Getting Started

Backpatch tells you which overrides, resolutions, and pnpm.overrides in your package.json are safe to remove. Call it over a simple REST API.

Base URL

https://api.backpatch.dev

Authentication

Every request needs an API key — there is no anonymous access. Start a 14-day Pro trial or pick a plan on the pricing page; your key is issued as soon as checkout completes (trial included) and is shown once on the success screen. Send it on every request in the X-API-Key header:

X-API-Key: bp_your_key_here

A bearer token works too: Authorization: Bearer bp_your_key_here. A missing, invalid, or revoked key returns 401.

Quick test

Confirm your key works by sending your package.json straight through as the request body:

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  --data-binary @package.json

A 200 with a JSON array means your key is valid and you're on your paid tier.

Worked example

What the analysis actually returns, on a package.json carrying three overrides left behind by three different advisories. This runs in your browser — no key needed to read it.

package.jsonSample — no API call

{
  "name": "my-app",
  "dependencies": {
    "request": "^2.88.2",
    "express": "^4.18.2",
    "webpack": "^4.46.0"
  },
  "overrides": {
    "tough-cookie": "4.1.3",
    "qs": "6.11.0",
    "terser": "5.14.2"
  }
}

See what Backpatch reports for these three overrides.

Endpoints

All endpoints are POST and accept a JSON body. The status field is one of "SafeToRemove", "StillNeeded", "NeedsMajorUpgrade", or "Unknown". "NeedsMajorUpgrade" means the override can only be dropped by upgrading a parent across a major version; pass allowMajorBump (query param on /analyze_overrides, body field on /check_override) to treat those as removable instead.

POST/analyze_overrides

Analyze every override in a package.json. Send it whichever way is easiest — there's no need to wrap or escape it:

Option A — send the file as the body

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  --data-binary @package.json

Option B — upload the file

curl -X POST https://api.backpatch.dev/analyze_overrides \
  -H "X-API-Key: bp_your_key_here" \
  -F "[email protected]"

In Postman: set the body to raw / JSON and paste your package.json in directly, or use form-data with a file field named packageJson. To pass a lockfile for more precise results, send {"packageJson": <object>, "lockfileContent": <string>}.

Response

[
  {
    "packageName": "lodash",
    "overriddenVersion": "4.17.21",
    "status": "SafeToRemove",
    "suggestedParentUpgrade": "upgrade lodash to 4.18.1",
    "advisoryId": "GHSA-f23m-r3pf-42rh",
    "reason": "Version 4.18.1 of lodash meets or exceeds the overridden version 4.17.21."
  }
]

POST/check_override

Check a single override. packageName and overriddenVersion are required; parentHint, parentVersion (the parent's current range, e.g. ^4.18.0), and allowMajorBump are optional.

curl -X POST https://api.backpatch.dev/check_override \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"packageName":"lodash","overriddenVersion":"4.17.21"}'

Response

{
  "packageName": "lodash",
  "overriddenVersion": "4.17.21",
  "status": "SafeToRemove",
  "suggestedParentUpgrade": "upgrade lodash to 4.18.1",
  "advisoryId": "GHSA-f23m-r3pf-42rh",
  "reason": "Version 4.18.1 of lodash meets or exceeds the overridden version 4.17.21."
}

POST/explain_override

Look up the security advisory behind an override. packageName and version are required. Returns null when no advisory is found.

curl -X POST https://api.backpatch.dev/explain_override \
  -H "X-API-Key: bp_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"packageName":"lodash","version":"4.17.20"}'

Response

{
  "id": "GHSA-29mw-wpgm-hmr9",
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "affectedVersions": ["4.0.0"],
  "patchedVersions": ["4.17.21"]
}

Plans & limits

Plan	Overrides / request	Requests / min	Max package.json
Pro	200	120	1 MB
Team	1,000	600	4 MB
Enterprise	10,000	3,000	16 MB

Requests without a valid key return 401; exceeding your plan's override cap returns 402; an oversized body returns 413; too many requests returns 429.

Using with MCP

Backpatch is also a Model Context Protocol server, so agents like Claude can call it directly. Point your MCP client at https://api.backpatch.dev/mcp and pass your key in the X-API-Key header. The same three tools — analyze_overrides, check_override, and explain_override — are exposed.

← Back to pricing Wire this into your Renovate PRs →