> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# False positives

> Poll for records OpenSourceMalware has determined are false positives, including retracted OSV advisories.

The `false-positive` endpoint returns two kinds of records:

* **Reclassifications:** Records that were originally classified by OpenSourceMalware as malicious but were subsequently determined by an admin to be false positives, or were retracted by the source feed (e.g. OSV). Where a withdrawal matches an OpenSourceMalware threat record, it's merged into that threat's entry rather than listed twice.
* **Rejections:** Submissions that OpenSourceMalware rejected, meaning they were never added to the verified findings feed, because they were determined to be false positives.

Both types surface as `source: "threat"` items with the same shape. The `false_positive.rejection_reason` and `rejection_note` fields explain why a given item was marked a false positive, whether it had previously been verified as malicious or was rejected before ever reaching that status. Upstream withdrawals that don't match any existing OpenSourceMalware threat record appear separately as `source: "osv_withdrawal"` items.

<Note>
  Subscription Required: This is a paid endpoint.
</Note>

Use this endpoint to:

* **Retract stale alerts and blocks:** If a package you already flagged, whether pulled from `threat-feed`'s verified threats or from unverified submissions, later appears here as a false positive, close the alert or lift the block automatically instead of waiting for someone to notice.
* **Audit other feeds you're consuming:** Cross-reference entries from other vendors' threat feeds against this endpoint. If another feed still lists something OpenSourceMalware has confirmed benign, that's evidence to raise with the vendor.
* **Turn silence into a signal:** When OpenSourceMalware doesn't flag something another feed does, this endpoint tells you whether that's because OpenSourceMalware reviewed it and rejected it as benign (it'll show up here), or because OpenSourceMalware hasn't looked at it yet (it won't appear anywhere).
* **Pick up upstream retractions:** Catch OSV advisories withdrawn at the source, even for packages OpenSourceMalware never carried a matching threat record for.

<Tip>
  If a package shows up in another vendor's threat feed but also appears here with `source: "threat"`, that's confirmation OpenSourceMalware reviewed it and rejected it as benign. Surface that context next to the other feed's alert instead of treating OpenSourceMalware's silence as a miss.
</Tip>

**Endpoint**

```text theme={null}
GET https://api.opensourcemalware.com/functions/v1/false-positive
```

**Required header**

```text theme={null}
Authorization: Bearer osm_your_token
```

## Query parameters

| Parameter | Type    | Default | Description                                 |
| --------- | ------- | ------- | ------------------------------------------- |
| `limit`   | integer | 100     | Max items to return (1-100)                 |
| `source`  | string  | — all   | Filter to `threat` or `osv_withdrawal` only |

<Note>
  Unlike `threat-feed`, this endpoint isn't scoped by `ecosystem`. Results span every ecosystem and asset type OpenSourceMalware tracks, so there's no need to loop over ecosystems to get full coverage.
</Note>

## Response example

### Success (200)

```json theme={null}
{
  "count": 2,
  "limit": 100,
  "sources": { "threats": 1, "osv_withdrawals": 1 },
  "items": [
    {
      "source": "threat",
      "id": "…",
      "package_name": "example-pkg",
      "registry": "npm",
      "marked_at": "2026-09-19T08:12:00Z",
      "false_positive": {
        "rejection_reason": "confirmed_benign",
        "rejection_note": "Reviewed. Research PoC, no payload.",
        "osv_withdrawn": true,
        "osv_ids": ["OSV-2026-1234"]
      }
    },
    {
      "source": "osv_withdrawal",
      "osv_id": "OSV-2026-9999",
      "ecosystem": "PyPI",
      "package_name": "other-pkg",
      "marked_at": "2026-09-18T14:00:00Z"
    }
  ]
}
```

Items are sorted by `marked_at` descending: for `threat` items, when the status was changed to `false_positive`; for `osv_withdrawal` items, the OSV withdrawal date.

### Item shape by source

* **`threat`** items cover both reclassifications and rejections. They carry `package_name`, `registry`, and a `false_positive` object with `rejection_reason` and `rejection_note` explaining the determination. If the same correction also involved an upstream OSV withdrawal, `osv_withdrawn` and `osv_ids` are included. There's no separate field distinguishing a reclassification from a rejection; read `rejection_reason` and `rejection_note` to tell which kind of record you're looking at.
* **`osv_withdrawal`** items are upstream OSV advisories withdrawn with no corresponding OpenSourceMalware threat record. They carry `osv_id` and `ecosystem` instead of `registry`, and have no `false_positive` object.

## Matching items to your own feeds

When cross-referencing an entry from another feed against this endpoint:

1. **Match on identifier first.** If the other feed carries an OSV, GHSA, or CVE id, compare it against `false_positive.osv_ids` (for `source: "threat"` items) or `osv_id` (for `source: "osv_withdrawal"` items). This is more precise than name matching and avoids collisions across ecosystems.
2. **Fall back to package name and ecosystem.** If no id is available, match on `package_name` plus the ecosystem field, noting that the field is named `registry` on `threat` items and `ecosystem` on `osv_withdrawal` items.

## Errors

| Status | Meaning                                  |
| ------ | ---------------------------------------- |
| 401    | Missing or invalid API token             |
| 403    | Token tier doesn't include this endpoint |
| 429    | Rate limit exceeded                      |

## cURL examples

Poll for the latest false positives:

```text theme={null}
curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive"
```

Only reclassifications and rejections from OpenSourceMalware's own findings:

```text theme={null}
curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?source=threat"
```

Only advisories withdrawn upstream in OSV:

```text theme={null}
curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?source=osv_withdrawal"
```

<Tip>
  If a package shows up in another vendor's threat feed but also appears here with `source: "threat"`, that's not a gap in OpenSourceMalware's coverage, it's confirmation OpenSourceMalware reviewed it and rejected it as benign. Surface that context next to the other feed's alert instead of treating OpenSourceMalware's silence as a miss.
</Tip>