# SCANOSS documentation - [What is SCANOSS?](https://docs.scanoss.com/en/latest/introduction/what-is-scanoss.md): SCANOSS is an open-source **software risk intelligence** platform that analyses source code to identify **declared and undeclared open-source usage**. It generates accurate, standards-based SBOMs and provides structured insight into software composition, licensing, and security through a command-lin… - [Open Source in AI-Generated Code](https://docs.scanoss.com/en/latest/introduction/use-cases/oss-in-ai-gen-code.md): The rapid adoption of AI in software development has changed how code is written, introducing significant challenges around code transparency, licence compliance, and intellectual property risk. - [Cryptography Detection](https://docs.scanoss.com/en/latest/introduction/use-cases/crypto-detection.md): How SCANOSS identifies and analyses cryptographic algorithms in software for security, compliance, and regulatory purposes. - [OSS Licence Compliance](https://docs.scanoss.com/en/latest/introduction/use-cases/oss-license-compliance.md): How SCANOSS helps organisations identify, track, and manage open source licence obligations within their codebases. - [Platform Architecture Overview](https://docs.scanoss.com/en/latest/introduction/platform-architecture-overview.md): Overview of SCANOSS platform architecture, highlighting secure local scanning, open-source knowledge management, and flexible deployment for reliable software composition analysis. - [Initial API Configuration](https://docs.scanoss.com/en/latest/introduction/initial-api-configuration.md): SCANOSS tools function without additional configuration and do not require an API key. However, an API key enables access to additional API features. - [Components Overview](https://docs.scanoss.com/en/latest/getting-started/components-overview.md): An overview of the core components that make up the SCANOSS platform, including the Engine, LDB, Python CLI, and SBOM Workbench. - [Understanding Scan Results](https://docs.scanoss.com/en/latest/getting-started/understanding-scan-results.md): Scan results are saved to `results.json` by default. - [Declaring Components](https://docs.scanoss.com/en/latest/getting-started/declaring-components.md): SCANOSS provides a settings file to customise the scanning process. - [Overview](https://docs.scanoss.com/en/latest/installation/on-prem/overview.md): This document provides a step-by-step guide for installing SCANOSS in an on-premises environment. - [Hardware Requirements](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/hardware-requirements.md): Recommended hardware specifications for running SCANOSS on-premise. - [Prepare the Environment](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/prepare-environment.md): Clone the on-premise repository and configure script permissions before running the SCANOSS installation. - [Install Applications](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/install-applications.md): Install SCANOSS system dependencies and applications using the `install-scanoss.sh` script. - [Install Knowledge Base](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/install-knowledge-base.md): Download and install the SCANOSS Knowledge Base or Test KB using the `kb-download.sh` script. - [Verify Installation](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/verify-installation.md): Verify that all SCANOSS components are functioning correctly after installation. - [API Service Management](https://docs.scanoss.com/en/latest/installation/on-prem/configuration/api-service-management.md): Start, stop, and check the status of the SCANOSS API service. - [API Configuration](https://docs.scanoss.com/en/latest/installation/on-prem/configuration/api-configuration.md): Configure the SCANOSS API service using the application configuration file. - [KB Update Guide](https://docs.scanoss.com/en/latest/installation/on-prem/kb-update-guide.md): How to download and update the SCANOSS on-premise Knowledge Base (KB). - [KB Docker Example](https://docs.scanoss.com/en/latest/installation/on-prem/local-kb-docker-example.md): How to build and test a local SCANOSS Knowledge Base using Docker, covering file matching and snippet matching. - [Cloud Deployment](https://docs.scanoss.com/en/latest/installation/cloud-deployment.md): SCANOSS offers two managed cloud deployment models: **Dedicated SaaS** and **Shared SaaS**. Both are fully operated by SCANOSS and hosted in European data centres, providing strong data protection and regulatory compliance. - [Proxy Configuration](https://docs.scanoss.com/en/latest/configuration/proxy-configuration.md): Set up a Caddy reverse proxy to centrally manage your SCANOSS API key and control outbound traffic across your organisation. - [Certificate Management](https://docs.scanoss.com/en/latest/configuration/certificate-management.md): Configure HTTPS and TLS certificates for your Caddy proxy, including automatic certificates, self-signed certificates, and custom certificate files. - [Pre-Commit Hooks](https://docs.scanoss.com/en/latest/integrations/pre-commit-hooks.md): Automatically scan your staged files for undeclared open-source components before each commit using SCANOSS pre-commit hooks. - [GitHub Actions](https://docs.scanoss.com/en/latest/integrations/github-actions.md): Integrate [SCANOSS](https://github.com/scanoss/gha-code-scan) into your CI/CD pipeline via GitHub Actions for automated code scanning and licence compliance. - [Azure DevOps](https://docs.scanoss.com/en/latest/integrations/azure-devops.md): Integrate SCANOSS into your development workflow via Azure