Experimental
Preview a compact dependency-license report
Create a compact informational license report from manifests and lockfiles. This separate experimental operation returns schema_version: 2; the existing /v1/experimental/licenses operation continues returning schema 1. The compact report preserves package occurrences, reported choices, publisher context, source observations, input attribution and meaningful gaps, while omitting dependency adjacency, checksums and generic SBOM property containers. It does not evaluate license policy or certify installed artifacts.
First request
Use a Bearer credential for an active account with required terms accepted. /path/to/private-auth.conf below is your own protected curl configuration containing your authorization header, kept outside the repository.
curl --config /path/to/private-auth.conf \
--fail-with-body --silent --show-error \
--form 'files[]=@package.json;filename=package.json' \
--form 'files[]=@package-lock.json;filename=package-lock.json' \
--output license-report.json \
'https://api.githits.dev/v1/experimental/license-reports'
Repeat the literal files[] field and preserve each repository-relative filename, including directories. Let curl set the multipart content type and boundary. Only files are accepted: no query parameters, format/kind selectors, repository URLs, archives, base64 data or policy files. Accept does not select a report version.
The existing SBOM upload contract applies: 1–256 UTF-8 files, each at most 5,242,880 bytes, a total multipart request of at most 8,000,000 bytes, and relative filenames of at most 1,024 UTF-8 bytes without control characters, backslashes or dot/parent segments. Uploads have a 30-second deadline and synchronous analysis a 150-second budget. Unsupported or unusable files reject the upload. Supported manifest/lockfile families and companion-file restrictions are the same as Generate an SBOM (POST /v1/experimental/sbom).
Check curl’s exit status before treating the output file as a report: errors save an application/problem+json body there. Successful output is the report itself, without a job ID or retrieval URL. Repeating POST starts another analysis; a timeout does not establish that processing stopped.
Long-running work and evidence inspection
Use the existing POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx workflow for long-running work or when you need the original SBOM. Follow its status/events until success, then read GET /v1/experimental/license-reports/{id}. This is the same analysis and authorized CycloneDX result, not another generation or a new job kind. Existing job links, retention, authorization, quotas and billing apply. Generation uses the same analysis reservation as SBOM; the provisional operation cost is 1. Reading an existing report has operation cost 0 and starts no new analysis.
Read the compact report
- Keep separate component entries even when names, versions or PURLs match. Preserve supplied qualifiers/subpaths, source kinds and recorded source selectors/revisions. A local source does not establish first-party ownership, and a recorded revision does not prove that commit was inspected.
licensescontains reported choices;observed_licensescontains separate detections. Neither observations nor repository context substitute for reported choices. No AND/OR relation between separate choices or license alias is inferred.publisher_evidenceretains original statements, interpretation/issues and applicability. Its capture/coverage fields describe evidence limitations, not inventory or license completeness.source_evidenceretains detection service/method, module/version/URL, root/nested file paths, observations and latest-attempt history. An older observation can coexist with a failed latest attempt.inputs.manifest_pathsandinputs.lockfile_pathsare ordinary JSON string arrays. Purpose-specific structured fields are already decoded JSON: do not parse them as JSON strings. Reference comments retain original owner/scope context; reference and component digests remain available only in the original SBOM/schema-1 view.- Optional
license_evidenceholds independent acquisition/applicability facts. With canonical publisher evidence, interpretation and statements remain solely with that owner. Without it, manifest/legacy raw text, syntax/status and issues remain available here. No missing fact is filled with an empty or completed stand-in. - Metadata status/reason, resolution basis/limitations and PURL-omission reasons distinguish missing acquisition from ineligible or uncertain identity. Read
inventory.completeness,resolutions,coverage,dependency_coverage,lockfilesand notices together. Missing references, unfamiliar states, empty arrays and HTTP 200 never prove complete license or dependency coverage. inventory.declarationspreserves minimal original request names/inputs, including dependencies lost from the package inventory after a whole-manifest resolver failure. Declarations are not resolved package occurrences or graph edges. An absent requirement is unreported or withheld, never an unconstrained range. Agreement summaries retain named outcomes; empty matched-version lists do not prove there was no lock evidence. Detailed provider proofs remain in the original SBOM/schema-1 view.
Null means unreported/unavailable information. Empty choices mean no choices were reported, not that no license exists or every file was checked. Accept unfamiliar response strings and additive evidence instead of rejecting otherwise usable data. The report is at most 16,777,216 bytes; over-limit output is rejected without truncation. Jobs do not increase that limit.
