← All runs

Trustify PR perf tests · 2026-10-24 16:02 UTC

Target trustify (scale snapshot) · 2026-10-24 16:02:29 UTC → 16:12:27 UTC · Users 10 · Deltas vs previous run (2026-10-24 15:00 UTC, pr_2791_2026-10-24T14-10-19_24a70e7)

Type pull-request · Dataset scale-20260317T023702Z · Scenario etc/scenarios/main/full-20260317T023702Z.json5 · Branch tc-7105 · Commit 8ecf3d8033a8 · PR #2791 · Workflow run

Duration
9m 58s
Total requests
287,449 (+94,533)
Failure rate
0.0%
0 failed requests
Throughput
480.0 req/s (+158.1)
Latency 95%ile
65 ms (-8)
Latency 99%ile
130 ms (-80)
Endpoints
72
0 with failures

Over time

Throughput

Requests and failures per second

Response time

Percentiles over Locust's rolling window, ms

Users

Concurrent simulated users

Load plan

ActionStartedStoppedElapsedUsers
Increasing16:02:2916:02:330m 04s2 → 10
Maintaining16:02:3316:12:279m 54s10 → 10

Top 10 slowest endpoints (95%ile)

#MethodName95%ile (ms)Average (ms)# Requests
1GET/api/v3/advisory-labels?filter_text=type&limit=10004,6003,932142
2POST/api/v3/vulnerability/analyze2,600644586
3GET/api/v3/sbom/{sbom_id}/download2,4002,281134
4GET/api/v3/sbom?q=name~redhat&total=true1,300569112
5GET/api/v3/advisory?q=CVE-2021-&total=true1,200282754
6POST/api/v3/purl/recommend1,100724577
7GET/api/v3/vulnerability?sort=base_score:desc&total=true1,100490337
8GET/api/v3/sbom?sort=ingested:desc&total=true630226136
9GET/api/v3/advisory?offset={offset}&limit=1580245125
10GET/api/v3/purl?q=purl:ty=rpm&total=true580133175

