Skip to main content
SafeDep supports a gRPC API with a ConnectRPC facade allowing clients to use both gRPC over HTTP/2 and JSON over HTTP/1.1 based clients. The canonical API specification lives at buf.build/safedep/api, which also publishes generated SDKs for all supported languages.

​
Planes and authentication

  • Control plane APIs (cloud.safedep.io, e.g. creating policy) require OAuth 2.0 authentication (JWT).
  • Data plane APIs (api.safedep.io, e.g. package insights) accept API keys or JWTs.
Control plane APIs are for management tooling; data plane APIs are for security tools that use or integrate with SafeDep. For tool-level login flows (safedep CLI, vet, CI/CD), see the authentication guide.

​
Request headers

Regardless of transport (gRPC over HTTP/2 or JSON over HTTP/1.1), requests carry the same two headers:

​
OAuth2 / OIDC

The SafeDep Cloud Identity Service at https://auth.safedep.io provides OAuth2/OIDC authentication for the control plane. OpenID configuration endpoint:
Command-line tools authenticate with the OAuth2 Device Code flow. A reference implementation is available in the vet OAuth2 client.

​
Rate limiting

SafeDep Cloud enforces rate limits at the API gateway, measured per second, with no hourly quota:
  • Data plane (api.safedep.io): up to 500 requests/second per API key
  • Management API: up to 20 requests/second
These limits are subject to change.

Authentication

API key and OAuth/JWT authentication for the safedep CLI, vet, and CI/CD.

API Hosts

Control plane, data plane, and other SafeDep hosts.

Insights API with TypeScript

Query package insights from a TypeScript client.

SafeDep Cloud SQL

Query your tenant data with SQL.