Experimental
Preview a compact report for a completed analysis
Retrieve compact report schema_version: 2 for an existing authorized CycloneDX SBOM job. Use the analysis ID returned by POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx, after its existing status/events indicate success. A component bom_ref is not an analysis ID. The synchronous compact POST returns no job ID.
curl --config /path/to/private-auth.conf \
--fail-with-body --silent --show-error \
--output license-report.json \
'https://api.githits.dev/v1/experimental/license-reports/{id}'
/path/to/private-auth.conf is your own protected curl configuration containing your authorization header, kept outside the repository. Use a credential with access to the submitted job, such as the submission credential. Check curl’s exit status: failures save a JSON problem rather than a report.
This read fetches one existing authorized result and projects it; it never resubmits, resolves, enriches or fetches source URLs. Operation cost is 0, with no new analysis reservation. The original job’s status/events/result links, representation, owner/expiry gates and retention stay unchanged. No query parameters or Accept-based report selection are supported. The legacy /v1/experimental/licenses/{id} read remains schema 1, and the original CycloneDX result remains available through the job’s result_url.
Interpret the report
The compact POST documents the full report semantics. Keep every original occurrence and supplied identity qualifier; bom_ref and typed inputs retain attribution. Reported choices, publisher statements/context and observed file detections remain distinct. Original source observations and latest-attempt state/time do not certify your installed artifact. Local source does not prove first-party ownership. No license normalization, inferred AND/OR or pass/fail verdict is added.
Purpose-specific fields are already JSON objects/arrays; they replace JSON strings inside generic property containers. license_evidence retains independent occurrence limitations and manifest/legacy detail only when it is not a mirror of canonical publisher evidence. Inventory coverage and named declaration gaps are not license completeness. Missing requirements never imply unrestricted selection. Empty matched-version lists do not imply no lock evidence; original provider proofs remain in the schema-1 view/SBOM.
Null, absent facts, empty choices, unfamiliar statuses and unresolved references retain uncertainty. HTTP 200 does not establish that every dependency or license is known. Report output is bounded at 16,777,216 bytes and is never truncated. Dependency adjacency, component/reference digests and generic SBOM/debug properties are omitted from this compact view.
Handle errors
Problems use application/problem+json; branch on code, keep X-Request-ID, and honor Retry-After.
| Status / code | Meaning and next action |
|---|---|
400 VALIDATION_ERROR / INVALID_SESSION_ID | Remove query parameters or correct the named field/session header. |
| 401 / 403 | Check credential, ownership/account eligibility and required terms. |
404 ANALYSIS_NOT_FOUND | Check the submission ID and credential. Missing, malformed, expired and inaccessible IDs share this response after authentication. |
409 ANALYSIS_PENDING | Wait through existing status/events, then retry the same read. |
409 ANALYSIS_FAILED | Inspect the safe open failure_code and job status before deliberately submitting new work. |
409 INCOMPATIBLE_ANALYSIS | Use a job submitted with kind=sbom&format=cyclonedx; audit/SPDX/text jobs are not converted. |
422 LICENSE_REPORT_TOO_LARGE | The compact report exceeds its limit. Read the original available job result or request a smaller inventory. |
| 429 / 502 / 503 / 504 | Respect retry guidance and retain the job/request IDs. Retry the existing read for transient failures instead of creating another analysis. |
Responses use Cache-Control: no-store. Stable promotion is a later acceptance step; current schema-1 endpoints and saved reports remain unchanged.