Handle errors
Branch on the problem code, retain X-Request-ID, and respect Retry-After. Correct request/upload problems for 400/408/413/415 and unusable-file 422 responses. Authentication/account/terms errors retain their existing 401/403 contract. LICENSE_REPORT_TOO_LARGE or SBOM_OUTPUT_TOO_LARGE requires a smaller inventory or the original available job result. Keep request identity for persistent 502 errors. Retry reads of an existing job for transient failures instead of unconditionally repeating a charged POST. Responses use Cache-Control: no-store.
This is an experimental contract. Stable promotion is a separate acceptance step; it does not remove or reinterpret saved schema-1 reports.
POST
/
v1
/
experimental
/
license-reports
Preview a compact dependency-license report
curl --request POST \
--url https://api.githits.dev/v1/experimental/license-reports \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form 'files[]=@example-file;type=application/octet-stream'import requests
url = "https://api.githits.dev/v1/experimental/license-reports"
files = { "files[]": ("example-file", open("example-file", "rb"), "application/octet-stream") }
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('files[]', '<string>');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api.githits.dev/v1/experimental/license-reports', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/license-reports",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/license-reports"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.githits.dev/v1/experimental/license-reports")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/license-reports")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"components": [
{
"bom_ref": "root",
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": [
"app/package.json"
]
},
"license_evidence": {
"applicability_reason": "uploaded_declaration",
"artifact_verification": "not_checked",
"interpretation_methods": [
"spdx_expression"
],
"issues": [
{
"code": "deprecated",
"identifier": "GPL-2.0"
}
],
"origin_scope": "manifest",
"raw": "GPL-2.0+",
"source": "manifest_declared",
"status": "expression",
"syntax": "spdx"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "GPL-2.0+"
}
],
"name": "license-example",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "registry",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [
{
"comment": "{\"basis\":\"package_metadata\"}",
"type": "vcs",
"url": "https://example.com/dependency"
}
],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "publisher_release_metadata",
"artifact_verification": "not_checked",
"source": "registry_declared"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "MIT"
}
],
"metadata_status": "available",
"name": "dependency",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "npm_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:npm/dependency@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "substitution",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"php/composer.lock"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "source_substitution",
"artifact_verification": "not_checked",
"lookup_basis": "registry_name_version",
"source": "registry_declared"
},
"licenses": [],
"metadata_status": "available",
"name": "example/substitution",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "composer_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:composer/example/substitution@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_GIT",
"source_revision": "0123456789abcdef0123456789abcdef01234567",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "unavailable",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_status": "unavailable",
"name": "missing-metadata",
"observed_licenses": [],
"publisher_evidence": null,
"purl": "pkg:npm/missing-metadata@2.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "2.0.0"
},
{
"bom_ref": "local",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_reason": "non_registry_source",
"metadata_status": "not_eligible",
"name": "local-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"purl_omission_reason": "non_registry_source",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_LOCAL",
"type": "library",
"version": null
},
{
"bom_ref": "catalog",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"native/vcpkg.json"
]
},
"licenses": [],
"metadata_status": "unavailable",
"name": "catalog-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "resolved_package",
"resolution_basis": "current_public_catalog",
"resolution_limitation": "vcpkg_baseline_not_applied",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "go",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"go.mod"
]
},
"licenses": [],
"name": "example.com/source",
"observed_licenses": [
{
"license": {
"name": "Apache-2.0"
}
},
{
"license": {
"name": "MIT"
}
}
],
"publisher_evidence": null,
"purl": "pkg:golang/example.com/source@v1.0.0",
"record_kind": "resolved_package",
"scope": null,
"source_evidence": {
"checked_at": "2026-10-22T12:00:00Z",
"files": [
{
"detected_licenses": [
"Apache-2.0"
],
"path": "LICENSE"
},
{
"detected_licenses": [
"MIT"
],
"path": "nested/LICENSE"
}
],
"last_attempt_at": "2026-10-22T12:00:00Z",
"last_attempt_status": "ambiguous",
"method": "licensecheck",
"module": "example.com/source",
"provider": "pkg_go_dev",
"status": "ambiguous",
"url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
"version": "v1.0.0"
},
"type": "library",
"version": "v1.0.0"
},
{
"bom_ref": "failed-root",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"unresolved/package.json"
]
},
"licenses": [],
"name": "unresolved-project",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": null
}
],
"inventory": {
"completeness": "mixed_dependency_inventory",
"component_type_basis": "library_assumed_from_inventory",
"coverage": [
{
"aggregate": "incomplete",
"assemblies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
},
{
"aggregate": "unknown",
"dependencies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
}
],
"declaration_agreement": [
{
"declaration_path": "app/package.json",
"declared_scope": "dependencies",
"locked_versions": [
"1.0.0"
],
"matched_versions": [],
"name": "dependency",
"path": "app/package-lock.json",
"recorded_scopes": [
"dependencies"
],
"requested_requirement": "^2.0.0",
"requirement_status": "recorded",
"status": "version_mismatch"
}
],
"declarations": [
{
"declared_requirement": "^2.0.0",
"declared_scope": "dependencies",
"manifest_path": "app/package.json",
"name": "dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "^9.0.0",
"declared_scope": "dependencies",
"manifest_path": "unresolved/package.json",
"name": "never-resolved-dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "v1.0.0",
"indirect": "true",
"manifest_path": "go.mod",
"name": "example.com/source",
"source_type": "registry"
}
],
"dependency_coverage": {
"catalog": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"failed-root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"go": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"local": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"registry": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"substitution": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"unavailable": {
"reasons": [
"not_expanded"
],
"state": "unknown"
}
},
"lockfiles": [
{
"association_diagnostics": [],
"association_status": "associated",
"completeness": "LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY",
"format": "LOCKFILE_FORMAT_NPM_PACKAGE_LOCK",
"manifest_lock_consistency": "not_checked",
"manifest_paths": [
"app/package.json"
],
"native_format_version": "3",
"path": "app/package-lock.json",
"projection_notices": [
"Target conditions were retained, not evaluated."
