{"api":"v1","generated_at":"2026-09-16T03:36:34.238Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/api-preflightstack-com-v1-dependency-preflight-f7ba44","pinned_page":"https://tollindex.com/e/api-preflightstack-com-v1-dependency-preflight-f7ba44/at/2026-09-15T21-20Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-09-15T21:20:12.737Z","snapshot_stamp":"2026-09-15T21-20Z","endpoint":{"slug":"api-preflightstack-com-v1-dependency-preflight-f7ba44","canonical_url":"https://api.preflightstack.com/v1/dependency-preflight","resource":"https://api.preflightstack.com/v1/dependency-preflight","http_method":"POST","type":"http","x402_version":2,"registries":["cdp"],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Evaluate up to 10 exact npm or PyPI package versions in one $0.02 paid batch immediately before installation or an exact-version change. Returns deterministic allow, review, or block guidance with known-vulnerability, lifecycle, declared-license, release-age, and npm install-lifecycle evidence. Reuse a current result for unchanged inputs instead of purchasing a duplicate check for an installation retry.","service_name":"Dependency Preflight","declared_category":null,"declared_tags":["dependency-preflight","package-install","npm","pypi","software-supply-chain"],"route_template":null,"registry_updated":"2026-08-31T06:17:52.877Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"dependency preflight","category":"market-data","first_observed_by_toll":"2026-09-10T19:08:24.178Z","last_observed_by_toll":"2026-09-15T21:20:12.737Z","observation_began":"2026-09-10"},"presence":{"listed_now":true,"first_absent_at":null,"delisting_confirmed_at":null,"events":[{"registry":"cdp","at":"2026-09-10T19:08:24.178Z","event":"listed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.02 USDC","amount_units":0.02,"decimals_known":true,"pay_to":"0x9acdadcec881a63508c0f2CD3A4ae61149cc2500","scheme":"exact"}],"counters":{"observed_at":"2026-09-15T21:20:12.737Z","calls_30d":7,"unique_payers_30d":5,"last_called_at":"2026-08-31T06:17:52.605Z"},"validation":{"latest":{"observed_at":"2026-09-15T07:04:37.457Z","state":"pass","failed_checks":[],"endpoint_http_status":402,"run_id":"daily-2026-09-15"},"uptime":[{"days":7,"observed":5,"passed":5,"ratio":1},{"days":30,"observed":5,"passed":5,"ratio":1},{"days":90,"observed":5,"passed":5,"ratio":1}],"history_90d":[{"observed_at":"2026-09-15T07:04:37.457Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-15","state_changed":false},{"observed_at":"2026-09-14T06:31:00.255Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-14","state_changed":false},{"observed_at":"2026-09-13T06:20:20.554Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-13","state_changed":false},{"observed_at":"2026-09-12T10:29:20.310Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-12","state_changed":false},{"observed_at":"2026-09-11T14:49:34.348Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-11","state_changed":true}]},"seller":{"wallet":"0x9acdadcec881a63508c0f2CD3A4ae61149cc2500","page":"https://tollindex.com/seller/0x9acdadcec881a63508c0f2CD3A4ae61149cc2500","endpoints":3,"hosts":3},"reports":0,"registry_record":{"cdp":[{"tags":["dependency-preflight","package-install","npm","pypi","software-supply-chain"],"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x9acdadcec881a63508c0f2CD3A4ae61149cc2500","amount":"20000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300}],"quality":{"lastCalledAt":"2026-08-31T06:17:52.605Z","l30DaysTotalCalls":7,"l30DaysUniquePayers":5},"resource":"https://api.preflightstack.com/v1/dependency-preflight","extensions":{"bazaar":{"info":{"input":{"body":{"policy":"balanced","packages":[{"name":"lodash","version":"4.17.21"}],"ecosystem":"npm"},"type":"http","method":"POST","bodyType":"json"},"output":{"type":"json","example":{"policy":{"name":"balanced","version":"2026-08-19.2"},"summary":{"allow":0,"block":0,"review":1,"partial":0,"package_count":1},"decision":"review","packages":[{"name":"lodash","install":{"lifecycle_scripts":[]},"license":{"status":"allow","declared":"MIT","normalized":"MIT"},"partial":false,"decision":"review","evidence":[{"url":"https://registry.npmjs.org/lodash","cached":false,"source":"npm","retrieved_at":"2026-08-20T00:00:00.000Z"},{"url":"https://api.osv.dev/v1/query","cached":false,"source":"osv","retrieved_at":"2026-08-20T00:00:00.000Z"}],"findings":[{"code":"KNOWN_VULNERABILITY","level":"review","message":"A known high-severity vulnerability affects the requested version; review a fixed version."