Getting Started

Backpatch tells you which overrides, resolutions, and pnpm.overrides in your package.json are safe to remove. Call it over a simple REST API.

Base URL

https://api.backpatch.dev

Authentication

The free tier is anonymous — no key required, but tightly bounded (25 overrides per request, 10 requests/min). To raise those limits, purchase a plan on the pricing page; your key is shown once on the success screen right after checkout. Send it on every request in the X-API-Key header:

X-API-Key: bp_your_key_here

A bearer token works too: Authorization: Bearer bp_your_key_here. An invalid or revoked key returns 401.

Quick test

Confirm your key works by sending your package.json straight through as the request body:

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  --data-binary @package.json

A 200 with a JSON array means your key is valid and you're on your paid tier.

Try it

Paste a package.json and run it against the live API right here. Leave the key blank to use the free tier.

package.json

Endpoints

All endpoints are POST and accept a JSON body. The status field is one of "SafeToRemove", "StillNeeded", "NeedsMajorUpgrade", or "Unknown". "NeedsMajorUpgrade" means the override can only be dropped by upgrading a parent across a major version; pass allowMajorBump (query param on /analyze_overrides, body field on /check_override) to treat those as removable instead.

POST/analyze_overrides

Analyze every override in a package.json. Send it whichever way is easiest — there's no need to wrap or escape it:

Option A — send the file as the body

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  --data-binary @package.json

Option B — upload the file

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -F "[email protected]"

In Postman: set the body to raw / JSON and paste your package.json in directly, or use form-data with a file field named packageJson. To pass a lockfile for more precise results, send {"packageJson": <object>, "lockfileContent": <string>}.

Response

[
  {
    "packageName": "lodash",
    "overriddenVersion": "4.17.21",
    "status": "SafeToRemove",
    "suggestedParentUpgrade": "upgrade lodash to 4.18.1",
    "advisoryId": "GHSA-f23m-r3pf-42rh",
    "reason": "Version 4.18.1 of lodash meets or exceeds the overridden version 4.17.21."
  }
]

POST/check_override

Check a single override. packageName and overriddenVersion are required; parentHint, parentVersion (the parent's current range, e.g. ^4.18.0), and allowMajorBump are optional.

curl -X POST https://api.backpatch.dev/check_override \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"packageName":"lodash","overriddenVersion":"4.17.21"}'

Response

{
  "packageName": "lodash",
  "overriddenVersion": "4.17.21",
  "status": "SafeToRemove",
  "suggestedParentUpgrade": "upgrade lodash to 4.18.1",
  "advisoryId": "GHSA-f23m-r3pf-42rh",
  "reason": "Version 4.18.1 of lodash meets or exceeds the overridden version 4.17.21."
}

POST/explain_override

Look up the security advisory behind an override. packageName and version are required. Returns null when no advisory is found.

curl -X POST https://api.backpatch.dev/explain_override \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"packageName":"lodash","version":"4.17.20"}'

Response

{
  "id": "GHSA-29mw-wpgm-hmr9",
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "affectedVersions": ["4.0.0"],
  "patchedVersions": ["4.17.21"]
}

Plans & limits

Plan	Overrides / request	Requests / min	Max package.json
Free	25	10	64 KB
Pro	200	120	1 MB
Team	1,000	600	4 MB
Enterprise	10,000	3,000	16 MB

Exceeding the override cap returns 402; an oversized body returns 413; too many requests returns 429.

Using with MCP

Backpatch is also a Model Context Protocol server, so agents like Claude can call it directly. Point your MCP client at https://api.backpatch.dev/mcp and pass your key in the X-API-Key header. The same three tools — analyze_overrides, check_override, and explain_override — are exposed.

← Back to pricing