Request metrics

MethodName# Requests# FailsFail %Average (ms)Min (ms)Max (ms)Avg size (B)RPSFailures/s
sbom 16
GET/api/v3/sbom/by-package?purl={purl}116 (+20)0 (0)0%86.4 (-15.8)49.92241,2870.19 (0)0
GET/api/v3/sbom/count-by-package103 (+1)0 (0)0%25.6 (-7.6)3.1579.930.17 (0)0
GET/api/v3/sbom/{sbom_id}120 (+31)0 (0)0%108 (-25.9)53.92812,0150.20 (+0.1)0
GET/api/v3/sbom/{sbom_id}/all-license-ids114 (+22)0 (0)0%16.0 (-7.8)1.5181.320.19 (0)0
GET/api/v3/sbom/{sbom_id}/download134 (+27)0 (0)0%2,281 (-741.1)2,1292,468136,458,6380.22 (0)0
GET/api/v3/sbom/{sbom_id}/license-export107 (+19)0 (0)0%29.0 (-3.7)3.5693.62350.18 (0)0
GET/api/v3/sbom/{sbom_id}/packages122 (+26)0 (0)0%120 (-33.5)11.469112,6480.20 (0)0
GET/api/v3/sbom/{sbom_id}/related106 (+22)0 (0)0%120 (-24.2)18.755015,3720.18 (0)0
GET/api/v3/sbom?limit=10&sort=name:asc&total=true121 (+11)0 (0)0%249 (+3.6)26.41,20312,1890.20 (0)0
GET/api/v3/sbom?offset=100&limit=10&total=true231 (+19)0 (0)0%171 (-34.9)21.680311,9410.39 (0)0
GET/api/v3/sbom?q=label:type=product&total=true116 (+49)0 (0)0%17.4 (-8.6)1.6280.7220.19 (+0.1)0
GET/api/v3/sbom?q=license~GPL&sort=name:desc&total=true111 (+29)0 (0)0%20.2 (-10.8)2.1680.5220.19 (0)0
GET/api/v3/sbom?q=name~redhat&total=true112 (+16)0 (0)0%569 (+42.8)7.841,891220.19 (0)0
GET/api/v3/sbom?q=published>2024-01-01&total=true117 (+41)0 (0)0%155 (-49.7)21.480329,3170.20 (+0.1)0
GET/api/v3/sbom?sort=ingested:desc&total=true136 (+28)0 (0)0%226 (-51.7)22.991929,6000.23 (0)0
GET/api/v3/sbom?total=true215 (+38)0 (0)0%138 (-41.2)20.699829,3170.36 (+0.1)0
advisory 13
GET/api/v3/advisory/urn:uuid:{advisory_id}779 (+190)0 (0)0%52.8 (-6.9)2.431212,3951.30 (+0.3)0
GET/api/v3/advisory/urn:uuid:{advisory_id}/download776 (+155)0 (0)0%20.9 (-6.9)3.5389.6178,4231.30 (+0.3)0
GET/api/v3/advisory?deprecated=Consider&total=true785 (+185)0 (0)0%50.2 (-20.4)5.413,37944,0031.31 (+0.3)0
GET/api/v3/advisory?limit=1&total=true126 (-4)0 (0)0%74.7 (-0.1)6.311,0192,2250.21 (0)0
GET/api/v3/advisory?limit=10&sort=ingested:desc&total=true731 (+164)0 (0)0%50.0 (-13.4)2.882,79020,1931.22 (+0.3)0
GET/api/v3/advisory?offset=100&limit=10&total=true782 (+150)0 (0)0%56.1 (-25.2)4.131,40518,9611.31 (+0.3)0
GET/api/v3/advisory?offset={offset}&limit=1125 (-5)0 (0)0%245 (-5.5)47.31,2442,0990.21 (0)0
GET/api/v3/advisory?q=CVE-2021-&total=true754 (+166)0 (0)0%282 (-109.8)5.822,70349,5831.26 (+0.3)0
