> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Preview a compact dependency-license report > Create a compact informational license report from manifests and lockfiles. This separate experimental operation returns `schema_version: 2`; the existing `/v1/experimental/licenses` operation continues returning schema 1. The compact report preserves package occurrences, reported choices, publisher context, source observations, input attribution and meaningful gaps, while omitting dependency adjacency, checksums and generic SBOM property containers. It does not evaluate license policy or certify installed artifacts. **First request** Use a Bearer credential for an active account with required terms accepted. `/path/to/private-auth.conf` below is your own protected curl configuration containing your authorization header, kept outside the repository. ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --form 'files[]=@package.json;filename=package.json' \ --form 'files[]=@package-lock.json;filename=package-lock.json' \ --output license-report.json \ 'https://api.githits.dev/v1/experimental/license-reports' ``` Repeat the literal `files[]` field and preserve each repository-relative filename, including directories. Let curl set the multipart content type and boundary. Only files are accepted: no query parameters, format/kind selectors, repository URLs, archives, base64 data or policy files. `Accept` does not select a report version. The existing SBOM upload contract applies: 1–256 UTF-8 files, each at most 5,242,880 bytes, a total multipart request of at most 8,000,000 bytes, and relative filenames of at most 1,024 UTF-8 bytes without control characters, backslashes or dot/parent segments. Uploads have a 30-second deadline and synchronous analysis a 150-second budget. Unsupported or unusable files reject the upload. Supported manifest/lockfile families and companion-file restrictions are the same as **Generate an SBOM** (`POST /v1/experimental/sbom`). Check curl's exit status before treating the output file as a report: errors save an `application/problem+json` body there. Successful output is the report itself, without a job ID or retrieval URL. Repeating POST starts another analysis; a timeout does not establish that processing stopped. **Long-running work and evidence inspection** Use the existing `POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx` workflow for long-running work or when you need the original SBOM. Follow its status/events until success, then read `GET /v1/experimental/license-reports/{id}`. This is the same analysis and authorized CycloneDX result, not another generation or a new job kind. Existing job links, retention, authorization, quotas and billing apply. Generation uses the same analysis reservation as SBOM; the provisional operation cost is 1. Reading an existing report has operation cost 0 and starts no new analysis. **Read the compact report** - Keep separate component entries even when names, versions or PURLs match. Preserve supplied qualifiers/subpaths, source kinds and recorded source selectors/revisions. A local source does not establish first-party ownership, and a recorded revision does not prove that commit was inspected. - `licenses` contains reported choices; `observed_licenses` contains separate detections. Neither observations nor repository context substitute for reported choices. No AND/OR relation between separate choices or license alias is inferred. - `publisher_evidence` retains original statements, interpretation/issues and applicability. Its capture/coverage fields describe evidence limitations, not inventory or license completeness. `source_evidence` retains detection service/method, module/version/URL, root/nested file paths, observations and latest-attempt history. An older observation can coexist with a failed latest attempt. - `inputs.manifest_paths` and `inputs.lockfile_paths` are ordinary JSON string arrays. Purpose-specific structured fields are already decoded JSON: do not parse them as JSON strings. Reference comments retain original owner/scope context; reference and component digests remain available only in the original SBOM/schema-1 view. - Optional `license_evidence` holds independent acquisition/applicability facts. With canonical publisher evidence, interpretation and statements remain solely with that owner. Without it, manifest/legacy raw text, syntax/status and issues remain available here. No missing fact is filled with an empty or completed stand-in. - Metadata status/reason, resolution basis/limitations and PURL-omission reasons distinguish missing acquisition from ineligible or uncertain identity. Read `inventory.completeness`, `resolutions`, `coverage`, `dependency_coverage`, `lockfiles` and notices together. Missing references, unfamiliar states, empty arrays and HTTP 200 never prove complete license or dependency coverage. - `inventory.declarations` preserves minimal original request names/inputs, including dependencies lost from the package inventory after a whole-manifest resolver failure. Declarations are not resolved package occurrences or graph edges. An absent requirement is unreported or withheld, never an unconstrained range. Agreement summaries retain named outcomes; empty matched-version lists do not prove there was no lock evidence. Detailed provider proofs remain in the original SBOM/schema-1 view. Null means unreported/unavailable information. Empty choices mean no choices were reported, not that no license exists or every file was checked. Accept unfamiliar response strings and additive evidence instead of rejecting otherwise usable data. The report is at most 16,777,216 bytes; over-limit output is rejected without truncation. Jobs do not increase that limit. **Handle errors** Branch on the problem `code`, retain `X-Request-ID`, and respect `Retry-After`. Correct request/upload problems for 400/408/413/415 and unusable-file 422 responses. Authentication/account/terms errors retain their existing 401/403 contract. `LICENSE_REPORT_TOO_LARGE` or `SBOM_OUTPUT_TOO_LARGE` requires a smaller inventory or the original available job result. Keep request identity for persistent 502 errors. Retry reads of an existing job for transient failures instead of unconditionally repeating a charged POST. Responses use `Cache-Control: no-store`. This is an experimental contract. Stable promotion is a separate acceptance step; it does not remove or reinterpret saved schema-1 reports. ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json post /v1/experimental/license-reports openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation or source code | Browse with list, then follow an exact action through the unified read operation | | Browse known content | List source files, local documentation, or an explicit hosted site | | Find exact text | Grep across ordered packages, repositories and hosted sites, then follow exact read actions | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Research a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Report dependency licenses | Upload manifests/lockfiles or use a completed analysis to read license choices, source observations and coverage for each reported entry | | Generate an SBOM | Upload manifests and lockfiles to receive a CycloneDX, SPDX or text inventory | | Audit lockfiles | Submit asynchronous audit analysis, follow status or SSE, then download findings and independent coverage as JSON | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Standard SBOM documents and embedded standard objects in licenses reports retain their format's field names. Percent-encode path parameters such as package names as one path segment, including any embedded slash. The unified read target is a query value: encode a literal plus sign as `%2B` and a literal fragment marker as `%23`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`; job events use `no-store, no-transform` to preserve streaming. When available, successful and rate-limited responses from operations that document them include `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` for the shared usage window. All three header values must be available; a credential type alone does not guarantee these headers. Reset is an absolute Unix epoch timestamp in seconds (UTC), rounded up, not a delay. These snapshots support pacing; concurrent requests and other quotas can still cause 429. Honor `Retry-After` when supplied. The trio is omitted when usage metadata is unavailable, and is not exposed for generated examples, Research, feedback, language discovery, SBOM/licenses generation and licenses views, or job submission, events and results. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Research, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Current source-advisory evidence by ID, independent of package-version assessment. name: Vulnerabilities - description: >- Find exact text across ordered source and hosted-documentation scopes, check coverage, and follow exact reads. name: Grep - description: >- Browse package, repository or hosted-site paths and follow exact read and browse actions. name: List - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Read an exact documentation page or source file and retain the page, package-version or repository-commit details needed to cite it. name: Read - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: Stable exact-tree source comparison. name: Code Diff - description: >- Preview target resolution, cited questions and SBOM generation, plus the deprecated source comparison alias. Use /v1/code/diff for stable source comparison. name: Experimental paths: /v1/experimental/license-reports: post: tags: - Experimental summary: Preview a compact dependency-license report description: > Create a compact informational license report from manifests and lockfiles. This separate experimental operation returns `schema_version: 2`; the existing `/v1/experimental/licenses` operation continues returning schema 1. The compact report preserves package occurrences, reported choices, publisher context, source observations, input attribution and meaningful gaps, while omitting dependency adjacency, checksums and generic SBOM property containers. It does not evaluate license policy or certify installed artifacts. **First request** Use a Bearer credential for an active account with required terms accepted. `/path/to/private-auth.conf` below is your own protected curl configuration containing your authorization header, kept outside the repository. ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --form 'files[]=@package.json;filename=package.json' \ --form 'files[]=@package-lock.json;filename=package-lock.json' \ --output license-report.json \ 'https://api.githits.dev/v1/experimental/license-reports' ``` Repeat the literal `files[]` field and preserve each repository-relative filename, including directories. Let curl set the multipart content type and boundary. Only files are accepted: no query parameters, format/kind selectors, repository URLs, archives, base64 data or policy files. `Accept` does not select a report version. The existing SBOM upload contract applies: 1–256 UTF-8 files, each at most 5,242,880 bytes, a total multipart request of at most 8,000,000 bytes, and relative filenames of at most 1,024 UTF-8 bytes without control characters, backslashes or dot/parent segments. Uploads have a 30-second deadline and synchronous analysis a 150-second budget. Unsupported or unusable files reject the upload. Supported manifest/lockfile families and companion-file restrictions are the same as **Generate an SBOM** (`POST /v1/experimental/sbom`). Check curl's exit status before treating the output file as a report: errors save an `application/problem+json` body there. Successful output is the report itself, without a job ID or retrieval URL. Repeating POST starts another analysis; a timeout does not establish that processing stopped. **Long-running work and evidence inspection** Use the existing `POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx` workflow for long-running work or when you need the original SBOM. Follow its status/events until success, then read `GET /v1/experimental/license-reports/{id}`. This is the same analysis and authorized CycloneDX result, not another generation or a new job kind. Existing job links, retention, authorization, quotas and billing apply. Generation uses the same analysis reservation as SBOM; the provisional operation cost is 1. Reading an existing report has operation cost 0 and starts no new analysis. **Read the compact report** - Keep separate component entries even when names, versions or PURLs match. Preserve supplied qualifiers/subpaths, source kinds and recorded source