API & Custom Integrations

To use CI/CD Scanning or integrate with many of FOSSA's services, you must provision API tokens.

API Tokens

FOSSA allows users to create API tokens to access the API.

To create a token, visit your Account Settings:

To use the API token for fossa-cli or many of our client integrations, you must set the FOSSA_API_KEY environment variable or pass it directly to the tool/integration.

To authenticate and access our API, include an Authorization header in the request:

curl -H "Authorization: Bearer <token>" "https://app.fossa.com/<API endpoint>"

📘

API Tokens are displayed one time, upon creation. Please copy and store your token securely. It will never be displayed again

Push Only API Token

Creating a push only API token restricts the users access to only allow uploading builds. The API token will be restricted from reading anything about the project or editing existing information.

This token was created with open source project maintainers in mind. The FOSSA API key is required to be set as an environment variable or included in the configuration file whenever integrating FOSSA with a CI system, such as TravisCI. This has the unfortunate side effect of exposing the API key to anyone who makes a pull request. Restricting a user's access with a push only API token is the best way to combat any malicious actors. The steps to create one are as follows:

1. Navigate to your API Tokens Page.
2. Click the "Edit" button, within the action menu, next to the API Token you wish to change to bring up the view below.

3. Check the box next to "Push Only" and scroll down to click "Confirm".

Try it out! Try running FOSSA_API_KEY=<push_only_token> fossa report licenses to see what happens when you attempt to access restricted information.

Custom Integrations - REST API

FOSSA API Documentation

The FOSSA API is available for enterprise customers to build custom integrations.

FOSSA provides an API to access one of the largest databases of open source projects and metadata in the world. Currently, our registry hosts data on over 23 million components totaling beyond 5TB of data.

In addition, our service offers API endpoints by which you can programmatically fetch data about your project and our analysis of it to automate parts of your workflow including:

• CI tasks
• Dependency management scripts
• Generate custom documents or reports
• Or any custom feature that operates on your code/dependencies.

Contact [email protected] for more information.