What’s New
Vulnerability scanners and compliance platforms work by pulling data from centralized databases, matching it against your software inventory, and routing findings into your security information and event management (SIEM) or ticketing systems. That pipeline runs automatically for PyPI, npm, Maven, and most other ecosystems.
Conda is the exception. Generic vulnerability databases don’t model how conda packages are built or distributed; they have no concept of channels, don’t distinguish platform-specific builds, and may not differentiate that a conda package sharing a name with a PyPI package can bundle a different upstream version entirely. Point a generic scanner at a conda environment and the results are unreliable, with missed exposure of affected packages and false positives on ones that aren’t affected.
Every other ecosystem still reports into one place: scanners pull from the National Vulnerability Database (NVD) and Open Source Vulnerabilities (OSV), findings land in SIEM platforms, and when a severity crosses a threshold, the on-call engineer gets paged. Conda does not have a programmatic path into that pipeline, so the work stays manual: somebody logs in, checks, and reports back.
The European Union Agency for Cybersecurity (ENISA) found in its SBOM Adoption State of Play 2026 report that 35% of organizations called vulnerability matching a significant challenge, and another 23% called it an extreme one.
Anaconda curates vulnerability data and generates software bills of materials (SBOMs) for almost 20,000 conda packages we build and maintain across our main and main-x channels. Package Intelligence APIs make this information available to your tooling directly. Two of them are live today: the Advisory API and SBOM API.
We proved the approach in a closed beta with one of the world’s largest hyperscalers, running on their infrastructure against their requirements, and are now making it available to organizations with an active Anaconda Business plan subscription.
| Capability | What It Gives You | Beta Scope |
|---|---|---|
| Advisory API | A syncable feed of Anaconda-curated vulnerability advisories, plus lookup of a single advisory by ID. | Anaconda main channel |
| SBOM API | SBOM retrieval for a conda package, by SHA-256 or by package properties. | Anaconda main and main-x channels |
Let’s Dig Deeper
These APIs work differently from each other. The Advisory API is a feed you mirror by pulling Anaconda’s advisory corpus once and updating your copy with subsequent syncs. The SBOM API is a lookup that returns information on the artifact that you specifically asked for.
Advisory API: advisories for the main channel
The Advisory API has two endpoints under anaconda.com/api, both authenticated GET requests using a bearer token from your organization service account:
| Endpoint | Output |
|---|---|
GET /v1/advisories/feed | Returns a paginated feed you sync on your own schedule |
GET /v1/advisories/{advisory_id} | Retrieves a single advisory when you already have its ID |
The feed supports incremental sync in two ways. Within a single run, pass the continuation token from each response to fetch the next page. Across runs, save the watermark from your final page. Pass it as modified_since on your next call and you’ll receive only what changed since then.
A package has many versions, each version can have many builds, and each advisory specifies which builds on which platforms are affected. Each advisory contains:
- its identifier, a description, and severity
- the other identifiers the same vulnerability is known by
- its Common Weakness Enumeration (CWE) classification
- publication and modification timestamps
- the package URLs (PURLs) and artifact SHA-256 hashes it affects
The feed covers Anaconda’s main channel, and expansion is driven by customer demand.
SBOM API for main and main-x
An SBOM lists what’s inside a package and where each part came from. This API has two endpoints, both under repo.anaconda.cloud. Depending on what you know about the package, you should use one or the other. Both return an SPDX 2.2.1 JSON document.
| Endpoint | Use When |
|---|---|
GET /repo/{channel_name}/sboms/sha256/{package_sha256} | You have the exact artifact hash. |
GET /repo/{channel_name}/sboms/by-properties/{artifact_family}/{common_name}/{platform}/{version} | You have the package coordinates rather than a hash. |
Authenticating
Both APIs are available to members of organizations with a Business subscription. If you don’t have a seat, your organization administrator must assign you one before you can create credentials.
Each API uses its own credentials. The Advisory API takes OAuth2 client credentials from an organization service account. Exchange your service account credentials for an access token, then see the getting started page for the full workflow. Access tokens expire after 15 minutes, so a sync that runs longer should request a fresh token and resume.
The SBOM API takes an API key plus the organization access token that grants access to the channels. Only the API key is passed in the request header. The organization access token is installed on your machine as a one-time setup step.
Why This Matters
Conda findings reach your security tooling the same way findings from every other ecosystem do. The feed authenticates with your existing service account, you poll it on your desired cadence, and new advisories land in your team’s queue.
It’s worth acting on this now rather than waiting: according to the National Institute of Standards and Technology (NIST), CVE submissions rose 263% between 2020 and 2025, and in April this year the Institute narrowed what it enriches in the National Vulnerability Database (NVD) to prioritize actively exploited vulnerabilities and critical software, moving its pre-March 2026 backlog to “Not Scheduled.” Even ecosystems NVD does track are seeing slower turnaround as volume climbs, which is one more reason to close the conda gap now.
For platform and continuous integration/continuous delivery (CI/CD) teams, SBOM retrieval by exact coordinates fits inside a build step. Resolve the artifact, fetch its SBOM, and attach it to the build record. No need to reconstruct what shipped afterward. Compliance and procurement teams get the same benefit from the other direction: when someone asks what went into a build, the answer is already on file.
The same ENISA survey found that 39% of organizations never receive an SBOM from the manufacturers of the commercial software they buy, and another 39% rarely do. Anaconda’s SBOMs are returned to you through an API call. Call either from a SIEM connector, an IT service management (ITSM) automation, a build job, or a script.
Give It a Shot
Each command below is a single line, so it runs unchanged in macOS and Linux shells, Command Prompt, and PowerShell 7. On Windows PowerShell, call curl.exe rather than curl. Documentation pages carry these requests as ready-made snippets in Python, JavaScript, Go, Java, PHP, and Ruby if you would rather not use cURL.
Sync the Advisory Feed
Ask your administrator for a service account, exchange its client ID and secret for an access token, then:
curl --request GET --url "https://anaconda.com/api/v1/advisories/feed" --header "Authorization: Bearer <ACCESS_TOKEN>"The Advisory API docs walk through the token exchange and include a Python script that runs the full sync loop where the pagination and watermark handling are already written for you.
Pull an SBOM
| Install | conda install anaconda-auth |
| Log In | anaconda auth login |
| Print API Key | anaconda auth api-keyFor more information about the api-key command, see the anaconda auth api-key command reference. |
| Make a request | curl --request GET --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" --header "Authorization: Bearer <API_KEY>"Replace <PACKAGE_SHA256> with the SHA-256 hash of the package. Replace <API_KEY> with your API key. |
You’ll get back an SPDX 2.2.1 JSON document for that artifact. The SBOM API docs cover looking a package up by name, channel, platform, and version when you don’t have a hash.
Pull SBOMs on demand. Schedule the advisory feed: each run returns only what changed since the last run, keeping your local copy current, so the tooling can check against it continuously instead of calling the API for every package.
If you have any issues, open a request in the Anaconda Support Center.