GET/api/v3/advisory?q=identifier=CVE-2022-0981&total=true807 (+221)0 (0)0%55.5 (-4.6)3.011391,9711.35 (+0.4)0
GET/api/v3/advisory?q=modified>3 days ago&total=true763 (+175)0 (0)0%17.5 (-4.3)1.7190.5221.27 (+0.3)0
GET/api/v3/advisory?q=title~openssl&total=true787 (+176)0 (0)0%33.6 (-11.0)6.06425126,4521.31 (+0.3)0
GET/api/v3/advisory?sort=modified:desc&total=true832 (+249)0 (0)0%47.1 (-22.9)3.992,59938,1281.39 (+0.4)0
GET/api/v3/advisory?total=true741 (+141)0 (0)0%108 (+0.3)6.312,25249,5641.24 (+0.2)0
vulnerability 7
POST/api/v3/vulnerability/analyze586 (+146)0 (0)0%644 (-292.0)0.914,5734,410,4220.98 (+0.2)0
GET/api/v3/vulnerability?offset=100&limit=10&total=true321 (+95)0 (0)0%60.7 (-2.1)3.648507,5510.54 (+0.2)0
GET/api/v3/vulnerability?q=base_score>=7.0&total=true339 (+119)0 (0)0%32.3 (-3.2)1.801,72718,3230.57 (+0.2)0
GET/api/v3/vulnerability?q=base_severity=high&total=true325 (+126)0 (0)0%27.0 (-21.7)2.131,62018,4730.54 (+0.2)0
GET/api/v3/vulnerability?q=cwes=CWE-79&total=true317 (+118)0 (0)0%28.0 (-21.0)1.931,33818,9300.53 (+0.2)0
GET/api/v3/vulnerability?sort=base_score:desc&total=true337 (+111)0 (0)0%490 (-109.9)86.62,84413,9540.56 (+0.2)0
GET/api/v3/vulnerability?total=true294 (+82)0 (0)0%16.3 (-15.9)1.8749218,8490.49 (+0.1)0
purl 15
GET/api/v3/purl/base/{purl}212 (+45)0 (0)0%78.7 (-3.8)3.6040548,8270.35 (+0.1)0
GET/api/v3/purl/base?q=namespace=redhat&total=true192 (+31)0 (0)0%67.5 (-3.2)3.359682,0800.32 (+0.1)0
GET/api/v3/purl/base?q=type=rpm&total=true190 (+26)0 (0)0%54.1 (-3.3)2.871112,0800.32 (0)0
GET/api/v3/purl/base?sort=name:asc&total=true217 (+68)0 (0)0%61.2 (-141.5)3.473122,9430.36 (+0.1)0
GET/api/v3/purl/base?total=true195 (+46)0 (0)0%54.9 (-8.3)2.522242,4500.33 (+0.1)0
POST/api/v3/purl/recommend577 (+118)0 (0)0%724 (-161.1)98.51,4292,7470.96 (+0.2)0
GET/api/v3/purl/{purl_id}188 (+24)0 (0)0%68.8 (-16.4)11.23175370.31 (0)0
GET/api/v3/purl?offset=100&limit=10&total=true207 (+30)0 (0)0%62.9 (-8.7)1.664584,1890.35 (+0.1)0
GET/api/v3/purl?q=curl&total=true205 (+49)0 (0)0%87.3 (+3.0)1.931,88510,2300.34 (+0.1)0
GET/api/v3/purl?q=license~GPLv3+...&sort=name:desc&total=true208 (+41)0 (0)0%24.8 (-7.4)2.7984.1220.35 (+0.1)0
GET/api/v3/purl?q=name=curl&total=true210 (+59)0 (0)0%24.5 (-6.0)1.4426512,0840.35 (+0.1)0
GET/api/v3/purl?q=purl:namespace=redhat&total=true212 (+61)0 (0)0%118 (-51.0)1.623,02610,3110.35 (+0.1)0
