Get lockfile analysis status
Return the latest complete job snapshot. The result_url is present in every state; only state=succeeded means the result is ready. Snapshots are full replacements. The associated events stream sends every update with a nondecreasing but nonunique revision, so state or attempt may change at an equal revision; clients must apply each event and must not deduplicate by ID or revision. Reconnecting returns only the latest snapshot and does not replay earlier events. An unknown, expired or other-owner job returns the same 404 response.
curl --request GET \
--url https://api.githits.dev/v1/experimental/lockfile-jobs/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/experimental/lockfile-jobs/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/experimental/lockfile-jobs/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/lockfile-jobs/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"attempt": 1,
"counts": {
"cached": 7,
"coordinates_done": 18,
"coordinates_total": 37,
"fetch_failed": 0,
"fetched": 11,
"manifests_done": 2,
"manifests_total": 2,
"queued_packages": 9,
"resolved": 37
},
"error": null,
"expires_at": "2026-10-10T12:00:00Z",
"format": "cyclonedx",
"id": "01900000-0000-7000-8000-000000000001",
"kind": "sbom",
"phase": "enriching",
"result_url": "/v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result",
"revision": 3,
"state": "running"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.
1 - 64^[A-Za-z0-9_-]{1,64}$Path Parameters
Hyphenated UUID returned when the job was accepted.
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$Response
Latest full snapshot of the job.
The complete current projection of a lockfile analysis job. Each event is a full replacement snapshot. Revision values are nondecreasing but not unique; apply every snapshot, including state or attempt changes at an equal revision, and do not deduplicate by job ID or revision.
Current execution attempt number; it may change while the revision remains equal.
x >= 01
Stage-dependent progress counters. Fields are optional and omitted until the corresponding stage provides a value.
Show child attributes
Show child attributes
Allowlisted terminal failure code, or null when no terminal error is recorded. Internal diagnostics are never included.
resolution_timeout, resolution_failed, output_too_large, unrepresentable_spdx, parser_contract_changed, execution_failed, execution_record_unavailable, invalid_response, no_manifest_evidence Time after which the job and its result are no longer available.
"2026-10-10T12:00:00Z"
Requested output format for the completed document.
cyclonedx, spdx, text Opaque UUID identifying this analysis job.
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$"01900000-0000-7000-8000-000000000001"
Analysis kind; this experimental job endpoint currently supports SBOM analysis only.
sbom "sbom"
Current analysis stage.
queued, resolving, enriching, rendering, succeeded, failed "enriching"
Canonical relative URL for retrieving the result. This field is always present; only state=succeeded indicates that the result is ready.
^/v1/experimental/lockfile-jobs/[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/result$"/v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result"
Nondecreasing job revision. Distinct full snapshots may share a revision, so it is not an event deduplication key.
x >= 03
Current job state. The result is ready only when state is succeeded.
queued, running, succeeded, failed "running"
curl --request GET \
--url https://api.githits.dev/v1/experimental/lockfile-jobs/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/experimental/lockfile-jobs/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/lockfile-jobs/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/experimental/lockfile-jobs/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/lockfile-jobs/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"attempt": 1,
"counts": {
"cached": 7,
"coordinates_done": 18,
"coordinates_total": 37,
"fetch_failed": 0,
"fetched": 11,
"manifests_done": 2,
"manifests_total": 2,
"queued_packages": 9,
"resolved": 37
},
"error": null,
"expires_at": "2026-10-10T12:00:00Z",
"format": "cyclonedx",
"id": "01900000-0000-7000-8000-000000000001",
"kind": "sbom",
"phase": "enriching",
"result_url": "/v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result",
"revision": 3,
"state": "running"
}