selectors/revisions. A local source does not establish first-party ownership, and a recorded revision does not prove that commit was inspected. - `licenses` contains reported choices; `observed_licenses` contains separate detections. Neither observations nor repository context substitute for reported choices. No AND/OR relation between separate choices or license alias is inferred. - `publisher_evidence` retains original statements, interpretation/issues and applicability. Its capture/coverage fields describe evidence limitations, not inventory or license completeness. `source_evidence` retains detection service/method, module/version/URL, root/nested file paths, observations and latest-attempt history. An older observation can coexist with a failed latest attempt. - `inputs.manifest_paths` and `inputs.lockfile_paths` are ordinary JSON string arrays. Purpose-specific structured fields are already decoded JSON: do not parse them as JSON strings. Reference comments retain original owner/scope context; reference and component digests remain available only in the original SBOM/schema-1 view. - Optional `license_evidence` holds independent acquisition/applicability facts. With canonical publisher evidence, interpretation and statements remain solely with that owner. Without it, manifest/legacy raw text, syntax/status and issues remain available here. No missing fact is filled with an empty or completed stand-in. - Metadata status/reason, resolution basis/limitations and PURL-omission reasons distinguish missing acquisition from ineligible or uncertain identity. Read `inventory.completeness`, `resolutions`, `coverage`, `dependency_coverage`, `lockfiles` and notices together. Missing references, unfamiliar states, empty arrays and HTTP 200 never prove complete license or dependency coverage. - `inventory.declarations` preserves minimal original request names/inputs, including dependencies lost from the package inventory after a whole-manifest resolver failure. Declarations are not resolved package occurrences or graph edges. An absent requirement is unreported or withheld, never an unconstrained range. Agreement summaries retain named outcomes; empty matched-version lists do not prove there was no lock evidence. Detailed provider proofs remain in the original SBOM/schema-1 view. Null means unreported/unavailable information. Empty choices mean no choices were reported, not that no license exists or every file was checked. Accept unfamiliar response strings and additive evidence instead of rejecting otherwise usable data. The report is at most 16,777,216 bytes; over-limit output is rejected without truncation. Jobs do not increase that limit. **Handle errors** Branch on the problem `code`, retain `X-Request-ID`, and respect `Retry-After`. Correct request/upload problems for 400/408/413/415 and unusable-file 422 responses. Authentication/account/terms errors retain their existing 401/403 contract. `LICENSE_REPORT_TOO_LARGE` or `SBOM_OUTPUT_TOO_LARGE` requires a smaller inventory or the original available job result. Keep request identity for persistent 502 errors. Retry reads of an existing job for transient failures instead of unconditionally repeating a charged POST. Responses use `Cache-Control: no-store`. This is an experimental contract. Stable promotion is a separate acceptance step; it does not remove or reinterpret saved schema-1 reports. operationId: generate_compact_dependency_licenses parameters: - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created. in: header name: X-GitHits-Session-ID required: false schema: maxLength: 64 minLength: 1 pattern: ^[A-Za-z0-9_-]{1,64}$ type: string requestBody: content: multipart/form-data: encoding: files[]: contentType: application/octet-stream schema: additionalProperties: false properties: files[]: description: >- Repeat the literal field name files[] once per file, with raw UTF-8 file contents rather than base64. Set each part's filename to the file's path relative to a common repository root, for example app/package.json and app/package-lock.json. Preserve directory structure so manifests can be associated with their lockfiles. Send 1–256 files, each at most 5,242,880 bytes. Each filename must be at most 1,024 UTF-8 bytes and must be relative, with no empty, dot (.) or parent (..) path segments, backslashes or control characters. Every file must be a supported, readable manifest or lockfile; one unusable file rejects the entire upload. items: format: binary type: string maxItems: 256 minItems: 1 type: array required: - files[] type: object description: >- Send a multipart upload. The complete request, including multipart headers and boundaries, must fit within 8,000,000 bytes. required: true responses: '200': content: application/json: example: components: - bom_ref: root external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: - app/package.json license_evidence: applicability_reason: uploaded_declaration artifact_verification: not_checked interpretation_methods: - spdx_expression issues: - code: deprecated identifier: GPL-2.0 origin_scope: manifest raw: GPL-2.0+ source: manifest_declared status: expression syntax: spdx licenses: - acknowledgement: declared expression: GPL-2.0+ name: license-example observed_licenses: [] publisher_evidence: null purl: null record_kind: manifest scope: null source_evidence: null type: library version: 1.0.0 - bom_ref: registry context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: - comment: '{"basis":"package_metadata"}' type: vcs url: https://example.com/dependency inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] license_evidence: applicability_reason: publisher_release_metadata artifact_verification: not_checked source: registry_declared licenses: - acknowledgement: declared expression: MIT metadata_status: available name: dependency observed_licenses: [] publisher_evidence: capture_status: present controlling_index: 0 coverage: complete expression: MIT observations: - interpretation: expression: MIT interpretation_methods: - spdx_expression issues: [] status: expression syntax: spdx observation: field: license relation: single scope: release source: npm_manifest statements: - MIT status: present version: 1.0.0 relationship: controlling reason: publisher_release_metadata status: expression purl: pkg:npm/dependency@1.