]
}
],
"manifest_associations": {
"app/package.json": [
"app/package-lock.json"
]
},
"notices": [
"Recorded inventory, not an exact installed build; artifacts were not inspected."
],
"primary_subject": {
"id": "root"
},
"resolution_basis": "lockfile_records_and_manifest_resolution",
"resolutions": [
{
"diagnostics": [
{
"reason": "vcpkg_baseline_not_applied"
}
],
"path": "native/vcpkg.json",
"status": "partial"
},
{
"diagnostics": [
{
"name": "",
"reason": "resolution_failed"
}
],
"path": "unresolved/package.json",
"status": "partial"
}
]
},
"schema_version": 2
}
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.
Required string length:
1 - 64Pattern:
^[A-Za-z0-9_-]{1,64}$Body
multipart/form-data
Send a multipart upload. The complete request, including multipart headers and boundaries, must fit within 8,000,000 bytes.
Repeat the literal field name files[] once per file, with raw UTF-8 file contents rather than base64. Set each part's filename to the file's path relative to a common repository root, for example app/package.json and app/package-lock.json. Preserve directory structure so manifests can be associated with their lockfiles.
Send 1–256 files, each at most 5,242,880 bytes. Each filename must be at most 1,024 UTF-8 bytes and must be relative, with no empty, dot (.) or parent (..) path segments, backslashes or control characters. Every file must be a supported, readable manifest or lockfile; one unusable file rejects the entire upload.
Required array length:
1 - 256 elementsResponse
JSON license report, at most 16,777,216 bytes. Read inventory coverage and component evidence together; a successful response may be partial and does not provide a pass/fail decision.
Compact experimental license evidence, report schema 2. Preserve separate choices/occurrences/context/observations. HTTP 200 is not complete license coverage or a policy verdict. Legacy license endpoints keep schema 1.
Every original occurrence in producer order, with the selected primary subject first when supplied. Do not merge by coordinate.
Show child attributes
Show child attributes
Input and coverage context for the component occurrences.
Show child attributes
Show child attributes
Compact experimental report structure version. Check before decoding; future versions require matching client support.
