Trustify PR perf tests · 2026-10-07 16:17 UTC
Duration
9m 59s
Total requests
362,681
Failure rate
0.0%
0 failed requests
Throughput
604.8 req/s
Latency 95%ile
38 ms
Latency 99%ile
120 ms
Endpoints
72
0 with failures
Over time
Throughput
Requests and failures per second
Response time
Percentiles over Locust's rolling window, ms
Users
Concurrent simulated users
Load plan
| Action | Started | Stopped | Elapsed | Users |
|---|---|---|---|---|
| Increasing | 16:17:09 | 16:17:13 | 0m 04s | 2 → 10 |
| Maintaining | 16:17:13 | 16:27:06 | 9m 53s | 10 → 10 |
Top 10 slowest endpoints (95%ile)
| # | Method | Name | 95%ile (ms) | Average (ms) | # Requests |
|---|---|---|---|---|---|
| 1 | GET | /api/v3/advisory-labels?filter_text=type&limit=1000 | 8,600 | 7,270 | 78 |
| 2 | GET | /api/v3/sbom/{sbom_id}/download | 5,600 | 4,987 | 73 |
| 3 | POST | /api/v3/vulnerability/analyze | 3,000 | 1,115 | 382 |
| 4 | GET | /api/v3/advisory?q=CVE-2021-&total=true | 2,200 | 463 | 567 |
| 5 | GET | /api/v3/vulnerability?sort=base_score:desc&total=true | 1,000 | 658 | 196 |
| 6 | GET | /api/v3/sbom?q=name~redhat&total=true | 940 | 202 | 97 |
| 7 | GET | /api/v3/sbom?limit=10&sort=name:asc&total=true | 570 | 271 | 83 |
| 8 | GET | /api/v3/sbom?sort=ingested:desc&total=true | 530 | 231 | 84 |
| 9 | GET | /api/v3/advisory?offset={offset}&limit=1 | 500 | 235 | 101 |
| 10 | GET | /api/v3/sbom?q=published>2024-01-01&total=true | 500 | 228 | 92 |
Request metrics
| Method | Name | # Requests | # Fails | Fail % | Average (ms) | Min (ms) | Max (ms) | Avg size (B) | RPS | Failures/s |
|---|---|---|---|---|---|---|---|---|---|---|
| sbom 16 | ||||||||||
| GET | /api/v3/sbom/by-package?purl={purl} | 92 | 0 | 0% | 114 | 24.6 | 234 | 1,287 | 0.15 | 0 |
| GET | /api/v3/sbom/count-by-package | 92 | 0 | 0% | 25.8 | 9.21 | 96.6 | 3 | 0.15 | 0 |
| GET | /api/v3/sbom/{sbom_id} | 97 | 0 | 0% | 143 | 27.4 | 269 | 2,015 | 0.16 | 0 |
| GET | /api/v3/sbom/{sbom_id}/all-license-ids | 88 | 0 | 0% | 15.8 | 4.57 | 52.1 | 2 | 0.15 | 0 |
| GET | /api/v3/sbom/{sbom_id}/download | 73 | 0 | 0% | 4,987 | 4,141 | 6,116 | 136,458,638 | 0.12 | 0 |
| GET | /api/v3/sbom/{sbom_id}/license-export | 94 | 0 | 0% | 26.9 | 6.35 | 72.4 | 235 | 0.16 | 0 |
| GET | /api/v3/sbom/{sbom_id}/packages | 96 | 0 | 0% | 119 | 27.7 | 404 | 12,648 | 0.16 | 0 |
| GET | /api/v3/sbom/{sbom_id}/related | 72 | 0 | 0% | 159 | 34.9 | 363 | 15,372 | 0.12 | 0 |
| GET | /api/v3/sbom?limit=10&sort=name:asc&total=true | 83 | 0 | 0% | 271 | 71.0 | 1,209 | 12,189 | 0.14 | 0 |
| GET | /api/v3/sbom?offset=100&limit=10&total=true | 159 | 0 | 0% | 249 | 58.8 | 833 | 11,895 | 0.27 | 0 |