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_REGISTRY type: library version: 1.0.0 - bom_ref: substitution context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - php/composer.lock manifest_paths: [] license_evidence: applicability_reason: source_substitution artifact_verification: not_checked lookup_basis: registry_name_version source: registry_declared licenses: [] metadata_status: available name: example/substitution observed_licenses: [] publisher_evidence: capture_status: present controlling_index: 0 coverage: complete expression: MIT observations: - interpretation: expression: MIT interpretation_methods: - spdx_expression issues: [] status: expression syntax: spdx observation: field: license relation: single scope: release source: composer_manifest statements: - MIT status: present version: 1.0.0 relationship: controlling reason: publisher_release_metadata status: expression purl: pkg:composer/example/substitution@1.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_GIT source_revision: 0123456789abcdef0123456789abcdef01234567 type: library version: 1.0.0 - bom_ref: unavailable context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] licenses: [] metadata_status: unavailable name: missing-metadata observed_licenses: [] publisher_evidence: null purl: pkg:npm/missing-metadata@2.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_REGISTRY type: library version: 2.0.0 - bom_ref: local context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] licenses: [] metadata_reason: non_registry_source metadata_status: not_eligible name: local-dependency observed_licenses: [] publisher_evidence: null purl: null purl_omission_reason: non_registry_source record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_LOCAL type: library version: null - bom_ref: catalog external_references: [] inputs: lockfile_paths: [] manifest_paths: - native/vcpkg.json licenses: [] metadata_status: unavailable name: catalog-dependency observed_licenses: [] publisher_evidence: null purl: null record_kind: resolved_package resolution_basis: current_public_catalog resolution_limitation: vcpkg_baseline_not_applied scope: null source_evidence: null type: library version: 1.0.0 - bom_ref: go external_references: [] inputs: lockfile_paths: [] manifest_paths: - go.mod licenses: [] name: example.com/source observed_licenses: - license: name: Apache-2.0 - license: name: MIT publisher_evidence: null purl: pkg:golang/example.com/source@v1.0.0 record_kind: resolved_package scope: null source_evidence: checked_at: '2026-10-22T12:00:00Z' files: - detected_licenses: - Apache-2.0 path: LICENSE - detected_licenses: - MIT path: nested/LICENSE last_attempt_at: '2026-10-22T12:00:00Z' last_attempt_status: ambiguous method: licensecheck module: example.com/source provider: pkg_go_dev status: ambiguous url: >- https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses version: v1.0.0 type: library version: v1.0.0 - bom_ref: failed-root external_references: [] inputs: lockfile_paths: [] manifest_paths: - unresolved/package.json licenses: [] name: unresolved-project observed_licenses: [] publisher_evidence: null purl: null record_kind: manifest scope: null source_evidence: null type: library version: null inventory: completeness: mixed_dependency_inventory component_type_basis: library_assumed_from_inventory coverage: - aggregate: incomplete assemblies: - root - registry - substitution - unavailable - local - catalog - go - failed-root - aggregate: unknown dependencies: - root - registry - substitution - unavailable - local - catalog - go - failed-root declaration_agreement: - declaration_path: app/package.json declared_scope: dependencies locked_versions: - 1.0.0 matched_versions: [] name: dependency path: app/package-lock.json recorded_scopes: - dependencies requested_requirement: ^2.0.0 requirement_status: recorded status: version_mismatch declarations: - declared_requirement: ^2.0.0 declared_scope: dependencies manifest_path: app/package.json name: dependency optional: 'false' source_type: registry - declared_requirement: ^9.0.0 declared_scope: dependencies manifest_path: unresolved/package.json name: never-resolved-dependency optional: 'false' source_type: registry - declared_requirement: v1.0.0 indirect: 'true' manifest_path: go.mod name: example.com/source source_type: registry dependency_coverage: catalog: reasons: - not_expanded state: unknown failed-root: reasons: - not_expanded state: unknown go: reasons: - not_expanded state: unknown local: reasons: - not_expanded state: unknown registry: reasons: - not_expanded state: unknown root: reasons: - not_expanded state: unknown substitution: reasons: - not_expanded state: unknown unavailable: reasons: - not_expanded state: unknown lockfiles: - association_diagnostics: [] association_status: associated completeness: LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY format: LOCKFILE_FORMAT_NPM_PACKAGE_LOCK manifest_lock_consistency: not_checked manifest_paths: - app/package.json native_format_version: '3' path: app/package-lock.json projection_notices: - Target conditions were retained, not evaluated. manifest_associations: app/package.json: - app/package-lock.json notices: - >- Recorded inventory, not an exact installed build; artifacts were not inspected. primary_subject: id: root resolution_basis: lockfile_records_and_manifest_resolution resolutions: - diagnostics: - reason: vcpkg_baseline_not_applied path: native/vcpkg.json status: partial - diagnostics: - name: '' reason: resolution_failed path: unresolved/package.json status: partial schema_version: 2 schema: $ref: '#/components/schemas/CompactDependencyLicensesReport' description: >- JSON license report, at most 16,777,216 bytes. Read inventory coverage and component evidence together; a successful response may be partial and does not provide a pass/fail decision. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '400': content: application/problem+json: examples: invalid_session_id: value: code: INVALID_SESSION_ID detail: >- X-GitHits-Session-ID must occur once and match [A-Za-z0-9_-]{1,64}. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Invalid session ID type: about:blank upstream_validation: summary: Invalid request without a field-specific explanation value: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank validation: value: code: VALIDATION_ERROR detail: >- query: contains unknown parameters; use only the documented parameters. