> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Download a completed lockfile analysis > Download the completed document in the format selected at submission. Only state=succeeded indicates that the result is ready. The response format is determined by the upstream's allowlisted media type; Accept does not select it. The document is checked using the same format-specific validation as synchronous /v1/experimental/sbom and is bounded to 16,777,216 bytes. Pending jobs return 409 ANALYSIS_PENDING. Failed jobs return 409 ANALYSIS_FAILED with an allowlisted failure_code and a fixed safe detail; backend diagnostics are not returned. Missing, expired and other-owner job IDs produce the same 404 response. ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json get /v1/experimental/lockfile-jobs/{id}/result openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation or source code | Browse with list, then follow an exact action through the unified read operation | | Browse known content | List source files, local documentation, or an explicit hosted site | | Find exact text | Grep across ordered packages, repositories and hosted sites, then follow exact read actions | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Research a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Generate an SBOM | Upload manifests and lockfiles to receive a CycloneDX, SPDX or text inventory | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`; development uses `https://api-dev.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Standard SBOM documents retain their format's field names. Percent-encode path parameters such as package names as one path segment, including any embedded slash. The unified read target is a query value: encode a literal plus sign as `%2B` and a literal fragment marker as `%23`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`; job events use `no-store, no-transform` to preserve streaming. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Research, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Find exact text across ordered source and hosted-documentation scopes, check coverage, and follow exact reads. name: Grep - description: >- Browse package, repository or hosted-site paths and follow exact read and browse actions. name: List - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Read an exact documentation page or source file and retain the page, package-version or repository-commit details needed to cite it. name: Read - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: Stable exact-tree source comparison. name: Code Diff - description: >- Preview target resolution, cited questions and SBOM generation, plus the deprecated source comparison alias. Use /v1/code/diff for stable source comparison. name: Experimental paths: /v1/experimental/lockfile-jobs/{id}/result: get: tags: - Experimental summary: Download a completed lockfile analysis description: >- Download the completed document in the format selected at submission. Only state=succeeded indicates that the result is ready. The response format is determined by the upstream's allowlisted media type; Accept does not select it. The document is checked using the same format-specific validation as synchronous /v1/experimental/sbom and is bounded to 16,777,216 bytes. Pending jobs return 409 ANALYSIS_PENDING. Failed jobs return 409 ANALYSIS_FAILED with an allowlisted failure_code and a fixed safe detail; backend diagnostics are not returned. Missing, expired and other-owner job IDs produce the same 404 response. operationId: lockfile_job_result parameters: - description: Hyphenated UUID returned when the job was accepted. in: path name: id required: true schema: format: uuid pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created. in: header name: X-GitHits-Session-ID required: false schema: maxLength: 64 minLength: 1 pattern: ^[A-Za-z0-9_-]{1,64}$ type: string responses: '200': content: application/vnd.cyclonedx+json: example: bomFormat: CycloneDX components: [] compositions: - aggregate: incomplete assemblies: [] metadata: timestamp: '2026-09-09T00:00:00Z' properties: - name: githits:completeness value: partial_manifest_inventory serialNumber: urn:uuid:00000000-0000-4000-8000-000000000001 specVersion: '1.7' version: 1 schema: $ref: '#/components/schemas/SbomCycloneDxInventory' text/plain: example: > GitHits dependency inventory report Notice: Recorded lockfile inventory, not an exact installed build or a compliance assertion. Report ID: sbom-fixture-report Generated: 2026-09-09T00:00:00Z Entries: 1 Locked packages: 1 Uploaded roots: 0 Structural records: 0 Resolved packages: 0 Document facts: completeness: "recorded_lockfile_inventory" Package: "dep" ID: locked-dep-1.2.0 Known version: "1.2.0" License: unknown record_kind: "locked_package" schema: pattern: ^GitHits (manifest|dependency) inventory report\n type: string text/spdx: example: > SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: GitHits dependency inventory DocumentNamespace: urn:uuid:24e6d898-af42-4113-b174-7388662d8648 Creator: Tool: GitHits Created: 2026-09-05T12:00:00Z DocumentComment: {"completeness":"recorded_lockfile_inventory","declarations":"[]","lockfiles":"[{\"path\":\"package-lock.json\",\"format\":\"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK\",\"context\":{\"categories\":[],\"requires_python\":\"\",\"resolution_markers\":[],\"provided_extras\":[],\"gradle_configurations\":[],\"supported_markers\":[],\"required_markers\":[],\"dart_sdk_constraints\":[],\"python_version\":\"\",\"bundler_platforms\":[],\"python_full_version\":\"\",\"python_targets\":[],\"nuget_targets\":[]},\"format_version\":0,\"dependency_count\":0,\"completeness\":\"LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY\",\"root_package_ids\":[1],\"format_revision\":null,\"native_format_version\":\"\",\"association_status\":\"standalone\",\"checksum_count\":0,\"manifest_lock_consistency\":\"not_checked\",\"manifest_paths\":[],\"omitted_context_counts\":{\"conflicts\":0,\"bundler_tool_checksums\":0,\"composer_platform_overrides\":0,\"conan_overrides\":0,\"conan_inventories\":0,\"composer_aliases\":0,\"conan_aliases\":0,\"poetry_checksum_sets\":0,\"dep_input_imports\":0},\"package_count\":3,\"projection_notices\":[\"relationships_not_projected\",\"integrity_not_projected\",\"resolution_context_not_projected\"],\"requirement_count\":0,\"structural_count\":1,\"structural_records\":[{\"id\":3,\"name\":\"\",\"version\":\"\",\"context\":{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"},\"role\":\"LOCKED_PACKAGE_ROLE_IMPORTER\",\"source_kind\":\"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY\"}]},{\"path\":\"nested/package-lock.json\",\"format\":\"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK\",\"context\":{\"categories\":[],\"requires_python\":\"\",\"resolution_markers\":[],\"provided_extras\":[],\"gradle_configurations\":[],\"supported_markers\":[],\"required_markers\":[],\"dart_sdk_constraints\":[],\"python_version\":\"\",\"bundler_platforms\":[],\"python_full_version\":\"\",\"python_targets\":[],\"nuget_targets\":[]},\"format_version\":0,\"dependency_count\":0,\"completeness\":\"LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY\",\"root_package_ids\":[1],\"format_revision\":null,\"native_format_version\":\"\",\"association_status\":\"standalone\",\"checksum_count\":0,\"manifest_lock_consistency\":\"not_checked\",\"manifest_paths\":[],\"omitted_context_counts\":{\"conflicts\":0,\"bundler_tool_checksums\":0,\"composer_platform_overrides\":0,\"conan_overrides\":0,\"conan_inventories\":0,\"composer_aliases\":0,\"conan_aliases\":0,\"poetry_checksum_sets\":0,\"dep_input_imports\":0},\"package_count\":1,\"projection_notices\":[\"relationships_not_projected\",\"integrity_not_projected\",\"resolution_context_not_projected\"],\"requirement_count\":0,\"structural_count\":0,\"structural_records\":[]}]","manifest_associations":"{}","notice":"Recorded conditional lockfile inventory, not an exact installed build or a compliance assertion. Manifest/lock consistency is not checked. Relationships and integrity are not projected. Licenses are uploaded-root or public-registry coordinate declarations, not source-artifact verification or legal conclusions.","resolution_basis":"lockfile_records","resolutions":"[]"} PackageName: dep SPDXID: SPDXRef-locked-42925864b1614adf48873a749eb88299882ddee203e2ac218e962986df33f40d PackageVersion: 1.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: MIT PackageLicenseComments: {"license":"MIT","source":"registry_declared"} PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","license_artifact_verification":"not_checked","license_catalog_version":"3.28.0","license_expression":"MIT","license_raw":"MIT","license_source":"registry_declared","license_status":"expression","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"package-lock.json","metadata_status":"available","package_id":"1","record_kind":"locked_package","registry":"npm","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY"} PackageName: dep SPDXID: SPDXRef-locked-4d058b03a8843e670ab6222627b94be44647ce35eb7f5e824c7760a5e9b6726d PackageVersion: 1.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: MIT PackageLicenseComments: {"license":"MIT","source":"registry_declared"} PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","license_artifact_verification":"not_checked","license_catalog_version":"3.28.0","license_expression":"MIT","license_raw":"MIT","license_source":"registry_declared","license_status":"expression","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"nested/package-lock.json","metadata_status":"available","package_id":"1","record_kind":"locked_package","registry":"npm","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY"} PackageName: local-dep SPDXID: SPDXRef-locked-e738e69432f53950a50dcf2514b6cefda5315365b7f94e9f661196b4e8d087dc PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"package-lock.json","metadata_reason":"missing_coordinate","metadata_status":"not_eligible","package_id":"2","record_kind":"locked_package","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_LOCAL"} Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-42925864b1614adf48873a749eb88299882ddee203e2ac218e962986df33f40d Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-4d058b03a8843e670ab6222627b94be44647ce35eb7f5e824c7760a5e9b6726d Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-e738e69432f53950a50dcf2514b6cefda5315365b7f94e9f661196b4e8d087dc schema: pattern: '^SPDXVersion: SPDX-2\.3\n' type: string description: >- The completed UTF-8 analysis document in the format selected at submission. The document has passed the same format-specific validation as the synchronous SBOM response and is at most 16,777,216 bytes. