# Dependency-Track-API-Server

Dependency-Track-API-Server is a self-hosted security app. API Server to be used with Dependency-Track Front-End Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/420/dependency-track-api-server

## Description

API Server to be used with Dependency-Track Front-End Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve. For more details about Dependency-Track see the projects website at dependencytrack.org Please note this application is not lightweight and uses 8-12GB of ram to run

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

59/100 (Fair), based on 5 of 5 factors.
- Maintained: 100 (last commit 16 days ago)
- Popular: 73 (4,265 GitHub stars)
- Easy to install: 35 (1 install platform, install notes, Docker image)
- Light to run: 20 (4.5 GB minimum RAM, runs on ARM)
- Security check: 15 (2 serious findings, 2 minor, CI, tests, OpenSSF Scorecard 7.7/10)

## Security check

2 serious findings: A private key is committed in the source code; A private key is committed in the source code.
Automated checks on commit e541c49, 19 Oct 2026. Not an audit.

## Links

- Docker Hub: https://hub.docker.com/r/dependencytrack/apiserver
- GitHub: https://github.com/DependencyTrack/dependency-track
- Unraid: https://ca.unraid.net/apps/dependency-track-api-server-1olhb610ougj4t?q=Dependency-Track-API-Server
- Official website: https://dependencytrack.org/
- Documentation: https://dependencytrack.github.io/docs/

## Common questions

### Where is the API server's main configuration file, and what can it define?

The central configuration file is application.properties, and it resides in the classpath of the WAR by default. It controls performance tuning parameters and is used for optional external database sources and directory services.

### How can I set up a self-hosted instance behind a reverse proxy?

A self-hosted instance can be set up with Docker Compose and Caddy. The same guide covers integrating non-Dockerized source-code projects and Dockerized container projects.

### What should I know before moving from v4 to v5?

v4 is in maintenance mode on the 4.14.x branch and reaches end-of-life in December 2026. Migration from v4 to v5 is covered by the V5_MIGRATION.md document.

### How can I run a quick local test?

The quickstart tutorial runs a local instance with Docker Compose in a few minutes.

## Alternatives

- FOSSA: FOSSA offers automated license scanning, dependency analysis and reports at each commit.

---
Source: Our Local Host (https://ourlocalhost.com/app/420/dependency-track-api-server), the self-hosted and open-source app directory.