> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Get lockfile analysis status > Return the latest complete job snapshot. The result_url is present in every state; only state=succeeded means the result is ready. Snapshots are full replacements. The associated events stream sends every update with a nondecreasing but nonunique revision, so state or attempt may change at an equal revision; clients must apply each event and must not deduplicate by ID or revision. Reconnecting returns only the latest snapshot and does not replay earlier events. An unknown, expired or other-owner job returns the same 404 response. ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json get /v1/experimental/lockfile-jobs/{id} openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation or source code | Browse with list, then follow an exact action through the unified read operation | | Browse known content | List source files, local documentation, or an explicit hosted site | | Find exact text | Grep across ordered packages, repositories and hosted sites, then follow exact read actions | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Research a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Generate an SBOM | Upload manifests and lockfiles to receive a CycloneDX, SPDX or text inventory | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`; development uses `https://api-dev.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Standard SBOM documents retain their format's field names. Percent-encode path parameters such as package names as one path segment, including any embedded slash. The unified read target is a query value: encode a literal plus sign as `%2B` and a literal fragment marker as `%23`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`; job events use `no-store, no-transform` to preserve streaming. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Research, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Find exact text across ordered source and hosted-documentation scopes, check coverage, and follow exact reads. name: Grep - description: >- Browse package, repository or hosted-site paths and follow exact read and browse actions. name: List - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Read an exact documentation page or source file and retain the page, package-version or repository-commit details needed to cite it. name: Read - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: Stable exact-tree source comparison. name: Code Diff - description: >- Preview target resolution, cited questions and SBOM generation, plus the deprecated source comparison alias. Use /v1/code/diff for stable source comparison. name: Experimental paths: /v1/experimental/lockfile-jobs/{id}: get: tags: - Experimental summary: Get lockfile analysis status description: >- Return the latest complete job snapshot. The result_url is present in every state; only state=succeeded means the result is ready. Snapshots are full replacements. The associated events stream sends every update with a nondecreasing but nonunique revision, so state or attempt may change at an equal revision; clients must apply each event and must not deduplicate by ID or revision. Reconnecting returns only the latest snapshot and does not replay earlier events. An unknown, expired or other-owner job returns the same 404 response. operationId: lockfile_job_status parameters: - description: Hyphenated UUID returned when the job was accepted. in: path name: id required: true schema: format: uuid pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created. in: header name: X-GitHits-Session-ID required: false schema: maxLength: 64 minLength: 1 pattern: ^[A-Za-z0-9_-]{1,64}$ type: string responses: '200': content: application/json: example: attempt: 1 counts: cached: 7 coordinates_done: 18 coordinates_total: 37 fetch_failed: 0 fetched: 11 manifests_done: 2 manifests_total: 2 queued_packages: 9 resolved: 37 error: null expires_at: '2026-10-10T12:00:00Z' format: cyclonedx id: 01900000-0000-7000-8000-000000000001 kind: sbom phase: enriching result_url: >- /v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result revision: 3 state: running schema: $ref: '#/components/schemas/LockfileJobSnapshot' description: Latest full snapshot of the job. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '400': content: application/problem+json: examples: invalid_session_id: value: code: INVALID_SESSION_ID detail: >- X-GitHits-Session-ID must occur once and match [A-Za-z0-9_-]{1,64}. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Invalid session ID type: about:blank validation: value: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- VALIDATION_ERROR INVALID_SESSION_ID: a supplied session header is invalid or duplicated. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: AUTHENTICATION_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer authentication challenge. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: FORBIDDEN, ACCOUNT_INACTIVE, TERMS_ACCEPTANCE_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '404': content: application/problem+json: example: code: ANALYSIS_NOT_FOUND detail: The analysis is unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 404 title: Analysis not found type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: ANALYSIS_NOT_FOUND headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: GET, HEAD.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: RATE_LIMITED headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: Validated delay or HTTP-date for quota reset, when available. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '500': description: >- Request identity could not be created. Empty body without X-Request-ID; no problem object is available. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UPSTREAM_ERROR headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '503': content: application/problem+json: example: code: ANALYSIS_UNAVAILABLE detail: Analysis is temporarily unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 503 title: Analysis unavailable type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: ANALYSIS_UNAVAILABLE, UPSTREAM_UNAVAILABLE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: TIMEOUT headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string security: - bearer_auth: [] components: schemas: LockfileJobSnapshot: additionalProperties: false description: >- The complete current projection of a lockfile analysis job. Each event is a full replacement snapshot. Revision values are nondecreasing but not unique; apply every snapshot, including state or attempt changes at an equal revision, and do not deduplicate by job ID or revision. example: attempt: 1 counts: cached: 7 coordinates_done: 18 coordinates_total: 37 fetch_failed: 0 fetched: 11 manifests_done: 2 manifests_total: 2 queued_packages: 9 resolved: 37 error: null expires_at: '2026-10-10T12:00:00Z' format: cyclonedx id: 01900000-0000-7000-8000-000000000001 kind: sbom phase: enriching result_url: >- /v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result revision: 3 state: running properties: attempt: description: >- Current execution attempt number; it may change while the revision remains equal. example: 1 minimum: 0 type: integer counts: additionalProperties: false description: >- Stage-dependent progress counters. Fields are optional and omitted until the corresponding stage provides a value. properties: cached: description: Number of coordinates whose metadata was served from cache. example: 7 minimum: 0 type: integer coordinates_done: description: Number of package coordinates processed for enrichment. example: 18 minimum: 0 type: integer coordinates_total: description: Total package coordinates counted for enrichment. example: 37 minimum: 0 type: integer fetch_failed: description: Number of coordinates whose metadata fetch failed. example: 0 minimum: 0 type: integer fetched: description: >- Number of coordinates fetched from their registry or metadata source. example: 11 minimum: 0 type: integer manifests_done: description: Number of uploaded manifests completed by resolution. example: 2 minimum: 0 type: integer manifests_total: description: Total uploaded manifests counted for resolution. example: 2 minimum: 0 type: integer queued_packages: description: Number of package coordinates queued for metadata enrichment. example: 9 minimum: 0 type: integer resolved: description: Number of dependencies resolved from manifests. example: 37 minimum: 0 type: integer type: object error: description: >- Allowlisted terminal failure code, or null when no terminal error is recorded. Internal diagnostics are never included. oneOf: - enum: - resolution_timeout - resolution_failed - output_too_large - unrepresentable_spdx - parser_contract_changed - execution_failed - execution_record_unavailable - invalid_response - no_manifest_evidence type: string - type: 'null' expires_at: description: Time after which the job and its result are no longer available. example: '2026-10-10T12:00:00Z' format: date-time type: string format: description: Requested output format for the completed document. enum: - cyclonedx - spdx - text type: string id: description: Opaque UUID identifying this analysis job. example: 01900000-0000-7000-8000-000000000001 format: uuid pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string kind: description: >- Analysis kind; this experimental job endpoint currently supports SBOM analysis only. enum: - sbom example: sbom type: string phase: description: Current analysis stage. enum: - queued - resolving - enriching - rendering - succeeded - failed example: enriching type: string result_url: description: >- Canonical relative URL for retrieving the result. This field is always present; only state=succeeded indicates that the result is ready. example: >- /v1/experimental/lockfile-jobs/01900000-0000-7000-8000-000000000001/result format: uri-reference pattern: >- ^/v1/experimental/lockfile-jobs/[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/result$ type: string revision: description: >- Nondecreasing job revision. Distinct full snapshots may share a revision, so it is not an event deduplication key. example: 3 minimum: 0 type: integer state: description: Current job state. The result is ready only when state is succeeded. enum: - queued - running - succeeded - failed example: running type: string required: - id - kind - format - state - attempt - phase - counts - error - result_url - expires_at - revision type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: Link for accepting the required terms, when provided. type: string code: description: The stable uppercase API error code. type: string detail: description: A stable, client-safe explanation of the failure. type: string instance: description: The active request trace ID. type: string status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: Link to the terms that require acceptance, when provided. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object securitySchemes: bearer_auth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.