curl --request POST \
  --url https://api.scanoss.com/v3/cryptography/reachability/component \
  --header 'Content-Type: application/json' \
  --data '
{
  "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
  "requirement": "1.78.1"
}
'

{
  "rules_version": "v1.19.0",
  "data": [
    {
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
      "version": "1.78.1",
      "requirement": "1.78.1",
      "finding_count": 1,
      "schemas": {
        "findings": "1.6",
        "callgraph": "6.10"
      },
      "findings": [
        {
          "file_path": "core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java",
          "language": "java",
          "cryptographic_assets": [
            {
              "finding_id": "8f3a2c41",
              "occurrence_key": "v1:0123456789abcdef",
              "match": "new AESEngine()",
              "source": "direct",
              "start_line": 92,
              "end_line": 92,
              "start_col": 40,
              "end_col": 55,
              "status": "pending",
              "metadata": {
                "assetType": "algorithm",
                "algorithmName": "AES",
                "algorithmFamily": "AES",
                "algorithmPrimitive": "block-cipher",
                "api": "org.bouncycastle.crypto.engines.AESEngine",
                "library": "bouncycastle"
              },
              "rules": [
                {
                  "id": "java.crypto.bouncycastle.aes-engine",
                  "message": "AES block cipher engine",
                  "severity": "INFO"
                },
                {
                  "id": "java.crypto.bouncycastle.block-cipher",
                  "message": "Block cipher instantiation",
                  "severity": "INFO"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "info_code": "READY",
  "status": {
    "status": "SUCCESS",
    "message": "Reachability computed"
  }
}

cryptography-reachability

Reachability for a component stitched across its declared dep tree.

Returns the stitched cryptographic assets across the component and its transitive dependencies, plus (optionally) per-asset call chains, bounded forward calls, the crypto entry-point surface, supporting calls, and the unfiltered callgraph. Reads from the separate crypto reachability results database (enabled only when reachability_db.dsn is configured). Inspect info_code for READY / error.

Findings-only requests (only purl and requirement: no include_* flag and no entry_point_signatures) serve the report crypto-finder produced when it mined the served version — the stored findings for that purl, version and rules_version, after the same version resolution and fallback (actual_mined_version) as any other request. Every asset is passed through as mined: finding_id, occurrence_key, start_col/end_col, status, conditioned_value, dependency_info and every rule with its message and severity. The result is the same as scanning that component with crypto-finder. finding_count is the number of assets in the stored report, and schemas.findings is that report’s own version. When the stored row has no readable report, the findings are rebuilt from the crypto annotations instead, as every other request does; the request does not fail.

Any other request rebuilds the findings from the crypto annotations, which carry less per asset: no columns, status, occurrence key or conditioned value, only the first rule (id only), and a finding_id recomputed from the stitched file path.

POST

cryptography

reachability

component

curl --request POST \
  --url https://api.scanoss.com/v3/cryptography/reachability/component \
  --header 'Content-Type: application/json' \
  --data '
{
  "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
  "requirement": "1.78.1"
}
'

{
  "rules_version": "v1.19.0",
  "data": [
    {
      "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on",
      "version": "1.78.1",
      "requirement": "1.78.1",
      "finding_count": 1,
      "schemas": {
        "findings": "1.6",
        "callgraph": "6.10"
      },
      "findings": [
        {
          "file_path": "core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java",
          "language": "java",
          "cryptographic_assets": [
            {
              "finding_id": "8f3a2c41",
              "occurrence_key": "v1:0123456789abcdef",
              "match": "new AESEngine()",
              "source": "direct",
              "start_line": 92,
              "end_line": 92,
              "start_col": 40,
              "end_col": 55,
              "status": "pending",
              "metadata": {
                "assetType": "algorithm",
                "algorithmName": "AES",
                "algorithmFamily": "AES",
                "algorithmPrimitive": "block-cipher",
                "api": "org.bouncycastle.crypto.engines.AESEngine",
                "library": "bouncycastle"
              },
              "rules": [
                {
                  "id": "java.crypto.bouncycastle.aes-engine",
                  "message": "AES block cipher engine",
                  "severity": "INFO"
                },
                {
                  "id": "java.crypto.bouncycastle.block-cipher",
                  "message": "Block cipher instantiation",
                  "severity": "INFO"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "info_code": "READY",
  "status": {
    "status": "SUCCESS",
    "message": "Reachability computed"
  }
}

Body

application/json

purl

string

required

requirement

string

Version constraint. Accepts exact versions (1.5.2, =1.5.2) or SemVer constraint expressions (>=1.5.0, ^1.5.0, ~1.5.0, >=1.5.0,<2.0.0, 4.1.x), including Maven range syntax ([4.1.112,4.2.0), (,4.1.112]; [4.1.112] is an exact pin). An unparseable constraint → INVALID_SEMVER. The leading = is optional. A range with a lower bound resolves to the mined version nearest that bound (the lowest satisfying one); an upper-bound-only range resolves to the highest. Maven qualifiers are understood: 4.1.136.Final satisfies >=4.1.112. No match → VERSION_NOT_FOUND.

entry_point_signatures

string[]

Optional exact-match filter on entry-point canonical signatures. When non-empty, assets[] is restricted to findings reachable from at least one supplied entry point. Findings unreachable from any supplied entry are REMOVED entirely from assets[] — they do NOT appear as reachability: unreachable entries. An empty array (or absent field) means no filter; all findings are returned.

