---
title: "Request vulnerabilities related to a list of PURLs"
method: POST
path: "/purls"
tags: ["endpoints"]
---

# Request vulnerabilities related to a list of PURLs

`POST /purls`

## Request

- Base URL: `https://api.vulncheck.com/v3`
- URL: `https://api.vulncheck.com/v3/purls`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/vulncheck/apis/vulncheck-api/docs/purls/post.ts> (a function with typed inputs; its response is checked against the schema)

Accepts a JSON array of PURLs in the request body and returns a list of vulnerabilities

## Request body

- string[]

## Response `200`

OK

- RenderResponseWithMetadataV3controllersPurlsResponseDataV3controllersPurlsResponseMetadata
  - `_benchmark` number: Benchmark is the server-side processing time for the request in seconds. Example: 0.122322 = approximately 122 milliseconds
  - `_meta` V3controllersPurlsResponseMetadata: Meta is the metadata related to the endpoint response
    - `timestamp` string: time of the transaction
    - `total_documents` integer: number of results found
    - `total_submitted` integer: number of purls in the request
    - `unprocessed` PurlUnprocessedPurl[]: Unprocessed lists purls we could not look up. Not inferable from the counts above: purls with no vulnerabilities are omitted from data too.
      - `purl` string: The purl exactly as submitted.
      - `reason` string: Why this purl was not looked up. One of: "unsupported_type" (a valid purl for an ecosystem VulnCheck does not index), "unparseable" (not a valid purl), "unsupported_distro" (a distro-scoped purl whose distro qualifier is missing or unrecognised, e.g. pkg:deb/debian/curl with no distro=). Treat this as an open set: further values may be added.
  - `data` PurlBatchVulnFinding[]: Data is the data returned by the endpoint
    - `cves` string[]: list of associated CVE 's
    - `purl` string: the purl, ex. hex/coherence@0.1.2
    - `purl_struct` PurlPackageURLJSON: meta-data about the purl
      - `name` string
      - `namespace` string
      - `qualifiers` PurlQualifierJSON[]
        - `key` string
        - `value` string
      - `subpath` string
      - `type` string
      - `version` string
    - `research_attributes` ApiOSSPackageResearchAttributes
      - `abandoned` boolean
      - `eol` boolean
      - `is_malicious` boolean
      - `malicious_source` string
      - `repo_hijackable` boolean
      - `squatted_package` string
    - `vulnerabilities` ApiOSSPackageVulnerability[]: list of associated vulnerabilities
      - `detection` string
      - `fixed_version` string

## Other responses

- `400`: Bad Request
- `404`: Not Found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/vulncheck/apis/vulncheck-api.md) - [All operations](https://skmtc.dev/vulncheck/apis/vulncheck-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulncheck/apis/vulncheck-api/revisions/7c714606affe?raw)