Describe the bug
Trying to scan a Crates.io packages results in an error in Dejacode.
Product inventory. Tried to scan 2 that failed. 2 not yet scanned.

In the logs:
[dejacode_web] | INFO "GET /packages/nexB/9bf0a93b-7689-4439-bcb9-116fb8e02df7/tab_purldb/ HTTP/1.1" 200 1691
[dejacode_web] | INFO "GET /packages/nexB/9bf0a93b-7689-4439-bcb9-116fb8e02df7/scan/ HTTP/1.1" 302 0
[dejacode_nginx] | 10.89.2.13 - - [18/Aug/2026:18:00:46 +0000] "GET /packages/nexB/9bf0a93b-7689-4439-bcb9-116fb8e02df7/scan/ HTTP/1.1" 302 0 "http://localhost:8000/packages/nexB/pkg:cargo/allocator-api2@0.2.21/9bf0a93b-7689-4439-bcb9-116fb8e02df7/" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0" "-"
Trying to manually access http://localhost:8000/packages/nexB/pkg:cargo/allocator-api2@0.2.21/9bf0a93b-7689-4439-bcb9-116fb8e02df7/#scan shows:
The error shows:
Error: The URL https://crates.io/api/v1/crates/allocator-api2/0.2.21/download is not reachable.
However, it works from the browser.
Trying with Curl:
$ curl https://crates.io/api/v1/crates/allocator-api2/0.2.21/download
{"errors":[{"detail":"We are unable to process your request at this time. This usually means that you are in violation of our API data access policy (https://crates.io/data-access). Please email help@crates.io and provide the request id ada0085e-e429-4053-fc90-a8bc90cf6dcc"}]}
This seems to indicate that it is some rate limiting.
To Reproduce
Steps to reproduce the behavior:
- Go to DejaCode
- Import an SBOM with Rust dependencies from crates.io in it
- Trigger a scan on the Rust dependencies from crates.io
- See the error in the inventory page.
- Considering going to the page of the package to see the specific error page of the package to be scanned.
Expected behavior
- To have DejaCode actually be able to download the Crates.io files.
- Otherwise have a more explicit error that helps the user to conclude what is the underlying issue.
Screenshots
If applicable, add screenshots to help explain your problem.
Context (OS, Browser, Device, etc.):
Describe the bug
Trying to scan a Crates.io packages results in an error in Dejacode.
Product inventory. Tried to scan 2 that failed. 2 not yet scanned.

In the logs:
Trying to manually access http://localhost:8000/packages/nexB/pkg:cargo/allocator-api2@0.2.21/9bf0a93b-7689-4439-bcb9-116fb8e02df7/#scan shows:
The error shows:
However, it works from the browser.
Trying with Curl:
This seems to indicate that it is some rate limiting.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Screenshots
If applicable, add screenshots to help explain your problem.
Context (OS, Browser, Device, etc.):