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '400': content: application/problem+json: examples: invalid_session_id: value: code: INVALID_SESSION_ID detail: >- X-GitHits-Session-ID must occur once and match [A-Za-z0-9_-]{1,64}. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Invalid session ID type: about:blank validation: value: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- VALIDATION_ERROR INVALID_SESSION_ID: a supplied session header is invalid or duplicated. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: AUTHENTICATION_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer authentication challenge. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: FORBIDDEN, ACCOUNT_INACTIVE, TERMS_ACCEPTANCE_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '404': content: application/problem+json: example: code: ANALYSIS_NOT_FOUND detail: The analysis is unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 404 title: Analysis not found type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: ANALYSIS_NOT_FOUND headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: GET, HEAD.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '409': content: application/problem+json: example: code: ANALYSIS_PENDING detail: The analysis has not finished. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 409 title: Analysis request failed type: about:blank schema: oneOf: - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - ANALYSIS_PENDING type: string detail: enum: - The analysis has not finished. type: string title: enum: - Analysis request failed type: string required: - code - title - detail type: object - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - ANALYSIS_FAILED type: string detail: enum: - The analysis failed. type: string failure_code: description: >- Allowlisted terminal analysis failure; internal diagnostics are not included. enum: - resolution_timeout - resolution_failed - output_too_large - unrepresentable_spdx - parser_contract_changed - execution_failed - execution_record_unavailable - invalid_response - no_manifest_evidence type: string title: enum: - Analysis request failed type: string required: - code - title - detail - failure_code type: object description: ANALYSIS_PENDING, ANALYSIS_FAILED headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: RATE_LIMITED headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: Validated delay or HTTP-date for quota reset, when available. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '500': description: >- Request identity could not be created. Empty body without X-Request-ID; no problem object is available. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UPSTREAM_ERROR headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '503': content: application/problem+json: example: code: ANALYSIS_UNAVAILABLE detail: Analysis is temporarily unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 503 title: Analysis unavailable type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: ANALYSIS_UNAVAILABLE, UPSTREAM_UNAVAILABLE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: TIMEOUT headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string security: - bearer_auth: [] components: schemas: SbomCycloneDxInventory: additionalProperties: true description: >- Extensible CycloneDX 1.7 document. This schema describes a compatible subset, not the entire standard. Additional fields are allowed at every object level; clients must preserve or ignore unfamiliar data. Inventory and license completeness must be read from evidence, not inferred from this schema. properties: bomFormat: enum: - CycloneDX type: string components: description: >- Named project roots and dependency entries. Unresolved declarations remain in document properties rather than becoming package components. The array may be empty when no concrete packages or named roots are available. Separate lockfile occurrences may have the same name and version; do not deduplicate by those fields alone. items: $ref: '#/components/schemas/SbomComponent' type: array compositions: description: Completeness declaration for the listed component references. items: additionalProperties: true properties: aggregate: description: >- Reported completeness of the referenced inventory. Do not infer that additional fields establish completeness. type: string assemblies: description: >- References to entries in components, using each entry's bom-ref. items: type: string type: array required: - aggregate type: object type: array metadata: additionalProperties: true properties: timestamp: description: Time this document was generated. format: date-time type: string type: object properties: description: >- Document evidence. githits:completeness distinguishes resolved_manifest_inventory, partial_manifest_inventory, recorded_lockfile_inventory and mixed_dependency_inventory; none guarantees that every license is known. githits:resolution_basis distinguishes manifest_resolution, lockfile_records and lockfile_records_and_manifest_resolution. Inspect githits:resolutions