- the five read endpoints:
check-malicious,query-latest,threat-feed,threat-data,query-by-username - the two write endpoints:
submit-threat-report,modify-threat-report
A
CORS OPTIONS preflight request returns 204 or 200 — this is expected browser behavior, not an error.Quick reference
Shared errors — read endpoints
These are returned by every read endpoint (check-malicious, query-latest, threat-feed, threat-data, query-by-username). Wording and status are identical unless noted per endpoint below.
405 — Method not allowed
query-by-username variant: "Method not allowed. Use GET."429 — IP rate limit (500 req / 15 min per IP)
429 — Token rate limit (per-minute, tier-scoped)
429 — Daily quota exceeded
threat-feed and query-by-username omit the trailing "Upgrade to Pro for higher limits." sentence but keep the same fields.500 — Internal server error
check-malicious
401 — Missing API token
401 — Invalid or inactive token
400 — Invalid or missing report_type
400 — Missing resource_identifier
400 — Invalid repository format
500 — Database query failed
query-latest
401 — Missing API token
401 — Invalid token
401 — Inactive token
400 — Missing ecosystem
500 — Query failed
threat-feed
401 — Missing API token
401 — Invalid token
401 — Inactive token
403 — Endpoint requires Core/Pro/Enterprise
403 — unverified=true requires Pro/Enterprise
400 — Invalid hours
400 — Missing ecosystem
500 — Query failed
threat-data
401 — Missing API token
401 — Invalid or inactive token
403 — Requires Pro/Editor/Admin
400 — Missing threat_id
400 — Invalid UUID
404 — Not found or not verified/modified
query-by-username
401 — Missing API token
401 — Invalid token
401 — Inactive token
403 — Requires Pro/Enterprise
400 — Missing params
500 — Failed to verify permissions
500 — Database query failed
Write endpoints
submit-threat-report and modify-threat-report rate limits are per-hour (submission/modification counts) rather than per-minute.
submit-threat-report
401 — No Authorization header
401 — Invalid API token (osm_...)
429 — IP rate limit
429 — Submission rate limit (per hour)
10/hour for Free users. Limit may be increased by an admin.
403 — New-user unverified cap
405 — Method not allowed
400 — Missing required fields
409 — Duplicate package in registry
500 — Existing-package lookup failed
500 — Threat insert failed
500 — Threat details insert failed (threat was rolled back)
500 — Catch-all
modify-threat-report
401 — No Authorization header
401 — Invalid API token
429 — IP rate limit (whitelisted IPs bypass)
429 — Modification rate limit (per hour)
30/hour for standard users. This limit may be increased by an admin.