}],"ecosystem":"npm","lifecycle":{"yanked":false,"deprecated":false,"latest_version":"4.18.1","latest_release_date":"2026-04-01T21:01:20.458Z","requested_release_date":"2021-02-20T15:42:16.891Z"},"version_exists":true,"vulnerabilities":[{"id":"GHSA-r5fr-rjxr-66jc","url":"https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337"],"summary":"Known code-injection vulnerability in the requested lodash version.","severity":"high","modified_at":"2026-07-08T08:11:11.759560102Z","fixed_versions":["4.18.0"],"upstream_severity":"HIGH"}],"requested_version":"4.17.21"}],"workflow":{"rerun_when":["package_added","exact_version_changed","policy_input_changed","fresh_evidence_required"],"instruction":"Run Dependency Preflight before installing every new dependency and whenever an exact version or policy input changes.","decision_actions":{"allow":"Continue only if the result and its evidence meet the caller's requirements.","block":"Do not install the requested exact version.","review":"Pause installation and review the findings and evidence."},"recommended_trigger":"before_dependency_install","avoid_duplicate_payment":"Reuse an acceptable current result when the ecosystem, package name, exact version, and policy inputs are unchanged."},"request_id":"req_example","limitations":["ALLOW means configured checks completed without a configured finding; it is not a claim that a package is safe.","Known-vulnerability, registry metadata, release-age, declared-license, and npm install-lifecycle preflight only.","PyPI source-build or install-time code execution is not currently analyzed.","Not a security guarantee or legal opinion."],"generated_at":"2026-01-01T00:00:00.000Z"}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["ecosystem","packages"],"properties":{"policy":{"enum":["balanced"],"type":"string","default":"balanced","description":"Optional; balanced is the only version-one policy."},"packages":{"type":"array","items":{"type":"object","required":["name","version"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1,"description":"Registry package name."},"version":{"type":"string","maxLength":128,"minLength":1,"description":"Exact version only; ranges and tags are rejected. npm may include an optional leading v."}},"additionalProperties":false},"maxItems":10,"minItems":1,"description":"Exact package names and versions to evaluate as one paid batch."},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"One package ecosystem per request."},"license_denylist":{"type":"array","items":{"type":"string"},"maxItems":50,"description":"Optional individual SPDX-style license identifiers to block.","uniqueItems":true},"license_allowlist":{"type":"array","items":{"type":"string"},"maxItems":50,"description":"Optional individual SPDX-style license identifiers to allow.","uniqueItems":true}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["request_id","decision","policy","summary","packages","workflow","limitations","generated_at"],"properties":{"policy":{"type":"object"},"summary":{"type":"object"},"decision":{"enum":["allow","review","block"],"type":"string"},"packages":{"type":"array","items":{"type":"object"},"maxItems":10,"minItems":1},"workflow":{"type":"object","required":["recommended_trigger","instruction","decision_actions","rerun_when","avoid_duplicate_payment"],"properties":{"rerun_when":{"type":"array","items":{"enum":["package_added","exact_version_changed","policy_input_changed","fresh_evidence_required"],"type":"string"},"uniqueItems":true},"instruction":{"type":"string"},"decision_actions":{"type":"object","required":["allow","review","block"],"properties":{"allow":{"type":"string"},"block":{"type":"string"},"review":{"type":"string"}},"additionalProperties":false},"recommended_trigger":{"const":"before_dependency_install"},"avoid_duplicate_payment":{"type":"string"}},"additionalProperties":false},"request_id":{"type":"string"},"limitations":{"type":"array","items":{"type":"string"}},"generated_at":{"type":"string","description":"ISO 8601 generation timestamp."}},"additionalProperties":false}}}}}}},"description":"Evaluate up to 10 exact npm or PyPI package versions in one $0.02 paid batch immediately before installation or an exact-version change. Returns deterministic allow, review, or block guidance with known-vulnerability, lifecycle, declared-license, release-age, and npm install-lifecycle evidence. Reuse a current result for unchanged inputs instead of purchasing a duplicate check for an installation retry.","lastUpdated":"2026-08-31T06:17:52.877Z","serviceName":"Dependency Preflight","x402Version":2}]}}