Skip to main content
To follow this guide you need a SafeDep Cloud API Key and Tenant Identifier. See Cloud Quickstart on how to onboard to SafeDep Cloud and get an API key.
This guide queries the SafeDep Insights API v2 for open-source package security metadata using TypeScript. Any language supported by the API SDK follows the same pattern.

Project Setup

Initialize TypeScript Project

Create a new TypeScript project:

Configure Buf Registry

Configure npm to use the Buf Registry for SafeDep API SDKs:

Install SafeDep API SDKs

Install the required libraries:

Authentication Setup

Environment Variables

Set your SafeDep Cloud credentials:
Never hardcode API keys in your source code. Always use environment variables or secure configuration management.

Implementation

Import Dependencies

Set up the necessary imports for ConnectRPC client and SafeDep services. The exact import paths and client constructor track the connect-es version of the generated SDK, so validate them against the version you install:

Authentication Interceptor

This interceptor adds authentication headers to each request:

Main Application Logic

Query package insights with the main function:

API Reference

For request and response schemas, see the Insights v2 API Specification.

Available Ecosystems

Supported package ecosystems:
  • NPM - Node.js packages
  • PYPI - Python packages
  • MAVEN - Java/JVM packages
  • CARGO - Rust packages
  • NUGET - .NET packages

Response Data

The response includes:
  • Vulnerabilities: Known security vulnerabilities
  • Licenses: License information and compliance data
  • Scorecard: OpenSSF Scorecard metrics
  • Malware: Malware detection results
  • Metadata: Package information and statistics

API Documentation

Complete API specification and schema documentation

SDK Support

SDKs available for multiple programming languages

SafeDep Cloud

Get started with SafeDep Cloud and API access

ConnectRPC

Learn more about the ConnectRPC framework