Pipelines. - [Jenkins](https://docs.scanoss.com/en/latest/integrations/jenkins.md): Use SCANOSS in different development scenarios via Jenkins Pipelines. - [GitLab](https://docs.scanoss.com/en/latest/integrations/gitlab.md): Leverage SCANOSS in different development scenarios via GitLab CI/CD. - [SonarQube](https://docs.scanoss.com/en/latest/integrations/sonarqube.md): Integrate SCANOSS into your SonarQube analysis pipeline using the SCANOSS SonarQube Plugin. - [Dependency-Track](https://docs.scanoss.com/en/latest/integrations/dependency-track.md): Dependency-Track and its integration with SCANOSS for continuous vulnerability monitoring and policy enforcement. - [OSS Review Toolkit (ORT)](https://docs.scanoss.com/en/latest/integrations/oss-review-toolkit.md): The [OSS Review Toolkit (ORT)](https://github.com/oss-review-toolkit/ort) is an enterprise-grade FOSS policy automation and orchestration toolkit. - [Scanning a File or Directory](https://docs.scanoss.com/en/latest/core/engine/scanning-file-or-directory.md): Learn how to use the SCANOSS Engine to scan a file or directory against the SCANOSS Knowledgebase and interpret the identification results. - [Command Parameters & Flags](https://docs.scanoss.com/en/latest/core/engine/command-parameters-flags.md): Complete reference for all SCANOSS Engine CLI parameters, flags, and environment variables used to configure and control scan behaviour. - [SCANOSS LDB](https://docs.scanoss.com/en/latest/core/scanoss-ldb.md): An overview of the LDB (Linked-list Database), the headless, read-optimised database engine at the core of the SCANOSS platform, designed for single-key lookups across vast amounts of open source data. - [Installation](https://docs.scanoss.com/en/latest/cli/scanoss-py/installation.md): A Python library and CLI tool for Software Composition Analysis. Scan your codebase for open-source components, dependencies, and licence compliance. - [Scanning Your Project](https://docs.scanoss.com/en/latest/cli/scanoss-py/scanning-your-project.md): Scan your code for open-source components, licences, vulnerabilities, and dependencies using SCANOSS. - [Output Formats](https://docs.scanoss.com/en/latest/cli/scanoss-py/output-formats.md): SCANOSS-PY outputs scan results in multiple industry-standard formats, including CycloneDX, SPDX Lite, CSV, and the default JSON format. - [Converting Results](https://docs.scanoss.com/en/latest/cli/scanoss-py/converting-results.md): Transform SCANOSS scan results between different formats, including CycloneDX, SPDX Lite, and CSV. - [Commands & Arguments](https://docs.scanoss.com/en/latest/cli/scanoss-py/commands-and-arguments.md): Complete reference for all SCANOSS-PY CLI commands, subcommands and their arguments. - [Proxy and Certificate Options](https://docs.scanoss.com/en/latest/cli/scanoss-py/proxy-and-certificate-options.md): Configure HTTP/HTTPS proxies, PAC (Proxy Auto-Config), custom SSL certificates, and reverse proxy with API key injection for corporate networks and secure environments. - [Using Docker](https://docs.scanoss.com/en/latest/cli/scanoss-py/using-docker.md): Run the SCANOSS Python CLI in isolated Docker containers using the official image from GitHub Container Registry. - [Advanced Use](https://docs.scanoss.com/en/latest/cli/scanoss-py/advanced-use.md): Advanced features and configurations for power users, including settings files, HPSM, multi-threading, and obfuscation. - [Installation](https://docs.scanoss.com/en/latest/cli/scanoss-js/installation.md): A Node.js module and CLI for interacting with SCANOSS APIs and Engine. Scan your codebase for open-source components, dependencies, and licence compliance. - [Scanning and Fingerprinting Examples](https://docs.scanoss.com/en/latest/cli/scanoss-js/scanning-and-fingerprinting-examples.md): Practical CLI examples for scanning, dependency detection, cryptography detection, and fingerprint generation using scanoss-js. - [Commands & Arguments](https://docs.scanoss.com/en/latest/cli/scanoss-js/commands-and-arguments.md): Complete reference for all SCANOSS-JS CLI commands and their arguments. - [Overview](https://docs.scanoss.com/en/latest/cli/crypto-finder/overview.md): [Crypto Finder](https://github.com/scanoss/crypto-finder) is a CLI tool for detecting cryptographic algorithm usage in source code repositories. Crypto Finder scans codebases using multiple scanning engines and outputs results in standardised formats including JSON and CycloneDX. - [Installation](https://docs.scanoss.com/en/latest/cli/crypto-finder/installation.md): Get started with SCANOSS Crypto Finder. Choose from Docker, package managers, or build from source. - [Quick Start](https://docs.scanoss.com/en/latest/cli/crypto-finder/quick-start.md): Get started with Crypto Finder in minutes. This guide walks you through your first cryptographic scan. - [Configuration](https://docs.scanoss.com/en/latest/cli/crypto-finder/configuration.md): Crypto Finder supports flexible configuration through multiple mechanisms: `scanoss.json` files, command-line flags, and environment variables. - [Output Formats](https://docs.scanoss.com/en/latest/cli/crypto-finder/output-formats.md): Crypto Finder supports two output formats for scan results. - [Error Codes](https://docs.scanoss.com/en/latest/cli/crypto-finder/error-codes.md): The stable, machine-readable failure code and pipeline stage taxonomy Crypto Finder emits with --error-format json, for CI parsers and downstream tooling. - [Remote Rulesets](https://docs.scanoss.com/en/latest/cli/crypto-finder/remote-rulesets.md): Crypto Finder can automatically fetch curated rulesets from the SCANOSS API, providing