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- VALIDATION_ERROR, INVALID_SESSION_ID. Correct the field named in detail or the session header. These operations accept no query parameters. INVALID_SESSION_ID: a supplied session header is invalid or duplicated. VALIDATION_ERROR details identify the first invalid field and a reason when available. Array indices are zero-based; submitted values and unknown keys are not echoed. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: AUTHENTICATION_REQUIRED. Supply a valid Bearer credential. headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer challenge. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- FORBIDDEN, ACCOUNT_INACTIVE, TERMS_ACCEPTANCE_REQUIRED. Check credential access, account eligibility and required terms; follow terms_url or acceptance_url when provided. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: POST.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '408': content: application/problem+json: example: code: UPLOAD_TIMEOUT detail: The upload did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 408 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UPLOAD_TIMEOUT. Ensure the upload can finish within 30 seconds. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '413': content: application/problem+json: example: code: INPUT_TOO_LARGE detail: The upload exceeds a file, path, count or body limit. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 413 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- INPUT_TOO_LARGE. Reduce file count, path length or bytes to the documented upload limits. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '415': content: application/problem+json: example: code: UNSUPPORTED_MEDIA_TYPE detail: Use multipart/form-data. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 415 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- UNSUPPORTED_MEDIA_TYPE. Send multipart/form-data and let the HTTP client set its boundary. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '422': content: application/problem+json: example: code: LICENSE_REPORT_TOO_LARGE detail: The licenses report exceeds the response limit. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 422 title: Licenses request failed type: about:blank schema: anyOf: - $ref: '#/components/schemas/SbomProblem' - $ref: '#/components/schemas/ProblemResponse' description: >- LICENSE_REPORT_TOO_LARGE, UNUSABLE_MANIFEST, NO_MANIFEST_EVIDENCE, SBOM_OUTPUT_TOO_LARGE. Correct any files identified by UNUSABLE_MANIFEST or supply supported package evidence. For output-limit errors, request a smaller inventory if possible. Jobs do not increase the 16,777,216-byte JSON report limit. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- RATE_LIMITED. Respect Retry-After when supplied before trying again. RATE_LIMITED can also mean your shared daily allowance is exhausted. When Retry-After is supplied, wait until that delay or HTTP date before trying again. headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: >- Delay in seconds or an HTTP date indicating when to retry, when supplied. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '500': description: >- A request ID could not be assigned. The response has an empty body and no X-Request-ID or problem object; try again later. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- UPSTREAM_ERROR. The analysis result could not be read. Keep X-Request-ID for support and report a persistent failure; a new submission creates another analysis. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '503': content: application/problem+json: example: code: SBOM_UNAVAILABLE detail: SBOM generation is temporarily unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 503 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- SBOM_UNAVAILABLE, UPSTREAM_UNAVAILABLE. Try again later if appropriate. A timeout or error does not guarantee processing stopped, and repeating POST may create another charged analysis. QUOTA_UNAVAILABLE: your daily allowance could not be checked. This is temporary; retry the same request later (retryable=true). headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- TIMEOUT. Try again later if appropriate. A timeout or error does not guarantee processing stopped, and repeating POST may create another charged analysis. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string security: - bearer_auth: [] components: schemas: CompactDependencyLicensesReport: additionalProperties: true description: >- Compact experimental license evidence, report schema 2. Preserve separate choices/occurrences/context/observations. HTTP 200 is not complete license coverage or a policy verdict. Legacy license endpoints keep schema 1. properties: components: description: >- Every original occurrence in producer order, with the selected primary subject first when supplied. Do not merge by coordinate. items: $ref: '#/components/schemas/CompactDependencyLicensesComponent' description: One original occurrence. type: array inventory: $ref: '#/components/schemas/CompactDependencyLicensesInventory' description: Input and coverage context for the component occurrences. schema_version: description: >- Compact experimental report structure version. Check before decoding; future versions require matching client support. enum: - 2 type: integer required: - schema_version - inventory - components type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: Link for accepting the required terms, when provided. type: string code: description: The stable uppercase API error code. type: string detail: description: >- Human-readable explanation. Wording can change; use code and structured fields for program logic. Validation errors identify the first invalid field (including zero-based array indices) and a reason; version errors can include canonical-version guidance. type: string instance: description: >- Request ID matching the X-Request-ID response header; include it when seeking support. type: string retryable: description: >- Whether retrying later may help, when supplied. Follow this flag for lookup/provider outcomes and temporary daily-allowance failures; malformed evidence can be nonretryable. type: boolean status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: Link to the terms that require acceptance, when provided. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object SbomProblem: allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: files: description: >- Unusable uploaded files; paths refer only to this request's uploads. items: $ref: '#/components/schemas/SbomFileFailure' maxItems: 256 minItems: 1 type: array required: - files type: object description: >- File-specific diagnostics returned only when generation rejects uploaded inputs. CompactDependencyLicensesComponent: additionalProperties: true description: >- One original occurrence, preserving repeated coordinates, qualifiers, excluded scopes and source/file/project subjects. The compact report omits graph/checksum/property-bag machinery, without inventing evidence. properties: bom_ref: description: >- Opaque reference for this occurrence, used by inventory relationships. null means no reference was available. Do not merge entries by name, version or package URL. type: - string - 'null' component_type_basis: description: >- Original qualification of this occurrence classification, including assumed or generic subject types. type: string context: additionalProperties: true description: >- Original structured occurrence conditions/platform/source context. Conditions are retained, never evaluated; unfamiliar fields and values remain evidence. type: object external_references: description: >- Original source/license/distribution and other references with non-hash metadata and owner/scope comments. Component and reference digests are omitted in this compact contract. URLs are never fetched and do not prove artifact inspection. items: additionalProperties: true type: object type: array inputs: $ref: '#/components/schemas/CompactDependencyLicensesInputs' description: Typed original input attribution for this occurrence. license_evidence: $ref: '#/components/schemas/CompactDependencyLicensesEvidence' description: Optional independent or legacy license facts, only when supplied. licenses: description: >- Reported license-choice objects, usually containing expression (for example MIT OR Apache-2.0) or license with an id/name, and optional acknowledgement. Keep each choice intact. Separate entries do not imply AND or OR, and an empty array means no choices were reported. These are evidence, not a pass/fail decision. items: additionalProperties: true type: object type: array metadata_reason: description: >- Original open reason metadata could not apply, for example non_registry_source or non_public_registry_source. type: string metadata_status: description: >- Original metadata acquisition status, distinguishing available, unavailable and not_eligible; available does not mean a license is known. type: string name: description: >- Reported project, package, source or file name. A name alone does not identify a unique package occurrence. type: string observed_licenses: description: >- Independent license observations, such as licenses identified in source files. Keep these separate from licenses and publisher statements; see source_evidence for file paths and detection status. An empty array means no observations were reported, not that every file was checked. items: additionalProperties: true type: object type: array publisher_evidence: additionalProperties: true description: >- Original publisher license statements and the context needed to interpret them. This is already a JSON object. observations retains statement text, source, scope, field, version, interpretation/issues and relationship. capture_status describes retained statement capture; coverage concerns that statement collection, not your dependency inventory. status/reason/expression describe interpretation. controlling_index identifies the selected observation when one was selected. Package/repository context may not apply to a specific release. null means no publisher evidence object was available, not that the package has no license. Accept unfamiliar statuses and additional fields. The redundant derived display_value hint is omitted; all substantive observations and limitations remain. type: - object - 'null' purl: description: >- Package URL (PURL), or null when unavailable. Its presence identifies a package coordinate; it does not verify your installed artifact. type: - string - 'null' purl_omission_reason: description: >- Original reason no usable package URL was supplied; the gateway never fabricates one. type: string record_kind: description: >- Why this entry is included: examples are manifest for an uploaded project, resolved_package for a dependency found by resolution, and locked_package for a lockfile occurrence. null means unspecified. Other values can appear. type: - string - 'null' resolution_basis: description: >- Original occurrence version-selection basis, for example lockfile_record or current_public_catalog; not an installed-build claim. type: string resolution_limitation: description: >- Original limitation on occurrence resolution, for example vcpkg_baseline_not_applied. type: string scope: description: >- Reported component scope, for example excluded. null means the scope was not specified. Entries with excluded scope remain in the report. type: - string - 'null' source_evidence: additionalProperties: true description: >- Source-file license detection details, already a JSON object. provider/method identify the detection service and technique; module/version identify what was examined. files contains path and detected_licenses, including nested license files. checked_at/status describe the available observation; last_attempt_at/last_attempt_status describe the latest attempt, which can fail while an older observation remains. null means no source observation was available. Accept unfamiliar statuses and additional fields; this does not certify an installed artifact. type: - object - 'null' source_kind: description: >- Original open source kind, including local/Git/registry distinctions. Local does not establish first-party ownership. type: string source_locator_omission_reason: description: Original reason the source locator could not be published or used. type: string source_revision: description: >- Original recorded source revision. Its presence does not prove that commit or its license was inspected. type: string source_revision_omission_reason: description: Original reason a source revision was unavailable or withheld. type: string