for per-manifest outcomes, githits:declarations for original requirements, and githits:lockfiles and githits:manifest_associations for lockfile coverage. githits:notice summarizes limitations. items: $ref: '#/components/schemas/SbomProperty' type: array serialNumber: description: >- Unique identifier for this generated document. This URN is not a retrieval URL. pattern: >- ^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ type: string specVersion: enum: - '1.7' type: string version: description: Document revision, not a package version. minimum: 1 type: integer required: - bomFormat - specVersion type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: Link for accepting the required terms, when provided. type: string code: description: The stable uppercase API error code. type: string detail: description: A stable, client-safe explanation of the failure. type: string instance: description: The active request trace ID. type: string status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: Link to the terms that require acceptance, when provided. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object SbomComponent: additionalProperties: true description: >- An uploaded project root, a resolved dependency or a recorded lockfile package. Use githits:record_kind in properties to distinguish them. properties: bom-ref: description: >- Opaque component identifier used by references within this document. It is not a package URL or an artifact checksum. type: string licenses: description: >- Standard license choices: SPDX expressions or licenses identified by id or name, with optional acknowledgement and additional standard evidence. Preserve the original evidence; no license conclusion is inferred. items: oneOf: - additionalProperties: true properties: license: additionalProperties: true properties: id: description: SPDX license identifier. type: string name: description: >- License name, including free-text and proprietary names. type: string type: object required: - license type: object - additionalProperties: true properties: acknowledgement: description: >- Standard license acknowledgement, such as declared or concluded; preserve the reported value. type: string expression: description: >- Recognized SPDX license expression, including a single identifier such as MIT or a compound expression such as MIT OR Apache-2.0. This is a declaration, not a legal conclusion or artifact verification. type: string required: - expression type: object type: array name: description: >- Package or project name. Names are not unique across registries, versions or lockfile occurrences. type: string properties: description: >- Component evidence. githits:purl_basis=manifest_resolution identifies the basis of an emitted PURL. For resolved packages without a PURL, githits:purl_omission_reason is missing_identity_facets (required identity details unavailable), unsupported_registry (no supported PURL mapping), or invalid_coordinate (the coordinate cannot form a valid PURL). Other record kinds omit both facts. githits:record_kind distinguishes manifest, resolved_package and locked_package entries. githits:resolution_basis identifies how a dependency was selected. githits:metadata_status reports metadata availability, not license verification. Where present, githits:license_artifact_verification=not_checked means the specific source artifact or commit was not checked. items: $ref: '#/components/schemas/SbomProperty' type: array purl: description: >- Identifies a concrete package selected by manifest dependency resolution. Present for supported registry coordinates even when license metadata is unavailable. Omitted for uploaded roots, unresolved declarations and lockfile occurrences, and when required identity details are unavailable. Presence does not verify installed or artifact contents; it is not a download URL. Preserve bom-ref for document relationships and occurrences. examples: - pkg:npm/%40scope/dep@1.2.3 minLength: 1 pattern: '^pkg:' type: string type: description: >- CycloneDX component classification, such as library, application or container. Clients must allow new standard classifications. type: string version: description: >- Version declared by an uploaded project, selected during dependency resolution, or recorded in a lockfile. Omitted when unknown; omission does not mean the latest version. type: string required: - type - name type: object SbomProperty: additionalProperties: true description: >- Extensible standard property. Match by name rather than array position; ignore names your client does not recognize. examples: - name: githits:record_kind value: resolved_package - name: githits:manifest_paths value: '["app/package.json"]' properties: name: description: >- Property name. GitHits evidence uses the githits: namespace; other namespaces are also allowed. type: string value: description: >- Evidence value, always encoded as a string. Structured values such as githits:declarations, githits:resolutions, githits:lockfiles, githits:manifest_associations, githits:manifest_paths and githits:lockfile_paths contain JSON; decode those values separately when needed. type: string required: - name type: object securitySchemes: bearer_auth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.