| GET | /api/v3/sbom?q=label:type=product&total=true | 95 | 0 | 0% | 15.7 | 4.46 | 69.3 | 22 | 0.16 | 0 |
| GET | /api/v3/sbom?q=license~GPL&sort=name:desc&total=true | 100 | 0 | 0% | 20.3 | 3.78 | 71.7 | 22 | 0.17 | 0 |
| GET | /api/v3/sbom?q=name~redhat&total=true | 97 | 0 | 0% | 202 | 19.3 | 2,183 | 22 | 0.16 | 0 |
| GET | /api/v3/sbom?q=published>2024-01-01&total=true | 92 | 0 | 0% | 228 | 53.2 | 892 | 29,331 | 0.15 | 0 |
| GET | /api/v3/sbom?sort=ingested:desc&total=true | 84 | 0 | 0% | 231 | 50.2 | 801 | 29,600 | 0.14 | 0 |
| GET | /api/v3/sbom?total=true | 183 | 0 | 0% | 212 | 51.3 | 548 | 29,331 | 0.31 | 0 |
| advisory 13 | ||||||||||
| GET | /api/v3/advisory/urn:uuid:{advisory_id} | 572 | 0 | 0% | 44.4 | 4.94 | 217 | 2,395 | 0.95 | 0 |
| GET | /api/v3/advisory/urn:uuid:{advisory_id}/download | 611 | 0 | 0% | 22.7 | 6.74 | 140 | 178,423 | 1.02 | 0 |
| GET | /api/v3/advisory?deprecated=Consider&total=true | 576 | 0 | 0% | 75.8 | 10.8 | 3,285 | 44,003 | 0.96 | 0 |
| GET | /api/v3/advisory?limit=1&total=true | 101 | 0 | 0% | 64.8 | 9.58 | 798 | 2,293 | 0.17 | 0 |
| GET | /api/v3/advisory?limit=10&sort=ingested:desc&total=true | 565 | 0 | 0% | 62.1 | 7.11 | 3,534 | 20,193 | 0.94 | 0 |
| GET | /api/v3/advisory?offset=100&limit=10&total=true | 618 | 0 | 0% | 63.8 | 8.20 | 2,692 | 19,929 | 1.03 | 0 |
| GET | /api/v3/advisory?offset={offset}&limit=1 | 101 | 0 | 0% | 235 | 34.1 | 644 | 2,315 | 0.17 | 0 |
| GET | /api/v3/advisory?q=CVE-2021-&total=true | 567 | 0 | 0% | 463 | 18.0 | 3,976 | 49,379 | 0.95 | 0 |
| GET | /api/v3/advisory?q=identifier=CVE-2022-0981&total=true | 577 | 0 | 0% | 45.3 | 4.22 | 178 | 1,971 | 0.96 | 0 |
| GET | /api/v3/advisory?q=modified>3 days ago&total=true | 594 | 0 | 0% | 17.1 | 4.52 | 179 | 22 | 0.99 | 0 |
| GET | /api/v3/advisory?q=title~openssl&total=true | 587 | 0 | 0% | 49.9 | 13.0 | 301 | 126,452 | 0.98 | 0 |
| GET | /api/v3/advisory?sort=modified:desc&total=true | 593 | 0 | 0% | 66.7 | 8.58 | 2,745 | 38,128 | 0.99 | 0 |
| GET | /api/v3/advisory?total=true | 619 | 0 | 0% | 102 | 12.4 | 2,572 | 47,914 | 1.03 | 0 |
| vulnerability 7 | ||||||||||
| POST | /api/v3/vulnerability/analyze | 382 | 0 | 0% | 1,115 | 2.62 | 5,614 | 4,707,614 | 0.64 | 0 |
| GET | /api/v3/vulnerability?offset=100&limit=10&total=true | 234 | 0 | 0% | 49.1 | 5.94 | 650 | 7,420 | 0.39 | 0 |
| GET | /api/v3/vulnerability?q=base_score>=7.0&total=true | 206 | 0 | 0% | 32.8 | 5.42 | 497 | 18,502 | 0.34 | 0 |
| GET | /api/v3/vulnerability?q=base_severity=high&total=true | 212 | 0 | 0% | 37.3 | 4.68 | 1,490 | 18,606 | 0.35 | 0 |
| GET | /api/v3/vulnerability?q=cwes=CWE-79&total=true | 211 | 0 | 0% | 33.2 | 6.05 | 924 | 18,875 | 0.35 | 0 |