up-to-date cryptographic detection rules without requiring manual management. - [Docker Usage](https://docs.scanoss.com/en/latest/cli/crypto-finder/docker-usage.md): Crypto Finder provides official Docker images for containerised scanning workflows. - [Dependency Scanning & Call Chain Attribution](https://docs.scanoss.com/en/latest/cli/crypto-finder/dependency-scanning.md): This document explains how crypto-finder discovers cryptographic usage in project dependencies and traces it back to user code through call graph analysis. - [Overview](https://docs.scanoss.com/en/latest/cli/ai-finder/overview.md): [AI Finder](https://github.com/scanoss/ai-finder) is a CLI tool for detecting AI-generated artifacts in source code repositories. It helps organisations inventory AI components, assess supply chain risk and meet emerging regulatory and governance requirements. - [Installation](https://docs.scanoss.com/en/latest/cli/ai-finder/installation.md): Get started with AI Finder. Install the CLI and start detecting AI artifacts, models and dependencies across your repositories. - [Telemetry](https://docs.scanoss.com/en/latest/cli/ai-finder/telemetry.md): AI Finder collects anonymous usage data to help improve the tool. This document describes what data is collected, why we collect it, how to opt out and our privacy commitments. - [Overview](https://docs.scanoss.com/en/latest/sdks/python/overview.md): The SCANOSS Python SDK is a library for integrating with the SCANOSS API and scanning engine from Python scripts and applications. - [Authentication](https://docs.scanoss.com/en/latest/sdks/python/authentication.md): How to authenticate the scanoss.py Python SDK with an API key and configure a custom API endpoint. - [Usage](https://docs.scanoss.com/en/latest/sdks/python/usage.md): The `scanoss` package can be imported directly into your own Python projects and scripts via `scanoss.scanner`. - [Overview](https://docs.scanoss.com/en/latest/sdks/java/overview.md): The SCANOSS Java SDK provides a Java library for interacting with the SCANOSS API and scanning engine directly from your Java projects. - [Authentication](https://docs.scanoss.com/en/latest/sdks/java/authentication.md): How to authenticate the SCANOSS Java SDK with an API key and configure a custom API endpoint. - [Usage](https://docs.scanoss.com/en/latest/sdks/java/usage.md): The `scanoss` Java package can be imported and used directly in your own Java projects via the `com.scanoss` package. - [Overview](https://docs.scanoss.com/en/latest/sdks/javascript/overview.md): The SCANOSS JS SDK provides a JavaScript module for interacting with the SCANOSS API and scanning engine directly from your JavaScript projects. - [Authentication](https://docs.scanoss.com/en/latest/sdks/javascript/authentication.md): How to authenticate the SCANOSS JavaScript SDK with an API key and configure custom API endpoints. - [Usage](https://docs.scanoss.com/en/latest/sdks/javascript/usage.md): The `scanoss` package can be imported directly into JavaScript and TypeScript projects from `scanoss`. - [Installation & Setup](https://docs.scanoss.com/en/latest/clients/workbench/installation-quick-start.md): Get started with SBOM Workbench — installation, initial configuration, and workspaces. - [Scanning, Reporting and Auditing](https://docs.scanoss.com/en/latest/clients/workbench/project-scanning-auditing-reporting.md): Guide to scanning a project, understanding scan results, and auditing components in SBOM Workbench. - [Advanced Search & Final Review](https://docs.scanoss.com/en/latest/clients/workbench/vulnerability-crypto-scanning.md): Guide to using Search Keywords and Cryptography Search to locate specific files, and verifying your audit is complete in SBOM Workbench. - [Exporting SBOMs and Projects](https://docs.scanoss.com/en/latest/clients/workbench/metadata-export-import.md): Guide to exporting SBOM files in various formats, and exporting full project archives, from SBOM Workbench. - [SCANOSS-CC](https://docs.scanoss.com/en/latest/clients/code-compare.md): [SCANOSS Code Compare](https://github.com/scanoss/scanoss.cc) is a desktop application for visual code comparison and open-source component identification. It enables developers to review and manage licence findings through a keyboard-driven interface with persistent decision management. - [API Overview](https://docs.scanoss.com/en/latest/apis/api-overview.md): Introduction to the SCANOSS API for software composition analysis, dependency information, vulnerability detection, and cryptography intelligence. - [Cryptography API](https://docs.scanoss.com/en/latest/apis/encryption-api.md): Analyse cryptographic algorithms, usage hints and version coverage for software components. - [Vulnerability API](https://docs.scanoss.com/en/latest/apis/vulnerability-api.md): Provides vulnerability data for software components, including CPE identifiers and known vulnerabilities (CVEs). - [Component Search API](https://docs.scanoss.com/en/latest/apis/component-search-api.md): Search components and retrieve versions, metadata, code statistics, and lifecycle status. - [License API](https://docs.scanoss.com/en/latest/apis/license-api.md): Retrieve license information for software components, including SPDX details and approval status. - [Geoprovenance API](https://docs.scanoss.com/en/latest/apis/geoprovenance-api.md): Retrieve geographical provenance of software components using contributor locations, commit timing patterns, and development activity. - [Dependencies API](https://docs.scanoss.com/en/latest/apis/dependencies-api.md): Provides dependency analysis for software