Magebean API Reference

Summary

Magebean CLI is offline-first. Security checks run locally. The API provides vulnerability data and lookup endpoints; a normal local scan does not upload Magento project content or scan output.

Endpoint index

The existence of a POST endpoint does not mean Magebean CLI calls it during a normal local scan.

Common conventions

Clients should send Accept: application/json. Requests containing JSON should also send Content-Type: application/json.

Base URL: https://api.magebean.com
Accept: application/json
Content-Type: application/json

The read-only routes are publicly addressable. Integrations must not assume ingestion routes are anonymous; their deployed authorization policy still applies.

Like any HTTPS service, the server or infrastructure can observe ordinary connection metadata: public source IP, request time and path, TLS/HTTP metadata, and a User-Agent header when supplied. This is not Magento scan content.

Read-only endpoints

GET /health

Checks service availability. Request body: none.

curl --fail-with-body https://api.magebean.com/health

GET /latest-cves

Legacy route for the latest CVE definitions. Request body: none.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/latest-cves

GET /v1/latest-cves

Versioned route for the latest CVE definitions. The definitions are downloaded for local matching; the request does not need a package list, composer.lock, configuration, or scan results.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/latest-cves

GET /v1/stats

Returns aggregate statistics about the Magebean vulnerability dataset. Request body: none.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/stats

GET /v1/packages/{vendor}/{package}

Returns vulnerability information for a Composer package. The package identifier in the URL is visible to the API; local package files, installed version, and scan results are not implied by this lookup.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/packages/magento/product-community-edition

Clients must URL-encode path segments.

GET /v1/cves/{cve}

Returns information for a public CVE identifier.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/cves/CVE-2024-34102

GET /v1/vulns/{id}

Returns a vulnerability using its Magebean dataset identifier.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/vulns/ID

GET /v1/bundles/latest

Returns the latest generated vulnerability bundle. Request body: none. Clients should honor the response Content-Type rather than assuming a media type.

curl --fail-with-body \
  https://api.magebean.com/v1/bundles/latest

GET /v1/uncovered-packages

Returns package entries recorded as not covered by the vulnerability dataset. Calling this route does not upload the caller's package inventory.

curl --fail-with-body \
  --header 'Accept: application/json' \
  https://api.magebean.com/v1/uncovered-packages

POST endpoints

These endpoints are not scan-upload endpoints and are not needed to download the CVE feed. Callers must follow the deployed payload and authorization contract.

POST /v1/osv/advisories

Accepts OSV advisory data for an ingestion or integration workflow. Magento project data must not be submitted here.

POST /v1/osv/advisories HTTP/1.1
Host: api.magebean.com
Accept: application/json
Content-Type: application/json

{ ... OSV advisory payload ... }

POST /v1/adobe/security-patches

Accepts Adobe security-patch data for an ingestion or integration workflow.

POST /v1/adobe/security-patches HTTP/1.1
Host: api.magebean.com
Accept: application/json
Content-Type: application/json

{ ... Adobe security-patch payload ... }

POST /v1/packages/status

Checks coverage for package identifiers supplied by the caller. Unlike bodyless GET routes, this endpoint sends the package values placed in its request body.

POST /v1/packages/status HTTP/1.1
Host: api.magebean.com
Accept: application/json
Content-Type: application/json

{ ... package-status request ... }

Only explicitly submitted fields are application data sent to Magebean. Clients should minimize the payload and must not include composer.lock, credentials, source code, store data, or scan evidence unless a future published contract requires it.

The exact JSON fields and validation constraints are not guessed here. They should be copied from the deployed handler or a published OpenAPI schema before third-party integration.

Error handling

Clients should primarily handle HTTP statuses until a formal error response schema is published.

Magebean CLI data disclosure

The bodyless CVE download sends the method, endpoint path, ordinary headers, and unavoidable network metadata. It does not send:

Package discovery, rules, and CVE matching run locally.