source_selector: description: >- Original recorded source selector, preserved without resolving or fetching it. type: string source_selector_basis: description: Original basis attributing the recorded selector to its input. type: string source_selector_kind: description: Original open selector kind, such as branch, tag or commit. type: string source_selector_omission_reason: description: Original reason a selector was unavailable or withheld. type: string type: description: >- Component classification, for example library or file. Additional string values can appear; accept unfamiliar classifications. type: string version: description: Reported version text, or null when no version was available. type: - string - 'null' required: - bom_ref - name - version - purl - type - scope - record_kind - licenses - observed_licenses - publisher_evidence - source_evidence - external_references - inputs type: object CompactDependencyLicensesInventory: additionalProperties: true description: >- Typed original input attribution and meaningful inventory/acquisition/coverage gaps. No dependency adjacency or generic property container is exposed. properties: completeness: description: >- How the inventory was built, for example recorded_lockfile_inventory, resolved_manifest_inventory, partial_manifest_inventory or mixed_dependency_inventory. null means unreported, and additional values can appear. This does not measure license coverage; HTTP 200 or a component count does not prove completeness. type: - string - 'null' component_type_basis: description: >- Original open basis qualifying inventory component classifications, including assumptions. type: string coverage: description: >- Original coverage groups with explicit scope/reference membership, independent of licenses or reported adjacency. items: $ref: '#/components/schemas/CompactDependencyLicensesCoverage' description: One original coverage group. type: array declaration_agreement: description: >- Named declaration/lock agreement outcomes, preserving gaps without provider proof catalogues or recomputing policy. Empty version lists on a matched outcome do not mean no lock evidence; provider proof remains in schema 1 and the original SBOM. items: additionalProperties: true description: One original agreement summary. properties: declaration_path: description: Original declaration path value; vocabulary remains open. type: - string - 'null' declared_scope: description: Original declared scope value; vocabulary remains open. type: - string - 'null' locked_versions: description: Original locked versions, without gateway matching. items: type: - string - 'null' type: array matched_versions: description: Original matched versions, without gateway matching. items: type: - string - 'null' type: array name: description: Original name value; vocabulary remains open. type: - string - 'null' path: description: Original path value; vocabulary remains open. type: - string - 'null' recorded_scopes: description: Original recorded scopes, without gateway matching. items: type: string type: array requested_requirement: description: Original requested requirement value; vocabulary remains open. type: - string - 'null' requirement_status: description: Original requirement status value; vocabulary remains open. type: - string - 'null' status: description: Original status value; vocabulary remains open. type: - string - 'null' type: object type: array declarations: description: >- Original named direct requests. These can be the only missing dependency names after a wholesale resolver failure; never treat them as resolved package components. items: additionalProperties: true description: Minimal original declaration summary. properties: declared_requirement: description: >- Original requested range/text, not a selected version. Absence means not recorded or withheld, never an unconstrained requirement. type: string declared_scope: description: Original request scope. type: string indirect: description: >- Original producer indirect flag text; do not coerce absence into false. type: string manifest_path: description: Original declaring input path. type: string name: description: Original requested dependency name. type: string optional: description: >- Original producer optional flag text; unfamiliar strings are accepted. type: string source_type: description: Original source type for the request. type: string type: object type: array dependency_coverage: additionalProperties: $ref: '#/components/schemas/CompactDependencyLicensesDependencyCoverage' description: Original coverage for this reference. description: >- Original reference-keyed outgoing dependency coverage. Keep unresolved refs and complete/incomplete/unknown entries; a missing owner never implies completeness. type: object lockfiles: description: >- Input association/completeness summaries without generic SBOM bookkeeping. items: $ref: '#/components/schemas/CompactDependencyLicensesLockfile' description: One meaningful lockfile input summary. type: array manifest_associations: additionalProperties: description: Original associated lockfile paths for this manifest. items: type: string type: array description: >- Original manifest-path to lockfile-path associations. These are not a lock freshness check. type: object notices: description: >- Every supplied inventory notice, in original order; absence is not a completion assertion. items: type: string type: array primary_subject: additionalProperties: true description: >- Original selected primary occurrence reference or absence reason; no project root is fabricated. type: object resolution_basis: description: >- Original open inventory-construction/resolution basis; not an observed installation. type: string resolutions: description: >- Original resolution outcomes for inputs, including meaningful diagnostics. items: $ref: '#/components/schemas/CompactDependencyLicensesResolution' description: One input-resolution outcome. type: array required: - completeness - notices - coverage type: object SbomFileFailure: description: One rejected uploaded file, without parser diagnostics. properties: path: description: Original repository-relative filename supplied by the caller. type: string status: $ref: '#/components/schemas/SbomFileStatus' description: Why this file could not contribute evidence. required: - path - status type: object CompactDependencyLicensesInputs: