OSS Index Migration Steps

OSS Index Migration Steps

OSS Index is migrating to Sonatype Guide. This page outlines key dates and the required steps for supported integrations.

Important

Following April 28, 2026, the legacy OSS Index endpoint will begin a phased deprecation process, leading up to its full sunset on December 31, 2026. Users who have not migrated their base URL by this time may experience service disruptions.

OSS Index will transition to Sonatype Guide on April 28, 2026. On that date, the OSS Index endpoint will automatically redirect to the Sonatype Guide API endpoint, and no user action is required for the cutover. To reduce the risk of future disruption and ensure continued compatibility, users are encouraged to review and follow the recommended migration steps outlined below.

Claim a Guide Account

Beginning March 31, 2026, existing OSS Index credentials can be used to sign in to Sonatype Guide.

  1. Go to guide.sonatype.com.

  2. Select Log In on the Guide homepage.

  3. Sign in using the existing OSS Index username and password, or use SSO with the same email address associated with the OSS Index account.

  4. Complete the required fields, including country, company, and acceptance of the Terms and Conditions.

  5. Select Continue.

After signing in, the Guide account is ready for use.

View Historical OSS Index Usage

You can view your historical OSS index usage from your account menu:

  1. Click the account icon in the upper-right corner of the application.

  2. Select the Usage option.

  3. On this page you can review usage statistics, trends and evaluate available plan options.

Using OSS Index with Dependency-Track

Dependency-Track remains compatible with OSS Index through the Sonatype Guide Compatibility API.

Dependency-Track instances running version 4.14.0 or later should update the OSS Index base URL.

Updating the Base URL

  1. Open Dependency-Track.

  2. Navigate to Administration → Analyzers → OSS Index.

  3. Update the Base URL to:

https://api.guide.sonatype.com/
  1. Click Update to apply the change.

A future Dependency-Track release will include the new endpoint as the default configuration. After upgrading to that version, no additional configuration will be required.

Using OSS Index with Dependency-Check

Dependency-Check remains compatible with OSS Index through the Sonatype Guide Compatibility API.

The OSS Index URL should be updated in Dependency-Check configurations. Disabling the OSS Index cache is optional.

CLI

dependency-check \
  --project "My Project" \
  --scan "/path/to/source" \
  --ossIndexUsername "<your-username>" \
  --ossIndexPassword "<your-token>" \
  --ossIndexUrl "https://api.guide.sonatype.com" \
  --disableOssIndexCache

Maven Plugin (pom.xml)

<configuration>
  <ossindexAnalyzerUrl>
    https://api.guide.sonatype.com
  </ossindexAnalyzerUrl>
  <ossIndexAnalyzerUseCache>false</ossIndexAnalyzerUseCache>
</configuration>

Gradle Plugin (build.gradle)

dependencyCheck {
  analyzers.ossIndex.enabled = true
  analyzers.ossIndex.username = System.getenv('OSS_INDEX_USERNAME')
  analyzers.ossIndex.password = System.getenv('OSS_INDEX_PASSWORD')
  analyzers.ossIndex.url = "https://api.guide.sonatype.com"
  cache.ossIndex = false
}

Using Guide Personal Access Tokens with OSS Index API Integrations

Guide Personal Access Tokens (PATs) can be used with OSS Index API integrations as a replacement for legacy OSS Index tokens. For setup details and examples, see Using Guide Personal Access Tokens with OSS Index API Integrations.

Enabling Paid Plan Access for Integration Users

If the email address used by your integration differs from the account used to purchase your Guide Pro or Enterprise plan, your integration will not automatically inherit paid access. You will need to add that email as a member of your organization.

Note

The paid plan belongs to the account that purchased it. Adding users to your organization gives them access to your paid plan, but it does not give you ownership of their paid accounts.

To add a user to your organization, follow these steps:

  1. Sign in to guide.sonatype.com using the account used to purchase your plan.

  2. Click the account icon in the upper-right corner of the application.

  3. Select People, then click Invite.

  4. Enter the email address associated with the user or integration, then click Send Invitation.

  5. The user accepts the invitation and signs in to gain access to your organization’s paid plan.

Other API Integrations

No action is required for other API integrations.

On April 28, 2026, the OSS Index endpoint will automatically cut over to the Sonatype Guide API endpoint.