Blast Radius / API

One API for npm supply-chain exposure

The same code path the console runs, behind a stable /api/v1 contract. Free forever, no rate limit, no usage cap, no card. Create a key and start calling.

No rate limit No quota No card MIT licensed
OpenAPI Get a key

Your API keys

Keys are shown once and stored only as a SHA-256 digest — a copy of the database yields nothing usable. Revoking takes effect on the very next request.

Quickstart

Every snippet below is filled in with your live host, and with your key if you have one selected.

Call it from anywhere

Try it now

A real request against this instance, using a real key. What comes back here is what comes back to your code.

Playground

ready
Used only by this tab, for this request. Never stored, never sent anywhere but this instance.
request 
select an endpoint
response 
// press "Send request"

Reference

Rendered from the same definition the server routes from, so it cannot drift. Copy the whole thing as plain text or Markdown — the Markdown is written to be pasted straight into an AI agent's context.

Full API reference

Download .md

Also served raw at /api/docs.md, /api/docs.txt and /api/docs.json — point an agent straight at those.

24-hour monitoring

Register a package once and this instance keeps measuring it. When its blast radius moves, an alert lands on your dashboard and on /api/v1/alerts — you do not poll, and you do not run the traversal yourself.

bash 

        

        

          Alerts carry a level — info, notable, high,
          critical — derived from how far the exposure moved, plus the before
          and after counts so you can gate a deploy on the delta rather than on the absolute.
        

      

    


    
    

      
 Errors

      
Every failure carries a machine-readable error code as well
        as prose. There is no 500 without a body.