additionalProperties: true description: >- Original input-path evidence for this occurrence. Repetitions remain; empty arrays mean no paths were supplied, not complete attribution. properties: lockfile_paths: description: >- Supplied lockfile paths, preserving producer property order and repetitions. items: type: string type: array manifest_paths: description: >- Supplied manifest paths, preserving producer property order and repetitions. items: type: string type: array required: - manifest_paths - lockfile_paths type: object CompactDependencyLicensesEvidence: additionalProperties: true description: >- Occurrence license facts. With canonical publisher evidence only independent source, lookup_basis, artifact_verification and applicability_reason remain here; statements/interpretation stay with their canonical owner. Without it, retained legacy/manifest details are explicit. No missing fact is defaulted. properties: applicability_reason: description: >- Original producer applicability/conclusion-basis reason, such as source_substitution; no SPDX conclusion or policy verdict is exported. type: string artifact_verification: description: >- Original verification limitation, such as not_checked; absence never implies verified. type: string interpretation_methods: description: >- Original open interpretation-method names, without gateway reinterpretation. items: type: string type: array issues: description: >- Original interpretation issues, retaining identifiers, offsets and unfamiliar issue shapes. items: additionalProperties: true type: - 'null' - boolean - object - array - number - string type: array lookup_basis: description: >- Original lookup basis, such as registry_name_version; not artifact inspection. type: string origin_scope: description: >- Original manifest/release/package/repository scope of legacy evidence. type: string raw: description: >- Original unnormalized license text when no canonical publisher object is available. type: string source: description: >- Original acquisition channel; registry_declared alone does not establish publisher-release applicability. type: string status: description: >- Original open legacy interpretation status, used only without canonical publisher evidence. type: string syntax: description: Original legacy statement syntax, not a gateway normalization rule. type: string type: object CompactDependencyLicensesCoverage: additionalProperties: true description: >- One original inventory/relationship coverage group. Preserve scope-key presence and references. Missing scope is unrecognized; missing or unfamiliar aggregate is not complete. This is not license coverage. properties: aggregate: description: >- Original open coverage state, for example incomplete or unknown. Accept unfamiliar values. type: - string - 'null' assemblies: description: >- Original component occurrence references covered by this group; presence identifies component-inventory scope. items: type: string type: array dependencies: description: >- Original references whose outgoing dependency coverage is described; these are not graph edges. items: type: string type: array services: description: >- Original service coverage references when supplied; do not reinterpret as components. items: type: string type: array type: object CompactDependencyLicensesDependencyCoverage: additionalProperties: true description: >- Original outgoing dependency coverage for one occurrence; independent of descendant completeness. Unfamiliar fields/codes and missing state remain evidence of uncertainty. properties: reasons: description: >- Original open reason codes explaining incomplete or unknown coverage. items: type: string type: array state: description: >- Open producer coverage state; missing/null/unfamiliar values do not mean complete. type: - string - 'null' type: object CompactDependencyLicensesLockfile: additionalProperties: true description: >- License-relevant input summary. Generic record catalogues, counters, checksum machinery and producer format versions are omitted. properties: association_diagnostics: description: >- Original meaningful association diagnostics, including incomplete/ambiguous association. items: additionalProperties: true description: One original association diagnostic. type: object type: array association_status: description: >- Open manifest/lockfile association outcome; association does not prove freshness. type: - string - 'null' completeness: description: >- Open recorded-input completeness state; not installed-build or license completeness. type: - string - 'null' format: description: Open producer lockfile-format name, not a request selector. type: - string - 'null' manifest_lock_consistency: description: >- Original consistency state, such as not_checked; no check is invented. type: - string - 'null' manifest_paths: description: >- Original manifests associated with this input; absence does not establish that none exist. items: type: string type: array native_format_version: description: Native format version text, not producer protocol/capture version. type: - string - 'null' path: description: Original input lockfile path. type: - string - 'null' projection_notices: description: >- Original notices about retained/omitted input evidence and interpretation limits. items: type: string type: array type: object CompactDependencyLicensesResolution: additionalProperties: true description: >- Original input-resolution outcome with structured diagnostics. A successful report can contain partial or unknown outcomes. properties: diagnostics: description: >- Original structured resolution diagnostics; values and additions remain open. items: additionalProperties: true description: One original resolution diagnostic; no raw diagnostic is logged. type: object type: array path: description: Input path as supplied by the producer, when available. type: - string - 'null' status: description: Open original resolution status; accept unfamiliar values. type: - string - 'null' type: object SbomFileStatus: description: >- Processing outcome for each uploaded file. Response values can evolve: accept values you do not recognise. A value the API does not yet recognise is returned as unknown. Known values include: unknown, unsupported, invalid_utf8, unparsed. type: string securitySchemes: bearer_auth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.