components, including direct and transitive dependency resolution. - [Scanning API](https://docs.scanoss.com/en/latest/apis/scanning-api.md): Provides high-precision scanning of folder structures to identify software components based on project hierarchy, file names, and content patterns. - [Workspace Setup](https://docs.scanoss.com/en/latest/apis/postman/workspace-setup.md): Set up your Postman workspace for testing SCANOSS API endpoints with authentication and environment configuration. - [Sending Requests and Reviewing Results](https://docs.scanoss.com/en/latest/apis/postman/sending-requests-reviewing-results.md): Learn how to send API requests and interpret responses using Postman for SCANOSS vulnerability, cryptography, and component APIs. - [SBOM Formats](https://docs.scanoss.com/en/latest/advanced/sbom-formats.md): Generate and export Software Bill of Materials (SBOMs) in multiple industry-standard formats using SCANOSS tooling. - [Fast Winnowing & Fingerprinting](https://docs.scanoss.com/en/latest/advanced/fast-winnowing-fingerprint-algorithms.md): Fingerprinting is the process of creating a unique digital signature (fingerprint) for source code files using the Winnowing Algorithm. - [Troubleshooting & FAQs](https://docs.scanoss.com/en/latest/troubleshooting-and-faqs.md): Answers to common questions and troubleshooting guidance for SCANOSS tools, integrations, and APIs. - [Changelog / Version History](https://docs.scanoss.com/en/latest/release-notes/changelog-version-history.md): SCANOSS is a modular platform distributed across several independent repositories on GitHub. - [References and External Docs](https://docs.scanoss.com/en/latest/release-notes/references-external-docs.md): This page collects the key external standards, specifications, tools, and resources that SCANOSS builds on, integrates with, or references throughout its documentation. - [Support & Contribution](https://docs.scanoss.com/en/latest/support-and-contribution.md): Get help with SCANOSS tools, request features, contribute to tools, and give back to the community. - [Web](https://docs.scanoss.com/link/web.md) - [Github](https://docs.scanoss.com/link/github.md) - [Youtube](https://docs.scanoss.com/link/youtube.md) - [Introduction](https://docs.scanoss.com/en/latest/poc/evaluation/introduction.md): This documentation provides practical guidance for evaluating SCANOSS capabilities through proof-of-concept implementations. It covers hands-on testing scenarios across the SCANOSS core datasets: license compliance, encryption detection and security vulnerabilities. - [Getting Started](https://docs.scanoss.com/en/latest/poc/evaluation/getting-started.md): This page helps you quickly navigate to the right resources based on what you want to accomplish. - [End-to-End Workflow](https://docs.scanoss.com/en/latest/poc/evaluation/end-to-end.md): Set up SCANOSS pre-commit hooks to catch undeclared open source components before code leaves your workstation, integrate the GitHub Actions workflow to enforce copyleft and undeclared-component policies on pull requests, and use Dependency Track to manage vulnerabilities and define organisational l… - [Improving Scan Accuracy](https://docs.scanoss.com/en/latest/poc/evaluation/improving-scan-accuracy.md): Two ways to help SCANOSS return more accurate results: telling it what components you expect to find, and tuning how strict its snippet matching should be. - [Desktop Integration](https://docs.scanoss.com/en/latest/poc/evaluation/desktop-integration.md): This guide walks you through setting up SCANOSS on your local development machine. You'll learn how to scan your code, review findings, declare components and establish automated pre-commit checks. - [CI/CD Integration](https://docs.scanoss.com/en/latest/poc/evaluation/cicd-integration.md): This guide walks you through integrating SCANOSS into your CI/CD pipeline. You'll learn how to automate scans, configure compliance policies and generate SBOMs as part of your continuous integration workflow. - [Advanced Analysis](https://docs.scanoss.com/en/latest/poc/evaluation/advanced-analysis.md): This guide walks you through extending your SCANOSS analysis with cryptography and security scanning. You'll learn how to detect cryptographic algorithms, identify vulnerabilities and generate comprehensive reports. - [Continuous Monitoring](https://docs.scanoss.com/en/latest/poc/evaluation/continuous-monitoring.md): This guide walks you through establishing ongoing monitoring and compliance for your open source dependencies. - [License Dataset](https://docs.scanoss.com/en/latest/poc/datasets/license-dataset.md): Component identification and license compliance tools. - [Encryption Dataset](https://docs.scanoss.com/en/latest/poc/datasets/encryption-dataset.md): The Encryption Dataset provides tools for identifying and analysing cryptographic algorithms used in your codebase. Choose your approach based on your specific needs. - [Security Dataset](https://docs.scanoss.com/en/latest/poc/datasets/security-dataset.md): The Security Dataset provides tools for identifying vulnerabilities and CVEs in your components. Choose your approach based on your specific needs. - [Interfaces & Integrations](https://docs.scanoss.com/en/latest/poc/interfaces-integrations.md): Interfaces & Integrations covers calling SCANOSS directly through SDKs and REST APIs, automating scanning across your CI/CD pipeline, monitoring vulnerabilities over time, and controlling network access. Choose your approach based on your specific needs. - [Introduction](https://docs.scanoss.com/en/latest/earnie/introduction.md): Earnie is SCANOSS's