| GET | /api/v3/vulnerability?sort=base_score:desc&total=true | 196 | 0 | 0% | 658 | 246 | 1,686 | 14,211 | 0.33 | 0 |
| GET | /api/v3/vulnerability?total=true | 205 | 0 | 0% | 25.2 | 4.21 | 965 | 18,862 | 0.34 | 0 |
| purl 15 | ||||||||||
| GET | /api/v3/purl/base/{purl} | 270 | 0 | 0% | 34.2 | 7.67 | 231 | 48,827 | 0.45 | 0 |
| GET | /api/v3/purl/base?q=namespace=redhat&total=true | 284 | 0 | 0% | 46.2 | 2.99 | 260 | 2,080 | 0.47 | 0 |
| GET | /api/v3/purl/base?q=type=rpm&total=true | 313 | 0 | 0% | 40.9 | 2.95 | 138 | 2,080 | 0.52 | 0 |
| GET | /api/v3/purl/base?sort=name:asc&total=true | 298 | 0 | 0% | 236 | 69.6 | 468 | 2,943 | 0.50 | 0 |
| GET | /api/v3/purl/base?total=true | 308 | 0 | 0% | 43.9 | 2.84 | 206 | 2,450 | 0.51 | 0 |
| POST | /api/v3/purl/recommend | 926 | 0 | 0% | 291 | 62.7 | 632 | 2,747 | 1.54 | 0 |
| GET | /api/v3/purl/{purl_id} | 295 | 0 | 0% | 111 | 24.3 | 428 | 537 | 0.49 | 0 |
| GET | /api/v3/purl?offset=100&limit=10&total=true | 274 | 0 | 0% | 82.7 | 3.48 | 4,501 | 4,474 | 0.46 | 0 |
| GET | /api/v3/purl?q=curl&total=true | 277 | 0 | 0% | 55.8 | 9.52 | 1,182 | 11,714 | 0.46 | 0 |
| GET | /api/v3/purl?q=license~GPLv3+...&sort=name:desc&total=true | 291 | 0 | 0% | 29.0 | 4.01 | 185 | 22 | 0.49 | 0 |
| GET | /api/v3/purl?q=name=curl&total=true | 314 | 0 | 0% | 14.1 | 3.31 | 107 | 12,084 | 0.52 | 0 |
| GET | /api/v3/purl?q=purl:namespace=redhat&total=true | 304 | 0 | 0% | 108 | 4.26 | 3,981 | 13,617 | 0.51 | 0 |
| GET | /api/v3/purl?q=purl:ty=rpm&total=true | 311 | 0 | 0% | 91.2 | 4.03 | 3,203 | 13,617 | 0.52 | 0 |
| GET | /api/v3/purl?sort=purl:name:asc&total=true | 324 | 0 | 0% | 101 | 3.21 | 4,955 | 11,101 | 0.54 | 0 |
| GET | /api/v3/purl?total=true | 322 | 0 | 0% | 74.7 | 3.92 | 3,899 | 9,877 | 0.54 | 0 |
| license 9 | ||||||||||
| GET | /api/v3/license/spdx/license/{license_id} | 1,898 | 0 | 0% | 41.3 | 1.38 | 170 | 1,143 | 3.17 | 0 |
| GET | /api/v3/license/spdx/license?q=apache&total=true | 1,835 | 0 | 0% | 5.91 | 1.31 | 251 | 165 | 3.06 | 0 |
| GET | /api/v3/license/spdx/license?q=gpl&total=true | 1,888 | 0 | 0% | 41.6 | 1.44 | 221 | 2,007 | 3.15 | 0 |
| GET | /api/v3/license/spdx/license?total=true | 1,898 | 0 | 0% | 40.3 | 1.31 | 161 | 1,525 | 3.17 | 0 |
| GET | /api/v3/license?limit=10&sort=license:asc&total=true | 1,836 | 0 | 0% | 40.5 | 9.55 | 522 | 425 | 3.06 | 0 |
| GET | /api/v3/license?q=ASL&sort=license:desc&total=true | 1,784 | 0 | 0% | 28.9 | 6.96 | 356 | 22 | 2.97 | 0 |
| GET | /api/v3/license?q=license~Apache&total=true | 1,918 | 0 | 0% | 20.6 | 4.87 | 224 | 120 | 3.20 | 0 |
| GET | /api/v3/license?q=license~GPL&total=true | 1,774 | 0 | 0% | 19.7 | 4.47 | 193 | 92 | 2.96 | 0 |