GET/api/v3/purl?q=purl:ty=rpm&total=true175 (+24)0 (0)0%133 (-32.7)1.483,56610,1730.29 (0)0
GET/api/v3/purl?sort=purl:name:asc&total=true205 (+51)0 (0)0%40.5 (-14.9)1.6050111,1010.34 (+0.1)0
GET/api/v3/purl?total=true201 (+34)0 (0)0%19.6 (-21.2)1.4265310,2060.34 (+0.1)0
license 9
GET/api/v3/license/spdx/license/{license_id}2,101 (+266)0 (0)0%41.6 (+0.2)0.9061.01,1433.51 (+0.4)0
GET/api/v3/license/spdx/license?q=apache&total=true2,034 (+289)0 (0)0%2.07 (-0.8)0.7117.71653.40 (+0.5)0
GET/api/v3/license/spdx/license?q=gpl&total=true2,116 (+271)0 (0)0%41.4 (-0.3)0.8762.01,9813.53 (+0.5)0
GET/api/v3/license/spdx/license?total=true2,111 (+213)0 (0)0%41.2 (-0.5)1.0765.81,5253.52 (+0.4)0
GET/api/v3/license?limit=10&sort=license:asc&total=true2,063 (+236)0 (0)0%27.4 (-8.9)3.633044253.44 (+0.4)0
GET/api/v3/license?q=ASL&sort=license:desc&total=true2,089 (+280)0 (0)0%23.4 (-7.4)2.42191223.49 (+0.5)0
GET/api/v3/license?q=license~Apache&total=true2,063 (+265)0 (0)0%20.9 (-6.6)1.851011203.44 (+0.4)0
GET/api/v3/license?q=license~GPL&total=true2,052 (+215)0 (0)0%20.4 (-5.9)1.7897.1923.43 (+0.4)0
GET/api/v3/license?total=true2,001 (+231)0 (0)0%65.2 (-7.2)5.542581,1013.34 (+0.4)0
analysis 3
GET/api/v3/analysis/component/{component}23,466 (+9,854)0 (0)0%8.09 (-5.9)0.9996.32539.18 (+16.5)0
GET/api/v3/analysis/latest/component/{cpe}23,240 (+9,650)0 (0)0%8.17 (-6.3)0.9999.12538.81 (+16.1)0
GET/api/v3/analysis/status23,408 (+9,873)0 (0)0%8.07 (-5.4)0.9310010339.09 (+16.5)0
importer 1
GET/api/v3/importer?total=true83,040 (+32,946)0 (0)0%6.71 (-4.4)0.731712138.66 (+55.1)0
group 3
GET/api/v3/group/sbom?parents=resolve&total=true23,702 (+8,497)0 (0)0%7.73 (-4.7)0.891013839.58 (+14.2)0
GET/api/v3/group/sbom?total=true23,823 (+8,489)0 (0)0%7.93 (-4.3)0.8792.72239.78 (+14.2)0
GET/api/v3/group/sbom?totals=true&total=true23,896 (+8,525)0 (0)0%7.97 (-4.2)0.871062239.90 (+14.3)0
labels 3
GET/api/v3/advisory-labels?filter_text=type&limit=1000142 (+47)0 (0)0%3,932 (-1,891.1)2,8884,991600.24 (+0.1)0
GET/api/v3/sbom-labels?limit=10&filter_text=&total=true107 (+13)0 (0)0%61.4 (-7.6)13.81211,0650.18 (0)0
GET/api/v3/sbom-labels?total=true117 (+27)0 (0)0%63.5 (-3.7)4.662351,0650.20 (0)0
other 2
GET/.well-known/trustify13,592 (+324)0 (0)0%41.3 (-0.2)0.6977.81,17322.70 (+0.6)0
POST/api/v3/ui/extract-sbom-purls13,504 (+156)0 (0)0%1.83 (-0.6)0.6531.64522.55 (+0.3)0