agent-native control plane for open-source, cryptographic, and AI governance. It answers one question, repeatedly and with evidence, is it safe and lawful to ship this code? - [Setting Up Your Workspace](https://docs.scanoss.com/en/latest/earnie/getting-started/workspace-setup.md): How to sign in with your company's SSO and complete the six-step wizard that takes a new Earnie workspace from empty to running its first scan. - [Connecting a Repository](https://docs.scanoss.com/en/latest/earnie/getting-started/connecting-a-repository.md): What access Earnie asks for when you connect a repository, how the GitHub App connection is made, and how to manage or disconnect it afterwards. - [Your First Scan](https://docs.scanoss.com/en/latest/earnie/getting-started/first-scan.md): How a scan runs, the ways you can start one, what each stage means, and how scan coverage affects what the Dashboard and Review Workspace show you. - [Reading the Dashboard](https://docs.scanoss.com/en/latest/earnie/using-earnie/dashboard.md): The Dashboard's card canvas: tabs, lenses, customizing your own layout, what each card tells you, and reading the numbers honestly. - [Across Every Project](https://docs.scanoss.com/en/latest/earnie/using-earnie/all-projects.md): The All Projects view: which projects are blocked, which have never been scanned, which are missing evidence, and how to act on several projects at once. - [Triaging Findings](https://docs.scanoss.com/en/latest/earnie/using-earnie/triaging-findings.md): How to work through the Review Workspace backlog, make a defensible decision on each finding, and use keyboard shortcuts to triage at speed. - [Setting Your First Policy](https://docs.scanoss.com/en/latest/earnie/using-earnie/setting-policies.md): How to write a policy, choose its action, understand where it applies across your projects, and clone one to start a new rule. - [When the Gate Blocks a Merge](https://docs.scanoss.com/en/latest/earnie/using-earnie/merge-gate.md): The three routes available when a policy blocks a pull request, how to request a policy approval, and how approvals are tracked and revoked. - [Exporting an SBOM](https://docs.scanoss.com/en/latest/earnie/evidence/exporting-sboms.md): How to generate an SBOM snapshot, choose its format, and render the Attribution Document that carries the licence text you're obliged to distribute. - [Proving It Later](https://docs.scanoss.com/en/latest/earnie/evidence/audit-log.md): What the organisation-wide audit log records, how to filter it, and when to use it instead of a finding's own audit trail. - [Your Team](https://docs.scanoss.com/en/latest/earnie/administration/team-and-roles.md): The three roles Earnie uses to separate who can change the rules from who can work the queue, how to add members, and the full permissions matrix. - [API Keys](https://docs.scanoss.com/en/latest/earnie/administration/api-keys.md): How pipelines and scripts authenticate with Earnie, how to create and scope a key, and why each automation consumer should have its own. - [Standard echo](https://docs.scanoss.com/api-reference/components/standard-echo.md) - [Search for components](https://docs.scanoss.com/api-reference/components/search-for-components.md) - [Get the statistics for the specified components](https://docs.scanoss.com/api-reference/components/get-the-statistics-for-the-specified-components.md) - [Get status information for a specific purl via a get request](https://docs.scanoss.com/api-reference/components/get-status-information-for-a-specific-purl-via-a-get-request.md) - [Get the status for a list of purls posted in the body](https://docs.scanoss.com/api-reference/components/get-the-status-for-a-list-of-purls-posted-in-the-body.md) - [Get all version information for a specific component](https://docs.scanoss.com/api-reference/components/get-all-version-information-for-a-specific-component.md) - [Get cryptographic algorithms associated with a single software component.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-algorithms-associated-with-a-single-software-component.md): Analyzes the component and returns cryptographic algorithms detected in the codebase including algorithm names and strength classifications. - [Get cryptographic algorithms associated with multiple software components in a single request.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-algorithms-associated-with-multiple-software-components-in-a-single-request.md): Analyzes multiple components and returns cryptographic algorithms detected in each codebase including algorithm names and strength classifications. - [Get cryptographic algorithms used by a component across specified version ranges.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-algorithms-used-by-a-component-across-specified-version-ranges.md): Analyzes the component across version ranges and returns all cryptographic algorithms detected along with the versions where they appear. - [Get cryptographic algorithms used by multiple components across specified version ranges.