GET
/
v1
/
experimental
/
license-reports
/
{id}
Preview a compact report for a completed analysis
curl --request GET \
--url https://api.githits.dev/v1/experimental/license-reports/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/experimental/license-reports/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/experimental/license-reports/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/license-reports/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/license-reports/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/experimental/license-reports/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/license-reports/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"components": [
{
"bom_ref": "root",
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": [
"app/package.json"
]
},
"license_evidence": {
"applicability_reason": "uploaded_declaration",
"artifact_verification": "not_checked",
"interpretation_methods": [
"spdx_expression"
],
"issues": [
{
"code": "deprecated",
"identifier": "GPL-2.0"
}
],
"origin_scope": "manifest",
"raw": "GPL-2.0+",
"source": "manifest_declared",
"status": "expression",
"syntax": "spdx"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "GPL-2.0+"
}
],
"name": "license-example",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "registry",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [
{
"comment": "{\"basis\":\"package_metadata\"}",
"type": "vcs",
"url": "https://example.com/dependency"
}
],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "publisher_release_metadata",
"artifact_verification": "not_checked",
"source": "registry_declared"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "MIT"
}
],
"metadata_status": "available",
"name": "dependency",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "npm_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:npm/dependency@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "substitution",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"php/composer.lock"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "source_substitution",
"artifact_verification": "not_checked",
"lookup_basis": "registry_name_version",
"source": "registry_declared"
},
"licenses": [],
"metadata_status": "available",
"name": "example/substitution",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "composer_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:composer/example/substitution@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_GIT",
"source_revision": "0123456789abcdef0123456789abcdef01234567",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "unavailable",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_status": "unavailable",
"name": "missing-metadata",
"observed_licenses": [],
"publisher_evidence": null,
"purl": "pkg:npm/missing-metadata@2.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "2.0.0"
},
{
"bom_ref": "local",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_reason": "non_registry_source",
"metadata_status": "not_eligible",
"name": "local-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"purl_omission_reason": "non_registry_source",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_LOCAL",
"type": "library",
"version": null
},
{
"bom_ref": "catalog",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"native/vcpkg.json"
]
},
"licenses": [],
"metadata_status": "unavailable",
"name": "catalog-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "resolved_package",
"resolution_basis": "current_public_catalog",
"resolution_limitation": "vcpkg_baseline_not_applied",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "go",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"go.mod"
]
},
"licenses": [],
"name": "example.com/source",
"observed_licenses": [
{
"license": {
"name": "Apache-2.0"
}
},
{
"license": {
"name": "MIT"
}
}
],
"publisher_evidence": null,
"purl": "pkg:golang/example.com/source@v1.0.0",
"record_kind": "resolved_package",
"scope": null,
"source_evidence": {
"checked_at": "2026-10-22T12:00:00Z",
"files": [
{
"detected_licenses": [
"Apache-2.0"
],
"path": "LICENSE"
},
{
"detected_licenses": [
"MIT"
],
"path": "nested/LICENSE"
}
],
"last_attempt_at": "2026-10-22T12:00:00Z",
"last_attempt_status": "ambiguous",
"method": "licensecheck",
"module": "example.com/source",
"provider": "pkg_go_dev",
"status": "ambiguous",
"url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
"version": "v1.0.0"
},
"type": "library",
"version": "v1.0.0"
},
{
"bom_ref": "failed-root",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"unresolved/package.json"
]
},
"licenses": [],
"name": "unresolved-project",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": null
}
],
"inventory": {
"completeness": "mixed_dependency_inventory",
"component_type_basis": "library_assumed_from_inventory",
"coverage": [
{
"aggregate": "incomplete",
"assemblies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
},
{
"aggregate": "unknown",
"dependencies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
}
],
"declaration_agreement": [
{
"declaration_path": "app/package.json",
"declared_scope": "dependencies",
"locked_versions": [
"1.0.0"
],
"matched_versions": [],
"name": "dependency",
"path": "app/package-lock.json",
"recorded_scopes": [
"dependencies"
],
"requested_requirement": "^2.0.0",
"requirement_status": "recorded",
"status": "version_mismatch"
}
],
"declarations": [
{
"declared_requirement": "^2.0.0",
"declared_scope": "dependencies",
"manifest_path": "app/package.json",
"name": "dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "^9.0.0",
"declared_scope": "dependencies",
"manifest_path": "unresolved/package.json",
"name": "never-resolved-dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "v1.0.0",
"indirect": "true",
"manifest_path": "go.mod",
"name": "example.com/source",
"source_type": "registry"
}
],
"dependency_coverage": {
"catalog": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"failed-root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"go": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"local": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"registry": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"substitution": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"unavailable": {
"reasons": [
"not_expanded"
],
"state": "unknown"
}
},
"lockfiles": [
{
"association_diagnostics": [],
"association_status": "associated",
"completeness": "LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY",
"format": "LOCKFILE_FORMAT_NPM_PACKAGE_LOCK",
"manifest_lock_consistency": "not_checked",
"manifest_paths": [
"app/package.json"
],
"native_format_version": "3",
"path": "app/package-lock.json",
"projection_notices": [
"Target conditions were retained, not evaluated."
]
}
],
"manifest_associations": {
"app/package.json": [
"app/package-lock.json"
]
},
"notices": [
"Recorded inventory, not an exact installed build; artifacts were not inspected."
],
"primary_subject": {
"id": "root"
},
"resolution_basis": "lockfile_records_and_manifest_resolution",
"resolutions": [
{
"diagnostics": [
{
"reason": "vcpkg_baseline_not_applied"
}
],
"path": "native/vcpkg.json",
"status": "partial"
},
{
"diagnostics": [
{
"name": "",
"reason": "resolution_failed"
}
],
"path": "unresolved/package.json",
"status": "partial"
}
]
},
"schema_version": 2
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.
