API & Custom Integrations

To use CI/CD Scanning or integrate with many of FOSSA's services, you must provision API tokens.

API Tokens

FOSSA allows users to create API tokens to access the API.

To create a token, visit your Account Settings:

To use the API token for fossa-cli or many of our client integrations, you must set the FOSSA_API_KEY environment variable or pass it directly to the tool/integration.

To authenticate and access our API, include an Authorization header in the request:

curl -H "Authorization: Bearer <token>" "https://app.fossa.com/<API endpoint>"

API Reference for Custom Integrations

FOSSA provides an API to access one of the largest databases of open source projects and metadata in the world. Currently, our registry hosts data on over 23 million components totaling beyond 5TB of data.

In addition, our service offers API endpoints by which you can programmatically fetch data about your project and our analysis of it to automate parts of your workflow including:

CI tasks
Dependency management scripts
Generate custom documents or reports

Or any custom feature that operates on your code/dependencies. In fact, all FOSSA itself is built off of our own API.

FOSSA API Documentation can be accessed here.

Please contact [email protected] if you'd like to learn more.

Push Only API Token

Creating a push only API token restricts the users access to only allow uploading builds. The API token will be restricted from reading anything about the project or editing existing information.

This token was created with open source project maintainers in mind. The FOSSA API key is required to be set as an environment variable or included in the configuration file whenever integrating FOSSA with a CI system, such as TravisCI. This has the unfortunate side effect of exposing the API key to anyone who makes a pull request. Restricting a user's access with a push only API token is the best way to combat any malicious actors. The steps to create one are as follows:

Navigate to your API Tokens Page.
Click the "Edit" button next to the API Token you wish to change to bring up the view below.

Check the box next to "Push Only" and scroll down to click "Confirm".

Try it out! Try running FOSSA_API_KEY=<push_only_token> fossa report licenses to see what happens when you attempt to access restricted information.