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-algorithms-used-by-multiple-components-across-specified-version-ranges.md): Analyzes multiple components across version ranges and returns all cryptographic algorithms detected along with the versions where they appear for each component. - [Get component versions that contain or don't contain cryptographic algorithms within specified ranges.](https://docs.scanoss.com/api-reference/cryptography/get-component-versions-that-contain-or-dont-contain-cryptographic-algorithms-within-specified-ranges.md): Returns lists of versions that either contain cryptographic algorithms or don't, helping assess cryptographic presence across component evolution. - [Get multiple component versions that contain or don't contain cryptographic algorithms within specified ranges.](https://docs.scanoss.com/api-reference/cryptography/get-multiple-component-versions-that-contain-or-dont-contain-cryptographic-algorithms-within-specified-ranges.md): Returns lists of versions for multiple components that either contain cryptographic algorithms or don't, helping assess cryptographic presence across component evolution in batch operations. - [Returns the same message that was sent, used for health checks and connectivity testing](https://docs.scanoss.com/api-reference/cryptography/returns-the-same-message-that-was-sent-used-for-health-checks-and-connectivity-testing.md) - [Get cryptographic hints for a single component.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-hints-for-a-single-component.md): Returns hints about cryptographic protocols, libraries, SDKs and frameworks used by the component, providing insights into cryptographic dependencies. - [Get cryptographic hints for multiple components in a single request.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-hints-for-multiple-components-in-a-single-request.md): Returns hints about cryptographic protocols, libraries, SDKs and frameworks used by multiple components, providing insights into cryptographic dependencies. - [Get cryptographic hints across version ranges - legacy endpoint.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-hints-across-version-ranges--legacy-endpoint.md): Legacy method for retrieving cryptographic hints related to protocols, libraries, SDKs and frameworks across version ranges. Use ComponentHintsInRange or ComponentsHintsInRange instead. - [Get cryptographic hints across version ranges - legacy endpoint.](https://docs.scanoss.com/api-reference/cryptography/get-cryptographic-hints-across-version-ranges--legacy-endpoint-1.md): Legacy method for retrieving cryptographic hints related to protocols, libraries, SDKs and frameworks across version ranges. Use ComponentHintsInRange or ComponentsHintsInRange instead. - [Download cryptography detection ruleset as a tarball.](https://docs.scanoss.com/api-reference/cryptography/download-cryptography-detection-ruleset-as-a-tarball.md): Downloads a compressed tarball containing cryptographic detection rules for various programming languages. Rulesets can be used with tools like SCANOSS Crypto Finder for cryptographic algorithm detection in source code. - [Get dependency details Deprecated: Use /v2/licenses/components instead](https://docs.scanoss.com/api-reference/dependencies/get-dependency-detailsdeprecated:-use-v2licensescomponents-instead.md) - [Standard echo](https://docs.scanoss.com/api-reference/dependencies/standard-echo.md) - [Get transitive dependency details](https://docs.scanoss.com/api-reference/dependencies/get-transitive-dependency-details.md) - [[DEPRECATED] Get component-level Geo Provenance by contributor location](https://docs.scanoss.com/api-reference/geoprovenance/[deprecated]-get-component-level-geo-provenance-by-contributor-location.md) - [Get component-level Geo Provenance based on contributor declared location This is the current method that accepts ComponentRequest for enhanced component identification Replaces the deprecated GetComponentContributors method](https://docs.scanoss.com/api-reference/geoprovenance/get-component-level-geo-provenance-based-on-contributor-declared-locationthis-is-the-current-method-that-accepts-componentrequest-for-enhanced-component-identificationreplaces-the-deprecated-getcomponentcontributors-method.md) - [Get component-level Geo Provenance based on contributor declared location This is the current method that accepts ComponentsRequest for enhanced component identification Replaces the deprecated GetComponentContributors method](https://docs.scanoss.com/api-reference/geoprovenance/get-component-level-geo-provenance-based-on-contributor-declared-locationthis-is-the-current-method-that-accepts-componentsrequest-for-enhanced-component-identificationreplaces-the-deprecated-getcomponentcontributors-method.md) - [Standard health check endpoint to verify service availability and connectivity](https://docs.scanoss.com/api-reference/geoprovenance/standard-health-check-endpoint-to-verify-service-availability-and-connectivity.md) - [[DEPRECATED] Get component-level Geo Provenance by contributor origin commit times](https://docs.scanoss.com/api-reference/geoprovenance/[deprecated]-get-component-level-geo-provenance-by-contributor-origin-commit-times.md) - [Get component-level Geo Provenance based on contributor origin commit times This is the current method that accepts ComponentRequest for enhanced component identification Replaces the deprecated GetComponentOrigin method](https://docs.scanoss.com/api-reference/geoprovenance/get-component-level-geo-provenance-based-on-contributor-origin-commit-timesthis-is-the-current-method-that-accepts-componentrequest-for-enhanced-component-identificationreplaces-the-deprecated-getcomponentorigin-method.md) - [Get component-level Geo Provenance based on contributor origin commit times This is the current method that accepts ComponentsRequest for enhanced component identification Replaces the deprecated GetComponentOrigin method](https://docs.scanoss.com/api-reference/geoprovenance/get-component-level-geo-provenance-based-on-contributor-origin-commit-timesthis-is-the-current-method-that-accepts-componentsrequest-for-enhanced-component-identificationreplaces-the-deprecated-getcomponentorigin-method.md) - [Get