Required string length:
1 - 64Pattern:
^[A-Za-z0-9_-]{1,64}$Path Parameters
Analysis id returned in the HTTP 202 JSON response from POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx. Use a credential that can access that job, such as the credential used to submit it. A component bom_ref is not a job id. Missing, malformed, expired or inaccessible ids return ANALYSIS_NOT_FOUND after authentication.
Response
JSON license report, at most 16,777,216 bytes. Read inventory coverage and component evidence together; a successful response may be partial and does not provide a pass/fail decision.
Compact experimental license evidence, report schema 2. Preserve separate choices/occurrences/context/observations. HTTP 200 is not complete license coverage or a policy verdict. Legacy license endpoints keep schema 1.
Every original occurrence in producer order, with the selected primary subject first when supplied. Do not merge by coordinate.
Show child attributes
Show child attributes
Input and coverage context for the component occurrences.
Show child attributes
Show child attributes
Compact experimental report structure version. Check before decoding; future versions require matching client support.
Available options:
2 ⌘I
Preview a compact report for a completed analysis
curl --request GET \
--url https://api.githits.dev/v1/experimental/license-reports/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/experimental/license-reports/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/experimental/license-reports/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/experimental/license-reports/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/experimental/license-reports/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/experimental/license-reports/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/experimental/license-reports/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"components": [
{
"bom_ref": "root",
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": [
"app/package.json"
]
},
"license_evidence": {
"applicability_reason": "uploaded_declaration",
"artifact_verification": "not_checked",
"interpretation_methods": [
"spdx_expression"
],
"issues": [
{
"code": "deprecated",
"identifier": "GPL-2.0"
}
],
"origin_scope": "manifest",
"raw": "GPL-2.0+",
"source": "manifest_declared",
"status": "expression",
"syntax": "spdx"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "GPL-2.0+"
}
],
"name": "license-example",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "registry",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [
{
"comment": "{\"basis\":\"package_metadata\"}",
"type": "vcs",
"url": "https://example.com/dependency"
}
],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "publisher_release_metadata",
"artifact_verification": "not_checked",
"source": "registry_declared"
},
"licenses": [
{
"acknowledgement": "declared",
"expression": "MIT"
}
],
"metadata_status": "available",
"name": "dependency",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "npm_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:npm/dependency@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "substitution",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"php/composer.lock"
],
"manifest_paths": []
},
"license_evidence": {
"applicability_reason": "source_substitution",
"artifact_verification": "not_checked",
"lookup_basis": "registry_name_version",
"source": "registry_declared"
},
"licenses": [],
"metadata_status": "available",
"name": "example/substitution",
"observed_licenses": [],
"publisher_evidence": {
"capture_status": "present",
"controlling_index": 0,
"coverage": "complete",
"expression": "MIT",
"observations": [
{
"interpretation": {
"expression": "MIT",
"interpretation_methods": [
"spdx_expression"
],
"issues": [],
"status": "expression",
"syntax": "spdx"
},
"observation": {
"field": "license",
"relation": "single",
"scope": "release",
"source": "composer_manifest",
"statements": [
"MIT"
],
"status": "present",
"version": "1.0.0"
},
"relationship": "controlling"
}
],
"reason": "publisher_release_metadata",
"status": "expression"
},
"purl": "pkg:composer/example/substitution@1.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_GIT",
"source_revision": "0123456789abcdef0123456789abcdef01234567",
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "unavailable",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_status": "unavailable",
"name": "missing-metadata",
"observed_licenses": [],
"publisher_evidence": null,
"purl": "pkg:npm/missing-metadata@2.0.0",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_REGISTRY",
"type": "library",
"version": "2.0.0"
},
{
"bom_ref": "local",
"context": {
"conditions": {
"cpu": [
"x86_64"
],
"engines": [],
"os": [
"linux"
]
},
"dev_only": false,
"group_conditions": [],
"optional": true,
"source": {}
},
"external_references": [],
"inputs": {
