "documentation": {
        "short": "Determines if the proje

Parameters

Parameter	Type	Required	Description
`platform`	path segment	Required	Source forge hostname, such as `github.com` or `gitlab.com`. `github.com`
`org`	path segment	Required	Organisation or user that owns the repository. `ossf`
`repo`	path segment	Required	Repository name. `scorecard`
`commit`	query	Optional	Return the result for a specific commit rather than the latest scan. `d1fab88f`
`(endpoint) /badge`	path	Optional	An SVG badge for the repository's current score, for embedding in a README. `/projects/github.com/ossf/scorecard/badge`

Response fields

datestring: When the scan ran. Results are weekly, so this can be several days old.
repo.name / repo.commitstring: Repository and the exact commit scored, which makes the result reproducible.
scorecard.versionstring: Which Scorecard release produced the result. Check definitions change between versions, so scores are not always comparable across them.
scorefloat: Overall score out of 10, a weighted aggregate of the individual checks.
checks[].namestring: Check identifier such as `Security-Policy`, `Code-Review`, `Maintained`, `Branch-Protection`, `Pinned-Dependencies`.
checks[].scoreinteger: Score for that check, 0 to 10. `-1` means the check could not run, which is different from a zero.
checks[].reasonstring: Plain-language explanation of the verdict — the most useful field in the response.
checks[].detailsarray: Evidence, often citing specific files and line numbers. Null for checks that need none.

What you can build with the OpenSSF Scorecard API

Screen a dependency's security posture before adopting it
Track your own repositories' scores over time
Set a policy floor for the open source you accept into a build
Compare candidate libraries on maintenance and review practice
Generate a supply-chain risk report across a dependency list

Common errors and how to fix them

404

The repository is not in the weekly scan set.

Fix: Coverage is limited to critical projects and their dependents. Run the Scorecard CLI yourself against any repository to get a result on demand.

Check score of -1

The check could not be evaluated.

Fix: This is not a zero. It usually means missing permissions or an inapplicable check. Exclude `-1` results from any average you compute.

Stale result

Scans run weekly.

Fix: Compare the `date` field against now. For an up-to-the-minute answer, run the CLI rather than reading the API.

Score changed without a code change

Scorecard's own version changed.

Fix: Check definitions and weights evolve between releases. Record `scorecard.version` alongside any score you track over time.

OpenSSF Scorecard API — frequently asked questions

Is the OpenSSF Scorecard API free?

Yes, free with no key or registration. Scorecard is an OpenSSF project under the Linux Foundation, and both the tool and the published results are open under Apache 2.0.

Does a high Scorecard score mean the code is secure?

No, and the project is explicit about this. Scorecard measures observable development practices — code review, dependency pinning, static analysis, branch protection — not the presence or absence of vulnerabilities. A high score means the project is run in a way that reduces risk, not that the code is free of bugs.

Why does my repository return 404?

Because the API only serves results for repositories in the weekly scan set, which covers critical projects and their dependents. You can run the Scorecard CLI or GitHub Action against any repository yourself to produce the same analysis.

What does a check score of -1 mean?

That the check could not be evaluated, typically for lack of the data or permissions it needs. It is not a failing grade, and including it in an average will unfairly depress the result.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

JSON Path Finder

Evaluate a dot/bracket path against your JSON and list every leaf path for discovery. Free online JSON path finder that runs 100% in your browser.

OpenSSF Scorecard is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.