license information for a single software component.](https://docs.scanoss.com/api-reference/license/get-license-information-for-a-single-software-component.md): Examines source code, license files, and package metadata to determine which licenses apply to the component. Returns license data in both individual SPDX license and SPDX expressions when determinable. - [Get license information for multiple software components in a single request.](https://docs.scanoss.com/api-reference/license/get-license-information-for-multiple-software-components-in-a-single-request.md): Examines source code, license files, and package metadata to determine which licenses apply to each component. Returns license data in both individual SPDX license and SPDX expressions when determinable. - [Get detailed metadata for a specific license by SPDX identifier.](https://docs.scanoss.com/api-reference/license/get-detailed-metadata-for-a-specific-license-by-spdx-identifier.md): Provides comprehensive license information including SPDX registry data, OSADL compliance metadata, license type classification, and official references. - [Returns the same message that was sent, used for health checks and connectivity testing](https://docs.scanoss.com/api-reference/license/returns-the-same-message-that-was-sent-used-for-health-checks-and-connectivity-testing.md) - [Get compliance obligations and usage requirements for a specific license.](https://docs.scanoss.com/api-reference/license/get-compliance-obligations-and-usage-requirements-for-a-specific-license.md): Returns structured OSADL compliance data including use cases, obligations, compatibility information, and patent hints for the specified license. - [Standard echo](https://docs.scanoss.com/api-reference/scanning/standard-echo.md) - [Scan the given folder request looking for matches](https://docs.scanoss.com/api-reference/scanning/scan-the-given-folder-request-looking-for-matches.md) - [Standard health check endpoint to verify service availability and connectivity](https://docs.scanoss.com/api-reference/semgrep/standard-health-check-endpoint-to-verify-service-availability-and-connectivity.md) - [Get potential security issues associated with a single component This is the current method that accepts ComponentRequest for enhanced component identification Replaces the deprecated GetIssues method for single component queries](https://docs.scanoss.com/api-reference/semgrep/get-potential-security-issues-associated-with-a-single-componentthis-is-the-current-method-that-accepts-componentrequest-for-enhanced-component-identificationreplaces-the-deprecated-getissues-method-for-single-component-queries.md) - [Get potential security issues associated with multiple components This is the current method that accepts ComponentsRequest for enhanced component identification Replaces the deprecated GetIssues method](https://docs.scanoss.com/api-reference/semgrep/get-potential-security-issues-associated-with-multiple-componentsthis-is-the-current-method-that-accepts-componentsrequest-for-enhanced-component-identificationreplaces-the-deprecated-getissues-method.md) - [Get vulnerability information for a single software component.](https://docs.scanoss.com/api-reference/vulnerabilities/get-vulnerability-information-for-a-single-software-component.md): Analyzes the component and returns known vulnerabilities including CVE details, severity scores, publication dates, and other security metadata. Vulnerability data is sourced from various security databases and feeds. - [Get vulnerability information for multiple software components in a single request.](https://docs.scanoss.com/api-reference/vulnerabilities/get-vulnerability-information-for-multiple-software-components-in-a-single-request.md): Analyzes multiple components and returns known vulnerabilities for each including CVE details, severity scores, publication dates, and other security metadata. Vulnerability data is sourced from various security databases and feeds. - [Get CPEs (Common Platform Enumeration) associated with a single software component.](https://docs.scanoss.com/api-reference/vulnerabilities/get-cpes-common-platform-enumeration-associated-with-a-single-software-component.md): Returns Common Platform Enumeration identifiers that match the specified component. CPEs are used to identify IT platforms in vulnerability databases and enable vulnerability scanning and assessment. - [Get CPEs (Common Platform Enumeration) associated with multiple software components.](https://docs.scanoss.com/api-reference/vulnerabilities/get-cpes-common-platform-enumeration-associated-with-multiple-software-components.md): Returns Common Platform Enumeration identifiers for multiple components in a single request. CPEs are used to identify IT platforms in vulnerability databases and enable vulnerability scanning and assessment. - [Returns the same message that was sent, used for health checks and connectivity testing](https://docs.scanoss.com/api-reference/vulnerabilities/returns-the-same-message-that-was-sent-used-for-health-checks-and-connectivity-testing.md) - [README TEMPLATE](https://docs.scanoss.com/docs-templates/README_TEMPLATE.md) - [[Feature/Topic Name]](https://docs.scanoss.com/docs-templates/scanoss-template.md): Brief description of what this page covers (appears in search results and under the title) - [Commands & Arguments](https://docs.scanoss.com/en/latest/cli/scanoss-cli/commands-and-arguments.md): Complete reference for every SCANOSS-CLI command, subcommand, and flag: wfp, scan, results, sbom, enrich, dependencies, and the decoration