"lockfile_paths": [
"app/package-lock.json"
],
"manifest_paths": []
},
"licenses": [],
"metadata_reason": "non_registry_source",
"metadata_status": "not_eligible",
"name": "local-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"purl_omission_reason": "non_registry_source",
"record_kind": "locked_package",
"resolution_basis": "lockfile_record",
"scope": null,
"source_evidence": null,
"source_kind": "LOCKED_PACKAGE_SOURCE_KIND_LOCAL",
"type": "library",
"version": null
},
{
"bom_ref": "catalog",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"native/vcpkg.json"
]
},
"licenses": [],
"metadata_status": "unavailable",
"name": "catalog-dependency",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "resolved_package",
"resolution_basis": "current_public_catalog",
"resolution_limitation": "vcpkg_baseline_not_applied",
"scope": null,
"source_evidence": null,
"type": "library",
"version": "1.0.0"
},
{
"bom_ref": "go",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"go.mod"
]
},
"licenses": [],
"name": "example.com/source",
"observed_licenses": [
{
"license": {
"name": "Apache-2.0"
}
},
{
"license": {
"name": "MIT"
}
}
],
"publisher_evidence": null,
"purl": "pkg:golang/example.com/source@v1.0.0",
"record_kind": "resolved_package",
"scope": null,
"source_evidence": {
"checked_at": "2026-10-22T12:00:00Z",
"files": [
{
"detected_licenses": [
"Apache-2.0"
],
"path": "LICENSE"
},
{
"detected_licenses": [
"MIT"
],
"path": "nested/LICENSE"
}
],
"last_attempt_at": "2026-10-22T12:00:00Z",
"last_attempt_status": "ambiguous",
"method": "licensecheck",
"module": "example.com/source",
"provider": "pkg_go_dev",
"status": "ambiguous",
"url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
"version": "v1.0.0"
},
"type": "library",
"version": "v1.0.0"
},
{
"bom_ref": "failed-root",
"external_references": [],
"inputs": {
"lockfile_paths": [],
"manifest_paths": [
"unresolved/package.json"
]
},
"licenses": [],
"name": "unresolved-project",
"observed_licenses": [],
"publisher_evidence": null,
"purl": null,
"record_kind": "manifest",
"scope": null,
"source_evidence": null,
"type": "library",
"version": null
}
],
"inventory": {
"completeness": "mixed_dependency_inventory",
"component_type_basis": "library_assumed_from_inventory",
"coverage": [
{
"aggregate": "incomplete",
"assemblies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
},
{
"aggregate": "unknown",
"dependencies": [
"root",
"registry",
"substitution",
"unavailable",
"local",
"catalog",
"go",
"failed-root"
]
}
],
"declaration_agreement": [
{
"declaration_path": "app/package.json",
"declared_scope": "dependencies",
"locked_versions": [
"1.0.0"
],
"matched_versions": [],
"name": "dependency",
"path": "app/package-lock.json",
"recorded_scopes": [
"dependencies"
],
"requested_requirement": "^2.0.0",
"requirement_status": "recorded",
"status": "version_mismatch"
}
],
"declarations": [
{
"declared_requirement": "^2.0.0",
"declared_scope": "dependencies",
"manifest_path": "app/package.json",
"name": "dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "^9.0.0",
"declared_scope": "dependencies",
"manifest_path": "unresolved/package.json",
"name": "never-resolved-dependency",
"optional": "false",
"source_type": "registry"
},
{
"declared_requirement": "v1.0.0",
"indirect": "true",
"manifest_path": "go.mod",
"name": "example.com/source",
"source_type": "registry"
}
],
"dependency_coverage": {
"catalog": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"failed-root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"go": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"local": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"registry": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"root": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"substitution": {
"reasons": [
"not_expanded"
],
"state": "unknown"
},
"unavailable": {
"reasons": [
"not_expanded"
],
"state": "unknown"
}
},
"lockfiles": [
{
"association_diagnostics": [],
"association_status": "associated",
"completeness": "LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY",
"format": "LOCKFILE_FORMAT_NPM_PACKAGE_LOCK",
"manifest_lock_consistency": "not_checked",
"manifest_paths": [
"app/package.json"
],
"native_format_version": "3",
"path": "app/package-lock.json",
"projection_notices": [
"Target conditions were retained, not evaluated."
]
}
],
"manifest_associations": {
"app/package.json": [
"app/package-lock.json"
]
},
"notices": [
"Recorded inventory, not an exact installed build; artifacts were not inspected."
],
"primary_subject": {
"id": "root"
},
"resolution_basis": "lockfile_records_and_manifest_resolution",
"resolutions": [
{
"diagnostics": [
{
"reason": "vcpkg_baseline_not_applied"
}
],
"path": "native/vcpkg.json",
"status": "partial"
},
{
"diagnostics": [
{
"name": "",
"reason": "resolution_failed"
}
],
"path": "unresolved/package.json",
"status": "partial"
}
]
},
"schema_version": 2
}