Skip to content
QuenchWorks

API · v1

JSON API

imageschartscveswolficosignmultiarchartifacthublicense

A free, read-only JSON API over the catalog. It is prerendered as static JSON (the dataset is small and the site is static), so it is fast, cacheable, and needs no key. Base path /api/v1.

Prefer to test it in the browser? Open the interactive API reference and use “Try it out”. Open the API reference →

Collections

Each resource returns its full list under a small envelope.

{
  "apiVersion": "v1",
  "resource": "images",
  "total": 195,
  "data": [ /* every item */ ]
}

Pagination

Pages are prerendered at 24 items each, so the page number lives in the path (not a ?page query). Each page carries meta + links.

GET /api/v1/{resource}/{page}.json

{
  "apiVersion": "v1", "resource": "images",
  "page": 2, "perPage": 24, "total": 195, "totalPages": 9,
  "links": { "self": "…/2.json", "first": "…/1.json", "last": "…/9.json", "next": "…/3.json", "collection": "/api/v1/images.json" },
  "data": [ /* this page */ ]
}

Security

Live CVE counts from the ArtifactHub Trivy scan of each chart-pinned image digest, refreshed every deploy. The summary gives the catalog total + a severity rollup; every images/charts item also carries a per-item security object (225 open CVEs catalog-wide right now).

GET /api/v1/security.json

{
  "apiVersion": "v1", "resource": "security",
  "total": 225,
  "bySeverity": { "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0 },
  "imagesWithCves": 0,
  "images": { "<name>": { "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0 } }
}

# per-item too: each images/charts entry gains a "security" field
curl https://quench-works.com/api/v1/images.json | jq '.data[] | {slug, security}'

For what each issue actually is, ask per image: the detail endpoints carry the deduped CVE list (id, severity, package, installed and fixed version, title, advisory URL, affected targets) for the latest version and for every published version. The rollup above stays counts-only and links to them with an href.

{
  "apiVersion": "v1", "resource": "security",
  "slug": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager",
  "latest": {
    "version": "0.33.1", "total": 0, "fixable": 0, "grade": "A+", "score": 100,
    "cves": [ { "id": "CVE-0000-0000", "severity": "HIGH", "pkg": "…", "installed": "…",
                "fixed": "…", "title": "…", "url": "…", "targets": [ "…" ] } ]
  },
  "versions": [ /* the same shape per published version */ ]
}

Status badges

shields.io endpoint badges, for any README. Live (shields fetches them on render; they refresh each deploy). Style, logo, and colors ship in the endpoint payload, so the for-the-badge look below renders with no extra query params:

![images](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/images.json)
![charts](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/charts.json)
![cves](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/cves.json)
![wolfi](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/wolfi.json)
![cosign](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/cosign.json)
![multiarch](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/multiarch.json)
![artifacthub](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/artifacthub.json)
![license](https://img.shields.io/endpoint?url=https://quench-works.com/api/v1/badge/license.json)

Examples

curl https://quench-works.com/api/v1/images.json
curl https://quench-works.com/api/v1/charts/2.json
curl https://quench-works.com/api/v1/security.json
curl https://quench-works.com/api/v1/security/alertmanager.json | jq '.latest.cves'

Notes