commands. - [Configuration](https://docs.scanoss.com/en/latest/cli/scanoss-cli/configuration.md): Store credentials and endpoint settings, understand precedence, and configure proxies, custom CAs, and on-prem endpoints. - [Decoration Commands](https://docs.scanoss.com/en/latest/cli/scanoss-cli/decoration-commands.md): Query vulnerabilities, cryptography, licenses, geoprovenance, copyright, and component data directly from the SCANOSS API. - [Enrich & Dependencies](https://docs.scanoss.com/en/latest/cli/scanoss-cli/enrich-and-dependencies.md): Refresh vulnerability, license, cryptography, and geoprovenance layers on an existing inventory, and extract or query dependencies. - [Installation](https://docs.scanoss.com/en/latest/cli/scanoss-cli/installation.md): Install SCANOSS-CLI via go install, a prebuilt binary, Docker, or by building from source. - [Output Formats & SBOM](https://docs.scanoss.com/en/latest/cli/scanoss-cli/output-formats-and-sbom.md): Generate raw, SPDX, or CycloneDX output, and convert between SBOM formats with the sbom command. - [Overview](https://docs.scanoss.com/en/latest/cli/scanoss-cli/overview.md): [SCANOSS-CLI](https://github.com/scanoss/scanoss.go) is the Go implementation of the SCANOSS command-line tool and SDK, for scanning source code and querying the SCANOSS platform. - [Quick Start](https://docs.scanoss.com/en/latest/cli/scanoss-cli/quick-start.md): Run your first scan, generate fingerprints, and refresh results with SCANOSS-CLI. - [Component Search](https://docs.scanoss.com/en/latest/clients/workbench/api-services/component-search.md) - [Crypto](https://docs.scanoss.com/en/latest/clients/workbench/api-services/crypto.md) - [Dependencies](https://docs.scanoss.com/en/latest/clients/workbench/api-services/dependencies.md) - [Raw Output](https://docs.scanoss.com/en/latest/clients/workbench/api-services/raw-output.md) - [Vulnerabilities](https://docs.scanoss.com/en/latest/clients/workbench/api-services/vulnerabilities.md) - [Downloading the SCANOSS Knowledge Base](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/downloading-knowledge-base.md): Instructions for obtaining and configuring the SCANOSS Knowledge Base for on-premise deployments. - [API Installation](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/installing-from-sources/api-installation.md): This section provides instructions for deploying the [SCANOSS Go API](https://github.com/scanoss/api.go). - [Encoder Library Installation](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/installing-from-sources/encoder-library-installation.md): Complete the Engine installation by adding the `libscanoss_encoder` library to `/usr/lib/`. - [Engine Installation](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/installing-from-sources/engine-installation.md): The [SCANOSS Engine](https://github.com/scanoss/engine) is a command-line tool used to scan files or directories and identify open-source components by comparing them against the SCANOSS knowledge base. - [LDB Installation](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/installing-from-sources/ldb-installation.md): The [LDB](https://github.com/scanoss/ldb) is the underlying database engine for the Knowledge Base (KB) and is required for the [SCANOSS Engine](https://github.com/scanoss/engine) to run. - [KB Test](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/validating-setup/kb-test.md): Step-by-step guide to validate the [SCANOSS Engine](https://github.com/scanoss/engine) and Knowledge Base ([LDB](https://github.com/scanoss/ldb)) in an on-premises installation. - [Scanning Against the LDB Knowledge Base](https://docs.scanoss.com/en/latest/installation/on-prem/deployment-guide/validating-setup/scanning-ldb.md): Examples and instructions for scanning files and components against the SCANOSS LDB (Local Database) Knowledge Base. - [Vulnerability Scanning](https://docs.scanoss.com/en/latest/poc/datasets/security-dataset/vulnerability-scanning.md): In this guide, you will learn how to scan a project for known security vulnerabilities (CVEs) using the [SCANOSS-PY](https://github.com/scanoss/scanoss.py) and the **SCANOSS API**. - [Mermaid diagrams](https://docs.scanoss.com/en/latest/poc/evaluation/images/mermaid-diagrams.md) - [SCANOSS-JS](https://docs.scanoss.com/en/latest/poc/license-dataset/snippet-detection/scanoss-js.md): A comprehensive JavaScript library and CLI tool for Software Composition Analysis. Scan your code for open source components, dependencies and license compliance. - [Authentication](https://docs.scanoss.com/en/latest/sdks/go/authentication.md): How to authenticate the SCANOSS Go SDK with an API key and configure a custom API endpoint. - [Overview](https://docs.scanoss.com/en/latest/sdks/go/overview.md): The SCANOSS Go SDK (pkg/scanoss) is a library for integrating with the SCANOSS API and scanning engine from Go applications. - [Usage](https://docs.scanoss.com/en/latest/sdks/go/usage.md): Using the SCANOSS Go SDK: the decoration pipeline, per-service progress reporting, logging, and scanning from Go code. - [Software](https://docs.scanoss.com/link/software.md) ## OpenAPI Specs - [components-openapi](/api-reference/components-openapi.json) - [cryptography-openapi](/api-reference/cryptography-openapi.json) - [dependencies-openapi](/api-reference/dependencies-openapi.json) - [geoprovenance-openapi](/api-reference/geoprovenance-openapi.json) - [licenses-openapi](/api-reference/licenses-openapi.json) - [scanning-openapi](/api-reference/scanning-openapi.json) - [semgrep-openapi](/api-reference/semgrep-openapi.json) - [vulnerabilities-openapi](/api-reference/vulnerabilities-openapi.json)