| GET | /api/v3/license?total=true | 1,898 | 0 | 0% | 66.5 | 9.30 | 393 | 1,101 | 3.17 | 0 |
| analysis 3 | ||||||||||
| GET | /api/v3/analysis/component/{component} | 17,852 | 0 | 0% | 9.91 | 1.83 | 203 | 25 | 29.77 | 0 |
| GET | /api/v3/analysis/latest/component/{cpe} | 17,743 | 0 | 0% | 10.0 | 1.89 | 131 | 25 | 29.59 | 0 |
| GET | /api/v3/analysis/status | 17,713 | 0 | 0% | 9.63 | 1.70 | 156 | 103 | 29.54 | 0 |
| importer 1 | ||||||||||
| GET | /api/v3/importer?total=true | 74,221 | 0 | 0% | 6.64 | 1.31 | 232 | 2 | 123.77 | 0 |
| group 3 | ||||||||||
| GET | /api/v3/group/sbom?parents=resolve&total=true | 17,966 | 0 | 0% | 9.58 | 1.86 | 157 | 38 | 29.96 | 0 |
| GET | /api/v3/group/sbom?total=true | 18,037 | 0 | 0% | 9.57 | 2.03 | 153 | 22 | 30.08 | 0 |
| GET | /api/v3/group/sbom?totals=true&total=true | 17,958 | 0 | 0% | 9.58 | 1.99 | 223 | 22 | 29.95 | 0 |
| labels 3 | ||||||||||
| GET | /api/v3/advisory-labels?filter_text=type&limit=1000 | 78 | 0 | 0% | 7,270 | 6,016 | 9,760 | 60 | 0.13 | 0 |
| GET | /api/v3/sbom-labels?limit=10&filter_text=&total=true | 90 | 0 | 0% | 62.6 | 9.81 | 126 | 1,065 | 0.15 | 0 |
| GET | /api/v3/sbom-labels?total=true | 88 | 0 | 0% | 59.9 | 14.6 | 134 | 1,065 | 0.15 | 0 |
| other 2 | ||||||||||
| GET | /.well-known/trustify | 74,561 | 0 | 0% | 3.00 | 0.79 | 111 | 890 | 124.34 | 0 |
| POST | /api/v3/ui/extract-sbom-purls | 74,610 | 0 | 0% | 3.74 | 0.88 | 107 | 45 | 124.42 | 0 |
Response time metrics (ms)
| Method | Name | 50%ile | 75%ile | 90%ile | 95%ile | 99%ile | 100%ile |
|---|---|---|---|---|---|---|---|
| sbom 16 | |||||||
| GET | /api/v3/sbom/by-package?purl={purl} | 110 | 140 | 160 | 180 | 230 | 230 |
| GET | /api/v3/sbom/count-by-package | 18 | 39 | 52 | 61 | 97 | 97 |
| GET | /api/v3/sbom/{sbom_id} | 140 | 170 | 210 | 230 | 270 | 270 |
| GET | /api/v3/sbom/{sbom_id}/all-license-ids | 12 | 18 | 36 | 39 | 52 | 52 |
| GET | /api/v3/sbom/{sbom_id}/download | 5,000 | 5,300 | 5,500 | 5,600 | 6,100 | 6,100 |
| GET | /api/v3/sbom/{sbom_id}/license-export | 22 | 37 | 51 | 59 | 72 | 72 |
| GET | /api/v3/sbom/{sbom_id}/packages | 94 | 150 | 230 | 260 | 400 | 400 |
| GET | /api/v3/sbom/{sbom_id}/related | 150 | 200 | 260 | 300 | 360 | 360 |
| GET | /api/v3/sbom?limit=10&sort=name:asc&total=true | 220 | 290 | 500 | 570 | 1,200 | 1,200 |
| GET | /api/v3/sbom?offset=100&limit=10&total=true | 230 | 310 | 420 | 490 | 640 | 830 |
| GET | /api/v3/sbom?q=label:type=product&total=true | 11 | 19 | 35 | 40 | 69 | 69 |
| GET | /api/v3/sbom?q=license~GPL&sort=name:desc&total=true | 17 | 29 | 37 | 48 | 72 | 72 |
| GET | /api/v3/sbom?q=name~redhat&total=true | 81 | 120 | 880 | 940 | 2,200 | 2,200 |
