Interfaces & Integrations - SCANOSS documentation

Interfaces & Integrations covers every way to bring SCANOSS into your existing stack: calling it directly through SDKs and REST APIs, automating scans in CI/CD, tracking vulnerabilities over time, generating compliance reports, and routing API traffic through a controlled proxy. If you followed the Evaluation Path, you’ve already set up GitHub Actions and Dependency Track as part of CI/CD Integration and Continuous Monitoring. This page is the full reference: every supported integration, including CI/CD platforms not covered in that guided walkthrough.

What Do You Need?

SDKs

Call the SCANOSS API and scanning engine directly from your application code, using the language your project is already written in.

Tool	Best For
Python SDK	Integrating SCANOSS into Python scripts and applications
Java SDK	Integrating SCANOSS into Java projects
JavaScript SDK	Integrating SCANOSS into JavaScript and Node.js projects

Direct API Access

Query the SCANOSS REST API directly for full control over requests and responses, without a client library or CLI tool in between. New to the API? Start with the API Overview.

Tool	Best For
Component Search API	Searching components and retrieving versions, metadata, code statistics, and lifecycle status
Dependencies API	Resolving direct and transitive dependencies
Geoprovenance API	Identifying the geographical provenance of components
License API	Retrieving license information, including SPDX details and approval status
Vulnerability API	Retrieving CPE identifiers and known vulnerabilities (CVEs)
Cryptography API	Analysing cryptographic algorithms, usage hints, and version coverage
Scanning API	High-precision scanning of folder structures to identify components
Postman	Exploring and testing SCANOSS API endpoints without writing code

CI/CD & Integrations

Run SCANOSS scans automatically as part of your build or pull request pipeline, then keep monitoring and enforcing policy after the scan is done, whichever platform your team already uses.

Tool	Best For
Pre-Commit Hooks	Catching undeclared components before code is even pushed
GitHub Actions	Scanning pull requests and enforcing policies in GitHub-hosted pipelines
Azure DevOps	Scanning pull requests and enforcing policies in Azure Pipelines
Jenkins	Scanning builds in self-hosted Jenkins pipelines
GitLab CI/CD	Scanning pipelines and merge requests in GitLab
SonarQube	Surfacing SCANOSS findings alongside your existing SonarQube code quality checks
Dependency Track	Continuously monitoring your SBOM for new vulnerabilities, license risks, and policy violations as they emerge
OSS Review Toolkit (ORT)	Generating compliance reports and managing open source licenses with an enterprise-grade FOSS policy automation toolkit

Network & Security

Any of the interfaces above, SDKs, direct API calls, or CI/CD tooling, can optionally route through a controlled proxy instead of calling the SCANOSS API directly. Proxy Configuration routes SCANOSS API traffic through a controlled proxy for centralised key management, security, and audit logging. Need help? Contact our AI assistant

​What Do You Need?

​SDKs

​Direct API Access

​CI/CD & Integrations

​Network & Security

What Do You Need?

SDKs

Direct API Access

CI/CD & Integrations

Network & Security