Available options:
2 ⌘I
Preview a compact dependency-license report
curl --request POST \
--url https://api.githits.dev/v1/experimental/license-reports \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form 'files[]=@example-file;type=application/octet-stream'import requests
url = "https://api.githits.dev/v1/experimental/license-reports"
files = { "files[]": ("example-file", open("example-file", "rb"), "application/octet-stream") }
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('files[]', '<string>');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api.githits.dev/v1/experimental/license-reports', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/license-reports",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/license-reports"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.githits.dev/v1/experimental/license-reports")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/license-reports")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"components": [
{
"bom_ref": "root",
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": [
"app/package.json"
]
},
"license_evidence": {
"applicability_reason": "uploaded_declaration",
"artifact_verification": "not_checked",
"interpretation_methods": [
"spdx_expression"
],
"issues": [
{
"code": "deprecated",
"identifier": "GPL-2.0"
}
],
"origin_scope": "manifest",
"raw": "GPL-2.0+",
"source": "manifest_declared",
"status": "expression",
"syntax": "spdx"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "GPL-2.0+"
}
],
"name": "license-example",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "registry",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [
{
"comment": "{\"basis\":\"package_metadata\"}",
"type": "vcs",
"url": "https://example.com/dependency"
}
],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "publisher_release_metadata",
"artifact_verification": "not_checked",
"source": "registry_declared"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "MIT"
}
],
"metadata_status": "available",
"name": "dependency",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "npm_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:npm/dependency@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "substitution",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"php/composer.lock"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "source_substitution",
"artifact_verification": "not_checked",
"lookup_basis": "registry_name_version",
"source": "registry_declared"
},
"licenses": [],
"metadata_status": "available",
"name": "example/substitution",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "composer_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:composer/example/substitution@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_GIT",
"source_revision": "0123456789abcdef0123456789abcdef01234567",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "unavailable",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_status": "unavailable",
"name": "missing-metadata",
"observed_licenses": [],
"publisher_evidence": null,
"purl": "pkg:npm/missing-metadata@2.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "2.0.0"
},
{
"bom_ref": "local",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_reason": "non_registry_source",
"metadata_status": "not_eligible",
"name": "local-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"purl_omission_reason": "non_registry_source",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_LOCAL",
"type": "library",
"version": null
},
{
"bom_ref": "catalog",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"native/vcpkg.json"
]
},
"licenses": [],
"metadata_status": "unavailable",
"name": "catalog-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "resolved_package",
"resolution_basis": "current_public_catalog",
"resolution_limitation": "vcpkg_baseline_not_applied",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "go",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"go.mod"
]
},
"licenses": [],
"name": "example.com/source",
"observed_licenses": [
{
"license": {
"name": "Apache-2.0"
}
},
{
"license": {
"name": "MIT"
}
}
],
"publisher_evidence": null,
"purl": "pkg:golang/example.com/source@v1.0.0",
"record_kind": "resolved_package",
"scope": null,
"source_evidence": {
"checked_at": "2026-10-22T12:00:00Z",
"files": [
{
"detected_licenses": [
"Apache-2.0"
],
"path": "LICENSE"
},
{
"detected_licenses": [
"MIT"
],
"path": "nested/LICENSE"
}
],
"last_attempt_at": "2026-10-22T12:00:00Z",
"last_attempt_status": "ambiguous",
"method": "licensecheck",
"module": "example.com/source",
"provider": "pkg_go_dev",
"status": "ambiguous",
"url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
"version": "v1.0.0"
},
"type": "library",
"version": "v1.0.0"
},
{
"bom_ref": "failed-root",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"unresolved/package.json"
]
},
"licenses": [],
"name": "unresolved-project",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": null
}
],
"inventory": {
"completeness": "mixed_dependency_inventory",
"component_type_basis": "library_assumed_from_inventory",
"coverage": [
{
"aggregate": "incomplete",
"assemblies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
},
{
"aggregate": "unknown",
"dependencies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
}
],
"declaration_agreement": [
{
"declaration_path": "app/package.json",
"declared_scope": "dependencies",
"locked_versions": [
"1.0.0"
],
"matched_versions": [],
"name": "dependency",
"path": "app/package-lock.json",
"recorded_scopes": [
"dependencies"
],
"requested_requirement": "^2.0.0",
"requirement_status": "recorded",
"status": "version_mismatch"
}
],
"declarations": [
{
"declared_requirement": "^2.0.0",
"declared_scope": "dependencies",
"manifest_path": "app/package.json",
"name": "dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "^9.0.0",
"declared_scope": "dependencies",
"manifest_path": "unresolved/package.json",
"name": "never-resolved-dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "v1.0.0",
"indirect": "true",
"manifest_path": "go.mod",
"name": "example.com/source",
"source_type": "registry"
}
],
"dependency_coverage": {
"catalog": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"failed-root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"go": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"local": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"registry": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"substitution": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"unavailable": {
"reasons": [
"not_expanded"
],
"state": "unknown"
}
},
"lockfiles": [
{
"association_diagnostics": [],
"association_status": "associated",
"completeness": "LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY",
"format": "LOCKFILE_FORMAT_NPM_PACKAGE_LOCK",
"manifest_lock_consistency": "not_checked",
"manifest_paths": [
"app/package.json"
],
"native_format_version": "3",
"path": "app/package-lock.json",
"projection_notices": [
"Target conditions were retained, not evaluated."
]
}
],
"manifest_associations": {
"app/package.json": [
"app/package-lock.json"
]
},
"notices": [
"Recorded inventory, not an exact installed build; artifacts were not inspected."
],
"primary_subject": {
"id": "root"
},
"resolution_basis": "lockfile_records_and_manifest_resolution",
"resolutions": [
{
"diagnostics": [
{
"reason": "vcpkg_baseline_not_applied"
}
],
"path": "native/vcpkg.json",
"status": "partial"
},
{
"diagnostics": [
{
"name": "",
"reason": "resolution_failed"
}
],
"path": "unresolved/package.json",
"status": "partial"
}
]
},
"schema_version": 2
}