Response time metrics (ms)

MethodName50%ile75%ile90%ile95%ile99%ile100%ile
sbom 16
GET/api/v3/sbom/by-package?purl={purl}66 (-44)120 (-10)130 (-10)140 (-70)220 (-10)220 (-10)
GET/api/v3/sbom/count-by-package8 (-5)51 (-8)70 (-7)74 (-4)78 (-12)80 (-12)
GET/api/v3/sbom/{sbom_id}110 (-20)130 (-20)150 (-60)210 (-10)230 (0)280 (+50)
GET/api/v3/sbom/{sbom_id}/all-license-ids5 (-3)18 (-29)54 (-12)68 (-10)73 (-15)81 (-7)
GET/api/v3/sbom/{sbom_id}/download2,300 (-700)2,300 (-800)2,400 (-700)2,400 (-700)2,400 (-800)2,500 (-900)
GET/api/v3/sbom/{sbom_id}/license-export11 (-3)52 (-14)72 (-8)82 (0)90 (-10)94 (-6)
GET/api/v3/sbom/{sbom_id}/packages91 (-19)170 (-90)260 (-40)290 (-20)380 (-20)690 (+290)
GET/api/v3/sbom/{sbom_id}/related100 (-20)160 (-40)210 (-60)270 (-20)450 (+140)550 (+240)
GET/api/v3/sbom?limit=10&sort=name:asc&total=true200 (0)310 (-10)460 (+30)510 (+20)1,100 (+210)1,200 (+290)
GET/api/v3/sbom?offset=100&limit=10&total=true100 (-70)260 (0)380 (-40)420 (-90)600 (-20)800 (0)
GET/api/v3/sbom?q=label:type=product&total=true5 (-4)30 (-22)59 (-9)64 (-6)72 (-7)81 (+2)
GET/api/v3/sbom?q=license~GPL&sort=name:desc&total=true6 (-4)38 (-27)61 (-14)70 (-7)77 (-7)81 (-3)
GET/api/v3/sbom?q=name~redhat&total=true690 (+530)960 (-140)1,200 (0)1,300 (0)1,400 (-100)1,900 (+400)
GET/api/v3/sbom?q=published>2024-01-01&total=true100 (-60)190 (-80)310 (-80)420 (-180)760 (-130)800 (-90)
GET/api/v3/sbom?sort=ingested:desc&total=true160 (-40)320 (-80)490 (-30)630 (-50)880 (+30)920 (-280)
GET/api/v3/sbom?total=true95 (-35)170 (-30)320 (-20)410 (-80)550 (-250)1,000 (+190)
advisory 13
GET/api/v3/advisory/urn:uuid:{advisory_id}45 (-2)48 (-28)97 (-13)100 (-10)120 (0)120 (-10)
GET/api/v3/advisory/urn:uuid:{advisory_id}/download10 (-4)20 (-26)65 (-7)72 (-6)80 (-6)90 (-10)
GET/api/v3/advisory?deprecated=Consider&total=true11 (-6)47 (-22)71 (-9)78 (-12)1,500 (-700)3,400 (+700)
GET/api/v3/advisory?limit=1&total=true47 (-2)65 (-14)99 (-1)110 (0)760 (+360)1,000 (+60)
GET/api/v3/advisory?limit=10&sort=ingested:desc&total=true9 (-3)50 (-9)68 (-9)76 (-7)1,500 (-400)2,800 (+100)
GET/api/v3/advisory?offset=100&limit=10&total=true44 (-25)80 (-7)92 (-3)110 (+10)250 (-40)1,400 (-1,300)
GET/api/v3/advisory?offset={offset}&limit=1200 (-10)320 (0)460 (-30)580 (-20)720 (-80)1,200 (+200)
GET/api/v3/advisory?q=CVE-2021-&total=true130 (-60)280 (-70)910 (-390)1,200 (-600)1,600 (-700)2,700 (-500)
GET/api/v3/advisory?q=identifier=CVE-2022-0981&total=true46 (-1)57 (-21)100 (-10)110 (0)120 (0)140 (0)
GET/api/v3/advisory?q=modified>3 days ago&total=true5 (-3)16 (-23)62 (-4)68 (-3)77 (-2)91 (+5)
GET/api/v3/advisory?q=title~openssl&total=true15 (-10)58 (-15)74 (-10)82 (-10)180 (0)430 (+120)
GET/api/v3/advisory?sort=modified:desc&total=true10 (-5)50 (-15)70 (-8)77 (-9)1,100 (-1,000)2,600 (-100)
GET/api/v3/advisory?total=true90 (-9)100 (-10)170 (0)200 (+20)500 (+300)2,300 (0)
vulnerability 7
POST/api/v3/vulnerability/analyze66 (-1)970 (-530)2,000 (-600)2,600 (-600)3,300 (-700)4,600 (-600)
GET/api/v3/vulnerability?offset=100&limit=10&total=true45 (-1)48 (-2)87 (-8)100 (-10)660 (+130)850 (+80)
GET/api/v3/vulnerability?q=base_score>=7.0&total=true5 (-3)8 (-7)56 (-6)70 (-6)580 (-10)1,700 (+930)
GET/api/v3/vulnerability?q=base_severity=high&total=true6 (-2)9 (-31)56 (-13)68 (-212)550 (-650)1,600 (+200)
GET/api/v3/vulnerability?q=cwes=CWE-79&total=true5 (-4)9 (-36)55 (-20)68 (-212)620 (-250)1,300 (+200)
GET/api/v3/vulnerability?sort=base_score:desc&total=true390 (-110)590 (-100)840 (-150)1,100 (-200)2,000 (+100)2,800 (+500)
