Guide API

The Guide API provides REST APIs for searching component and vulnerability data

Using a token

To authenticate API requests, you'll need to create a Personal Access Token, tokens are used with Bearer authentication for programmatic access to the API. Manage your tokens to get started.

Bearer Authentication:

curl -H "Authorization: Bearer <your-token>"
  https://api.guide.sonatype.com/users/me

Sonatype Guide API OAS 3.1

REST API for searching component and security vulnerability data.

Servers

https://api.guide.sonatype.com - API Server

Authorize

Usage Credit usage and billing period APIs

GET /usage

Get usage information

GET /usage/ossi-history

Get historical OSSI usage

GET /usage/cumulative

Get cumulative credit usage for a billing period

GET /usage/credit-periods

Get credit periods

Vulnerabilities Vulnerability search and filtering API

GET /vulnerabilities/{id}

Get vulnerability by ID

GET /vulnerabilities/{id}/components

Get affected components for a vulnerability

AGP Dashboard Connected repository status with search, filter & paging

GET /api/agp/dashboard

List connected repositories with status (search, filter & paging)

GET /api/agp/dashboard/onboarding-access

Whether the caller may onboard repositories

GET /api/agp/dashboard/candidate-ids

Ids of all onboarding-candidate repositories matching the name filter

Activity Log Organization activity log APIs

GET /users/me/organization/activity-log

Get organization activity log

AGP Bulk Onboarding Onboard multiple repositories in one operation

POST /api/agp/onboarding/bulk

Start bulk onboarding for selected repositories

GET /api/agp/onboarding/bulk/{jobId}

Get bulk onboarding job progress

GET /api/agp/onboarding/bulk/org-activity

Whether another org member currently has a bulk onboarding job in flight

GET /api/agp/onboarding/bulk/active

Get the caller's currently-running bulk onboarding job, if any

AGP Governance AgentP feature governance: org-level Default Configuration is Owner-only; per-repo config and lifecycle actions are available to any org member

GET /api/agp/repos/{installationRepoId}/config

Get a repo's AgentP config overrides + inherited Default Configuration + version (any org member)

PUT /api/agp/repos/{installationRepoId}/config

Set per-repo AgentP config overrides (any org member)

DELETE /api/agp/repos/{installationRepoId}/config

Reset a repo to the Default Configuration by clearing its config overrides (any org member)

GET /api/agp/org/config

Get the AgentP Default Configuration (read: any org member)

PUT /api/agp/org/config

Set the AgentP Default Configuration + developer-access flag (Owner-only)

POST /api/agp/repos/{installationRepoId}/resume

Resume AgentP for a repository (any org member)

POST /api/agp/repos/{installationRepoId}/removal-pr

Open (and optionally merge) a PR removing the AgentP workflow file from a repository (any org member)

POST /api/agp/repos/{installationRepoId}/pause

Pause AgentP for a repository (any org member)

GET /api/agp/repos/{installationRepoId}/effective-config

Get the rendered effective agp.yml for a repo (defaults + org + overrides) (any org member)

GET /api/agp/org/effective-config

Get the rendered Default Configuration agp.yml (defaults + org) (Owner-only)

GET /api/agp/agentic-mode-access

Whether the caller's org is registered for AgentP agentic mode (org-scoped; gates the AI Fix toggle + AI agent config in the UI)

Current User Tokens Personal Access Token management APIs

GET /users/me/tokens

List all Personal Access Tokens

POST /users/me/tokens

Create a new Personal Access Token

POST /users/me/tokens/{tokenId}/rotate

Rotate a Personal Access Token

GET /users/me/tokens/{tokenId}

Get a Personal Access Token by ID

DELETE /users/me/tokens/{tokenId}

Revoke a Personal Access Token

Components Component search and filtering API

POST /components/latest-version

Get latest version of a component

GET /components/vulnerabilities

Get vulnerabilities for a component by coordinates (query parameters)

GET /components/versions

Get all component versions by coordinates (query parameters)

GET /components/detail

Get component detail by coordinates (query parameters)

GET /components/dependencies

Get dependencies for a component by coordinates (query parameters)

OSS Index Compatibility Legacy OSSI API providing backward compatibility. Allows existing OSSI users to continue using their OSSI API tokens without creating a new Sonatype Guide account. Authentication requires HTTP Basic Auth with OSSI username and API token.

POST /api/v3/component-report

Get component reports for multiple PURLs

POST /api/v3/authorized/component-report

Get component reports for multiple PURLs

GET /api/v3/version

Get API version

GET /api/v3/authorized/component-report/**

Get component report by PURL

GET /api/v3/component-report/**

Get component report by PURL

Billing Billing and subscription management API

GET /billing

Get billing information

GET /billing/plans

Get all available plans

GET /billing/invoices

Get user invoice history

GET /billing/invoices/{invoiceId}/pdf

Download invoice PDF

Current User Organization Current user organization management APIs

GET /users/me/organization

Get current user's organization

PUT /users/me/organization

Update current user's organization

POST /users/me/organization/members/invite

Invite users to current user's organization

POST /users/me/organization/invitations/{invitationToken}/accept

Accept organization invitation

GET /users/me/organization/onboarding-banner

Get onboarding banner status

DELETE /users/me/organization/onboarding-banner

Dismiss onboarding banner

GET /users/me/organization/members

Retrieve current user's organization members and invitees

DELETE /users/me/organization/members

Bulk remove members or invitations from organization

DELETE /users/me/organization/membership

Leave organization

DELETE /users/me/organization/members/{email}

Remove member or invitation from organization

Recommendations Version upgrade recommendation API

POST /recommendations

Get version upgrade recommendations

Retrieves version upgrade recommendations for a component specified by PURL. Analyzes security vulnerabilities, stability metrics, and policy compliance to suggest optimal upgrade paths. Only policy-compliant versions are returned. If policy evaluation fails, the response is BLOCKED_BY_POLICY (fail-closed).

Parameters

No parameters

Request body

application/json

• Example Value
• Schema

RecommendationRequest

Collapse all object

Request body containing the component PURL

• purl

string

• extension

string

• classifier

string

Responses