SafeDep Documentation

This quickstart uses plain JSON over HTTP with curl.

Before you begin

You need three things before your first request:

You need	What it is
Threat Intel Feed Add-On	Enabled on your account.
An API key	Your data-plane key, created at app.safedep.io/settings/api-keys.
Your tenant domain	For example `your-company.safedep.io`.

Run your first query

Set your credentials

export SAFEDEP_API_KEY="<your-api-key>"
export SAFEDEP_TENANT_ID="your-company.safedep.io"

# Base URL of the service.
export TI="https://api.safedep.io/safedep.services.threatintel.v1.ThreatIntelService"

Put the API key in Authorization as-is, with no Bearer prefix. Put your tenant domain in X-Tenant-ID.

List the five most recent reports

curl -sS "$TI/ListPackageReports" \
  -H "Content-Type: application/json" \
  -H "Authorization: $SAFEDEP_API_KEY" \
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING"}}'

Read the response

You get an array of reports and a pagination cursor:

{
  "packageReports": [
    {
      "reportId": "01JZ8Q9V6K3S2M7C1B0A4E5F6G",
      "verdict": "THREAT_VERDICT_MALICIOUS",
      "confidence": "THREAT_CONFIDENCE_HUMAN_VERIFIED",
      "title": "Credential stealer in npm package express-logger-pro",
      "summary": "Package exfiltrates environment variables to a remote host on install.",
      "ecosystem": "ECOSYSTEM_NPM",
      "publishedAt": "2026-08-12T09:14:02Z",
      "updatedAt": "2026-08-12T10:01:44Z",
      "verifiedAt": "2026-08-12T10:01:44Z",
      "package": {
        "purl": "pkg:npm/[email protected]",
        "name": "express-logger-pro",
        "versions": ["9.9.9"]
      },
      "iocs": [
        {"type": "INDICATOR_TYPE_C2_DOMAIN", "value": "exfil.example.com"},
        {"type": "INDICATOR_TYPE_FILE_SHA256", "value": "3b1f0c9a...c2a9"}
      ],
      "campaigns": [
        {"campaignId": "01JZ8QC0N2W5R8T3Y6U9I1O4P7", "name": "npm crypto-stealer wave"}
      ]
    }
  ],
  "pagination": {"nextPageToken": "eyJhdCI6IjIwMjYtMDgtMTJ..."}
}

A report that is only suspected omits verifiedAt:

{
  "reportId": "01JZ8QB4H7X2K9M0C3B1A5E6F8",
  "verdict": "THREAT_VERDICT_SUSPICIOUS",
  "confidence": "THREAT_CONFIDENCE_AUTOMATED",
  "title": "Suspected malicious package quick-utils-x",
  "summary": "Install script fetches and runs a remote payload.",
  "ecosystem": "ECOSYSTEM_PYPI",
  "publishedAt": "2026-08-12T11:02:10Z",
  "updatedAt": "2026-08-12T11:02:10Z",
  "package": {"purl": "pkg:pypi/[email protected]", "name": "quick-utils-x", "versions": ["0.0.7"]}
}

The API omits empty and default fields. A suspicious report has no verifiedAt. A non-withdrawn report has no withdrawn field, so treat a missing withdrawn as false. A report with no indicators has no iocs.

Get the next page

Pass the nextPageToken back as pageToken:

curl -sS "$TI/ListPackageReports" \
  -H "Content-Type: application/json" \
  -H "Authorization: $SAFEDEP_API_KEY" \
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING","pageToken":"<nextPageToken>"}}'

Repeat until nextPageToken comes back empty.

Next steps

Pagination & sync

Turn this loop into a local mirror that stays current.

Package reports

Filter by ecosystem, verdict, and time, and fetch a single report.

Recipes

Mirror the feed, poll for new malicious packages, expand a campaign.

Connecting

Transport, headers, and JSON conventions in full.

Getting Started

Consuming the Feed

Reference

Quickstart

Before you begin

Run your first query

Next steps

Pagination & sync

Package reports

Recipes

Connecting

​Before you begin

​Run your first query

​Next steps

Pagination & sync

Package reports

Recipes

Connecting

Before you begin

Run your first query

Next steps