OSV API Consumer Data Collection Query

[cbatesCAPGEM]

Hi,

I've been considering the usage of OSV's API for a proposal, but i need to fully understand exactly what data (if any) is extracted / collected from a consumer of the API i.e. a consumers IP address etc.

If anyone could assist with that it would be greatly appreciated.

Thanks,
Callum

[jess-lowe]

Hi Callum,

Our infrastructure is set up on Google Cloud Run, which automatically logs standard telemetry data from the HTTP request like:

• The request method (e.g., GET, POST)
• The exact endpoint URL path requested
• The HTTP response status code (e.g., 200, 404, 500)
• The request and response payload sizes (in bytes)
• The user agent (e.g., browser or client type)
• The IP address of the client that made the request.

The only bespoke logs we add is logging the ecosystem the query + querybatch is for. You can see what's logged in server.py. We don't use this data for anything beyond debugging issues.

If you are concerned about any of these, our data dumps include no logs, and are essentially an offline alternative. The only limiting factor there is that the API includes the matching logic and data for Git records that otherwise can't really be added in the record dumps themselves. OSV-Scanner has the matching logic in offline mode, but doesn't have the data for Git based matching either when offline.

We have discussed making it easier to spin up a local version of the API, with a matching interface, but it's currently on the back burner until we can gauge more interest. So let us know if that would be something of interest to you.

Hope this helps!