> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OSV.dev

> Reference for the Tracecat OSV.dev integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get vulnerability

Action ID: `tools.osv.get_vulnerability`

Get a vulnerability. Calls GET /v1/vulns/\{vulnerability\_id} directly.

Reference: [https://google.github.io/osv.dev/get-v1-vulns/](https://google.github.io/osv.dev/get-v1-vulns/)

### Input fields

<ParamField path="vulnerability_id" type="string" required>
  OSV vulnerability identifier.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the OSV.dev API.

  Default: `null`.
</ParamField>

## Query vulnerabilities

Action ID: `tools.osv.query_vulnerabilities`

Query vulnerabilities. Calls POST /v1/query directly with an OSV API-native payload.

Reference: [https://google.github.io/osv.dev/post-v1-query/](https://google.github.io/osv.dev/post-v1-query/)

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the OSV.dev API.

  Default: `null`.
</ParamField>

<ParamField path="commit" type="string | null">
  The commit hash to query for. If specified, version should not be set.

  Default: `null`.
</ParamField>

<ParamField path="ecosystem" type="string | null">
  The ecosystem for this package, such as PyPI, npm, Maven, Go, crates.io, NuGet, RubyGems, or GIT.

  Default: `null`.
</ParamField>

<ParamField path="package_name" type="string | null">
  Name of the package. Should match the name used in the package ecosystem. Must be paired with ecosystem and must not be used with purl.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  OSV pagination token from a previous next\_page\_token response.

  Default: `null`.
</ParamField>

<ParamField path="purl" type="string | null">
  The package URL for this package. Must not be used with package\_name or ecosystem.

  Default: `null`.
</ParamField>

<ParamField path="version" type="string | null">
  The version string to query for. A fuzzy match is done against upstream versions. Must not be used with commit or with a versioned purl.

  Default: `null`.
</ParamField>

## Query vulnerabilities batch

Action ID: `tools.osv.query_vulnerabilities_batch`

Query vulnerabilities in a batch. Calls POST /v1/querybatch directly and passes each OSV query through untouched.

Reference: [https://google.github.io/osv.dev/post-v1-querybatch/](https://google.github.io/osv.dev/post-v1-querybatch/)

### Input fields

<ParamField path="queries" type="array[object]" required>
  OSV API-native query objects.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the OSV.dev API.

  Default: `null`.
</ParamField>