| GET | /api/v3/sbom?q=published>2024-01-01&total=true | 200 | 290 | 440 | 500 | 890 | 890 |
| GET | /api/v3/sbom?sort=ingested:desc&total=true | 190 | 320 | 390 | 530 | 800 | 800 |
| GET | /api/v3/sbom?total=true | 200 | 250 | 340 | 390 | 500 | 550 |
| advisory 13 | |||||||
| GET | /api/v3/advisory/urn:uuid:{advisory_id} | 50 | 56 | 65 | 74 | 130 | 220 |
| GET | /api/v3/advisory/urn:uuid:{advisory_id}/download | 18 | 24 | 39 | 53 | 110 | 140 |
| GET | /api/v3/advisory?deprecated=Consider&total=true | 28 | 41 | 66 | 100 | 2,400 | 3,300 |
| GET | /api/v3/advisory?limit=1&total=true | 54 | 60 | 69 | 75 | 670 | 800 |
| GET | /api/v3/advisory?limit=10&sort=ingested:desc&total=true | 20 | 32 | 46 | 68 | 1,900 | 3,500 |
| GET | /api/v3/advisory?offset=100&limit=10&total=true | 42 | 57 | 83 | 110 | 260 | 2,700 |
| GET | /api/v3/advisory?offset={offset}&limit=1 | 220 | 300 | 460 | 500 | 630 | 640 |
| GET | /api/v3/advisory?q=CVE-2021-&total=true | 180 | 390 | 1,500 | 2,200 | 3,300 | 4,000 |
| GET | /api/v3/advisory?q=identifier=CVE-2022-0981&total=true | 51 | 56 | 66 | 73 | 110 | 180 |
| GET | /api/v3/advisory?q=modified>3 days ago&total=true | 13 | 19 | 29 | 40 | 100 | 180 |
| GET | /api/v3/advisory?q=title~openssl&total=true | 39 | 55 | 78 | 120 | 250 | 300 |
| GET | /api/v3/advisory?sort=modified:desc&total=true | 26 | 38 | 63 | 91 | 2,000 | 2,700 |
| GET | /api/v3/advisory?total=true | 76 | 98 | 120 | 170 | 280 | 2,600 |
| vulnerability 7 | |||||||
| POST | /api/v3/vulnerability/analyze | 1,300 | 2,100 | 2,700 | 3,000 | 3,800 | 5,600 |
| GET | /api/v3/vulnerability?offset=100&limit=10&total=true | 49 | 53 | 61 | 72 | 480 | 650 |
| GET | /api/v3/vulnerability?q=base_score>=7.0&total=true | 13 | 19 | 36 | 120 | 450 | 500 |
| GET | /api/v3/vulnerability?q=base_severity=high&total=true | 14 | 21 | 35 | 100 | 450 | 1,500 |
| GET | /api/v3/vulnerability?q=cwes=CWE-79&total=true | 13 | 20 | 34 | 120 | 400 | 920 |
| GET | /api/v3/vulnerability?sort=base_score:desc&total=true | 640 | 710 | 820 | 1,000 | 1,500 | 1,700 |
| GET | /api/v3/vulnerability?total=true | 12 | 17 | 21 | 33 | 380 | 960 |
| purl 15 | |||||||
| GET | /api/v3/purl/base/{purl} | 25 | 39 | 62 | 82 | 200 | 230 |
| GET | /api/v3/purl/base?q=namespace=redhat&total=true | 48 | 52 | 64 | 76 | 230 | 260 |
| GET | /api/v3/purl/base?q=type=rpm&total=true | 47 | 52 | 64 | 74 | 91 | 140 |
| GET | /api/v3/purl/base?sort=name:asc&total=true | 230 | 280 | 330 | 380 | 450 | 470 |
| GET | /api/v3/purl/base?total=true | 48 | 53 | 63 | 73 | 120 | 210 |
| POST | /api/v3/purl/recommend | 280 | 350 | 410 | 460 | 530 | 630 |