Matching is against crypto_entry_points[].canonical_signature, so every entry point the service can publish is a usable filter value — including the majority that head none of the emitted call_chains[]. Supply the signature exactly as that field spells it, spaces included.

With include_call_chains: true a surviving asset's call_chains[] carries routes that START at a supplied entry: the traversal is rooted at them, so the per-finding chain budget is spent reaching what you asked about instead of on whichever entries the walk happened to meet first.

Signatures matching no entry point in the component are listed in unmatched_signatures at the top level of the response (diagnostic for typos).

include_call_chains

boolean

default:false

When true, decorates each asset with its call_chains[] array (raw callgraph 6.x frame arrays) and the reachability verdict. Default false produces a pure CBOM response (findings without reachability decoration). Independent of entry_point_signatures (which controls whether assets are PRUNED to reachable ones). Independent of include_crypto_entry_points and include_supporting_calls.

include_crypto_entry_points

boolean

default:false

When true, populates crypto_entry_points[] at the top level of each ComponentData block — the public reachability surface (entry-point functions with their reachable_findings[]). This is the projection that replaced the legacy entry_point_index field. Independent of include_call_chains and include_supporting_calls.

include_supporting_calls

boolean

default:false

When true, populates supporting_calls[] at the top level of each ComponentData block (deduped object-lifecycle calls such as IV generation and key-size initialisation) AND attaches supporting_call_ids[] to each cryptographic_asset whose finding graph references supporting calls. Each supporting_call_id resolves to a supporting_calls[].supporting_id in the same block. Independent of include_call_chains and include_crypto_entry_points.

include_forward_calls

boolean

default:false

When true, attaches a bounded forward_calls graph to each asset. Forward traversal follows only real implementation edges and keeps argument expressions, resolved values, inferred types, provenance, candidate evidence, and explicit truncation state. When false or absent, responses retain their previous shape.

max_forward_depth

integer<int32>

Optional forward traversal depth. Applies only when include_forward_calls: true. When omitted, the producer default of 4 is used. Values outside 1..16 are rejected with HTTP 400.

Required range: 1 <= x <= 16

include_raw_callgraph

boolean

default:false

When true, callgraph at the top level of the response carries the unfiltered merged callgraph.

max_chains_per_asset

integer<int32>

default:0

Per-asset cap on call_chains[] length. Hard cap 128. 0 (the default) applies no cap HERE — it does not mean every route that exists is returned: the traversal that produces the chains already bounds them at 128 per finding, so 128 is the ceiling either way. Use a positive integer to ask for fewer. Values above 128 are rejected with HTTP 400.

A finding at that ceiling has more routes than were emitted, and analysis.call_chains does not currently report it — treat exactly 128 chains as "sampled", and read crypto_entry_points[].reachable_findings[].chain_depth for the distance from an entry the chains do not cover.

Required range: 0 <= x <= 128

Response

Request processed. Inspect info_code for READY / error.

Response envelope for /component. Top-level shape: {data, info_code, info_message, missing_components, rules_version, status, unmatched_signatures, callgraph}.

data is an array of length 1 — the target component block with all merged transitive findings collapsed in (own + indirect, discriminated by cryptographic_asset.source). Component identity (purl, version, requirement) lives inside data[0], not at the top level.

Unmined nodes in the recorded dependency closure do not blank the parent: the envelope stays READY and lists those holes in missing_components. NO_INFO remains only when the requested component itself has no serveable graph.

unmatched_signatures and callgraph live at the TOP LEVEL.

Each data[] block optionally carries crypto_entry_points[] and supporting_calls[] when the corresponding opt-in flags are set.

info_code

enum<string>

required

Outcome for this single component. A bucket-fallback result stays READY with actual_mined_version set. Unmined transitives keep the envelope READY and appear in missing_components. DEPENDENCY_UNRESOLVED and INVALID_REQUEST are not used by this endpoint.

Available options:

READY,

INVALID_PURL,

INVALID_SEMVER,

COMPONENT_NOT_FOUND,

VERSION_NOT_FOUND,

UNSUPPORTED_SCHEMA,

NO_INFO,

DEPENDENCY_UNRESOLVED,

INVALID_REQUEST

status

object

required

Top-level outcome for the request as a whole.

Show child attributes

rules_version

string

Echoed on READY — the rules_version active for this row.

data

object[]

Show child attributes

unmatched_signatures

string[]

Signatures from entry_point_signatures that matched zero chains.

callgraph

object

Raw merged callgraph as JSON, populated only when the request set include_raw_callgraph: true. Shape matches crypto-finder callgraph schema 6.x verbatim.

missing_components

object[]

Recorded transitive dependencies that have no serveable graph fragment or annotation. Present only on a READY envelope whose requested component was mined. The parent is stitched from the subgraph that is present; chains through a listed hole do not exist. Omitted when the closure is complete. Not used to report a missing root — that remains info_code: NO_INFO.

Show child attributes

info_message

string

Get started

Recipes

CLI reference

API reference

Self-hosting & knowledge base

Reachability for a component stitched across its declared dep tree.

Body

Response