GET/api/v3/vulnerability?total=true5 (-2)8 (-6)43 (-23)62 (-11)330 (-150)490 (-410)
purl 15
GET/api/v3/purl/base/{purl}56 (-2)120 (-30)200 (-10)270 (+40)350 (-40)410 (+20)
GET/api/v3/purl/base?q=namespace=redhat&total=true44 (-2)69 (-9)95 (-4)100 (0)630 (-230)970 (+50)
GET/api/v3/purl/base?q=type=rpm&total=true44 (-2)67 (-8)98 (+2)100 (0)110 (-10)110 (-20)
GET/api/v3/purl/base?sort=name:asc&total=true47 (-153)80 (-150)100 (-210)110 (-220)190 (-230)310 (-120)
GET/api/v3/purl/base?total=true44 (-2)61 (-26)93 (-7)100 (-10)160 (-30)220 (+20)
POST/api/v3/purl/recommend780 (-180)930 (-270)1,000 (-300)1,100 (-400)1,300 (-400)1,400 (-500)
GET/api/v3/purl/{purl_id}66 (-18)87 (-13)130 (-30)170 (0)300 (+90)320 (+60)
GET/api/v3/purl?offset=100&limit=10&total=true44 (-2)70 (-11)91 (-9)100 (-10)420 (-210)460 (-190)
GET/api/v3/purl?q=curl&total=true9 (-22)54 (-9)160 (+81)400 (-360)1,100 (0)1,900 (+600)
GET/api/v3/purl?q=license~GPLv3+...&sort=name:desc&total=true9 (-13)47 (-8)62 (-6)72 (-3)81 (-1)84 (+2)
GET/api/v3/purl?q=name=curl&total=true7 (-4)40 (-11)60 (-6)80 (-3)220 (+20)260 (+50)
GET/api/v3/purl?q=purl:namespace=redhat&total=true5 (-3)35 (-13)58 (-3)64 (-1,536)2,700 (-400)3,000 (-500)
GET/api/v3/purl?q=purl:ty=rpm&total=true4 (-11)43 (-4)59 (-7)580 (-1,220)2,700 (-300)3,600 (+600)
GET/api/v3/purl?sort=purl:name:asc&total=true9 (-4)46 (-11)64 (-6)160 (-250)470 (-110)500 (-170)
GET/api/v3/purl?total=true4 (-3)19 (-23)53 (-7)58 (-14)77 (-693)650 (-150)
license 9
GET/api/v3/license/spdx/license/{license_id}42 (0)43 (0)44 (0)44 (-1)51 (-3)61 (-7)
GET/api/v3/license/spdx/license?q=apache&total=true2 (-1)3 (-1)3 (-2)4 (-2)5 (-3)18 (-23)
GET/api/v3/license/spdx/license?q=gpl&total=true42 (-1)43 (-1)44 (-1)44 (-2)50 (-4)62 (-8)
GET/api/v3/license/spdx/license?total=true42 (-1)43 (0)44 (0)44 (-1)53 (-2)66 (-5)
GET/api/v3/license?limit=10&sort=license:asc&total=true13 (-12)49 (-10)63 (-13)73 (-9)84 (-6)300 (+180)
GET/api/v3/license?q=ASL&sort=license:desc&total=true9 (-7)46 (-7)59 (-9)66 (-10)76 (-11)190 (+90)
GET/api/v3/license?q=license~Apache&total=true7 (-5)41 (-8)57 (-7)64 (-9)77 (-4)100 (+1)
GET/api/v3/license?q=license~GPL&total=true7 (-5)40 (-8)57 (-5)62 (-9)74 (-5)97 (-2)
GET/api/v3/license?total=true52 (-8)89 (-6)100 (-10)110 (-10)120 (-10)260 (+10)
analysis 3
GET/api/v3/analysis/component/{component}3 (-2)4 (-3)7 (-57)62 (-8)72 (-6)96 (-84)
GET/api/v3/analysis/latest/component/{cpe}3 (-2)4 (-3)8 (-57)63 (-8)72 (-6)99 (-71)
GET/api/v3/analysis/status3 (-2)4 (-3)7 (-56)62 (-8)72 (-6)100 (-70)
importer 1
GET/api/v3/importer?total=true2 (-2)3 (-2)5 (-52)58 (-9)71 (-4)170 (-10)
group 3
GET/api/v3/group/sbom?parents=resolve&total=true3 (-1)4 (-2)7 (-54)61 (-7)71 (-4)100 (-10)
GET/api/v3/group/sbom?total=true3 (-1)4 (-2)7 (-54)62 (-6)72 (-3)93 (-3)
GET/api/v3/group/sbom?totals=true&total=true3 (-1)4 (-2)7 (-53)62 (-6)71 (-4)110 (+11)
labels 3
GET/api/v3/advisory-labels?filter_text=type&limit=10003,900 (-1,900)4,200 (-1,900)4,400 (-2,000)4,600 (-2,000)4,900 (-1,800)5,000 (-1,700)
GET/api/v3/sbom-labels?limit=10&filter_text=&total=true47 (-5)79 (-18)100 (-20)110 (-10)110 (-10)120 (0)
GET/api/v3/sbom-labels?total=true47 (-5)81 (-6)110 (0)110 (-10)120 (0)230 (+110)
other 2
GET/.well-known/trustify42 (0)43 (0)43 (-1)44 (-1)51 (-5)78 (+6)
POST/api/v3/ui/extract-sbom-purls1 (0)2 (-1)3 (-2)4 (-2)6 (-2)32 (-9)

Failures

No failures recorded.

Exceptions

No exceptions raised in the locustfile.