| GET | /api/v3/purl/{purl_id} | 99 | 130 | 170 | 210 | 380 | 430 |
| GET | /api/v3/purl?offset=100&limit=10&total=true | 47 | 52 | 59 | 70 | 2,500 | 4,500 |
| GET | /api/v3/purl?q=curl&total=true | 27 | 39 | 57 | 84 | 930 | 1,200 |
| GET | /api/v3/purl?q=license~GPLv3+...&sort=name:desc&total=true | 24 | 37 | 52 | 63 | 110 | 190 |
| GET | /api/v3/purl?q=name=curl&total=true | 10 | 14 | 26 | 35 | 86 | 110 |
| GET | /api/v3/purl?q=purl:namespace=redhat&total=true | 10 | 15 | 33 | 52 | 3,000 | 4,000 |
| GET | /api/v3/purl?q=purl:ty=rpm&total=true | 11 | 14 | 23 | 38 | 2,900 | 3,200 |
| GET | /api/v3/purl?sort=purl:name:asc&total=true | 11 | 14 | 24 | 37 | 3,200 | 5,000 |
| GET | /api/v3/purl?total=true | 10 | 14 | 23 | 35 | 3,000 | 3,900 |
| license 9 | |||||||
| GET | /api/v3/license/spdx/license/{license_id} | 45 | 47 | 50 | 57 | 86 | 170 |
| GET | /api/v3/license/spdx/license?q=apache&total=true | 4 | 6 | 8 | 10 | 52 | 250 |
| GET | /api/v3/license/spdx/license?q=gpl&total=true | 45 | 47 | 50 | 56 | 130 | 220 |
| GET | /api/v3/license/spdx/license?total=true | 45 | 46 | 49 | 54 | 84 | 160 |
| GET | /api/v3/license?limit=10&sort=license:asc&total=true | 35 | 48 | 63 | 80 | 150 | 520 |
| GET | /api/v3/license?q=ASL&sort=license:desc&total=true | 24 | 34 | 47 | 58 | 120 | 360 |
| GET | /api/v3/license?q=license~Apache&total=true | 16 | 24 | 35 | 43 | 92 | 220 |
| GET | /api/v3/license?q=license~GPL&total=true | 16 | 23 | 33 | 42 | 88 | 190 |
| GET | /api/v3/license?total=true | 66 | 82 | 99 | 110 | 180 | 390 |
| analysis 3 | |||||||
| GET | /api/v3/analysis/component/{component} | 8 | 11 | 16 | 26 | 43 | 200 |
| GET | /api/v3/analysis/latest/component/{cpe} | 8 | 11 | 16 | 26 | 43 | 130 |
| GET | /api/v3/analysis/status | 7 | 10 | 16 | 26 | 42 | 160 |
| importer 1 | |||||||
| GET | /api/v3/importer?total=true | 5 | 7 | 10 | 16 | 37 | 230 |
| group 3 | |||||||
| GET | /api/v3/group/sbom?parents=resolve&total=true | 7 | 10 | 16 | 25 | 43 | 160 |
| GET | /api/v3/group/sbom?total=true | 7 | 10 | 16 | 26 | 42 | 150 |
| GET | /api/v3/group/sbom?totals=true&total=true | 7 | 10 | 16 | 25 | 42 | 220 |
| labels 3 | |||||||
| GET | /api/v3/advisory-labels?filter_text=type&limit=1000 | 7,200 | 7,600 | 8,300 | 8,600 | 9,800 | 9,800 |
| GET | /api/v3/sbom-labels?limit=10&filter_text=&total=true | 60 | 76 | 97 | 100 | 130 | 130 |
| GET | /api/v3/sbom-labels?total=true | 59 | 72 | 84 | 89 | 130 | 130 |
| other 2 | |||||||
| GET | /.well-known/trustify | 3 | 4 | 5 | 6 | 11 | 110 |
| POST | /api/v3/ui/extract-sbom-purls | 3 | 5 | 7 | 8 | 14 | 110 |
Failures
No failures recorded.
Exceptions
No exceptions raised in the locustfile.