> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Preview a compact report for a completed analysis > Retrieve compact report `schema_version: 2` for an existing authorized CycloneDX SBOM job. Use the analysis ID returned by `POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx`, after its existing status/events indicate success. A component `bom_ref` is not an analysis ID. The synchronous compact POST returns no job ID. ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --output license-report.json \ 'https://api.githits.dev/v1/experimental/license-reports/{id}' ``` `/path/to/private-auth.conf` is your own protected curl configuration containing your authorization header, kept outside the repository. Use a credential with access to the submitted job, such as the submission credential. Check curl's exit status: failures save a JSON problem rather than a report. This read fetches one existing authorized result and projects it; it never resubmits, resolves, enriches or fetches source URLs. Operation cost is 0, with no new analysis reservation. The original job's status/events/result links, representation, owner/expiry gates and retention stay unchanged. No query parameters or `Accept`-based report selection are supported. The legacy `/v1/experimental/licenses/{id}` read remains schema 1, and the original CycloneDX result remains available through the job's `result_url`. **Interpret the report** The compact POST documents the full report semantics. Keep every original occurrence and supplied identity qualifier; `bom_ref` and typed `inputs` retain attribution. Reported choices, publisher statements/context and observed file detections remain distinct. Original source observations and latest-attempt state/time do not certify your installed artifact. Local source does not prove first-party ownership. No license normalization, inferred AND/OR or pass/fail verdict is added. Purpose-specific fields are already JSON objects/arrays; they replace JSON strings inside generic property containers. `license_evidence` retains independent occurrence limitations and manifest/legacy detail only when it is not a mirror of canonical publisher evidence. Inventory coverage and named declaration gaps are not license completeness. Missing requirements never imply unrestricted selection. Empty matched-version lists do not imply no lock evidence; original provider proofs remain in the schema-1 view/SBOM. Null, absent facts, empty choices, unfamiliar statuses and unresolved references retain uncertainty. HTTP 200 does not establish that every dependency or license is known. Report output is bounded at 16,777,216 bytes and is never truncated. Dependency adjacency, component/reference digests and generic SBOM/debug properties are omitted from this compact view. **Handle errors** Problems use `application/problem+json`; branch on `code`, keep `X-Request-ID`, and honor `Retry-After`. | Status / code | Meaning and next action | | --- | --- | | 400 `VALIDATION_ERROR` / `INVALID_SESSION_ID` | Remove query parameters or correct the named field/session header. | | 401 / 403 | Check credential, ownership/account eligibility and required terms. | | 404 `ANALYSIS_NOT_FOUND` | Check the submission ID and credential. Missing, malformed, expired and inaccessible IDs share this response after authentication. | | 409 `ANALYSIS_PENDING` | Wait through existing status/events, then retry the same read. | | 409 `ANALYSIS_FAILED` | Inspect the safe open `failure_code` and job status before deliberately submitting new work. | | 409 `INCOMPATIBLE_ANALYSIS` | Use a job submitted with `kind=sbom&format=cyclonedx`; audit/SPDX/text jobs are not converted. | | 422 `LICENSE_REPORT_TOO_LARGE` | The compact report exceeds its limit. Read the original available job result or request a smaller inventory. | | 429 / 502 / 503 / 504 | Respect retry guidance and retain the job/request IDs. Retry the existing read for transient failures instead of creating another analysis. | Responses use `Cache-Control: no-store`. Stable promotion is a later acceptance step; current schema-1 endpoints and saved reports remain unchanged. ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json get /v1/experimental/license-reports/{id} openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation or source code | Browse with list, then follow an exact action through the unified read operation | | Browse known content | List source files, local documentation, or an explicit hosted site | | Find exact text | Grep across ordered packages, repositories and hosted sites, then follow exact read actions | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Research a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Report dependency licenses | Upload manifests/lockfiles or use a completed analysis to read license choices, source observations and coverage for each reported entry | | Generate an SBOM | Upload manifests and lockfiles to receive a CycloneDX, SPDX or text inventory | | Audit lockfiles | Submit asynchronous audit analysis, follow status or SSE, then download findings and independent coverage as JSON | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Standard SBOM documents and embedded standard objects in licenses reports retain their format's field names. Percent-encode path parameters such as package names as one path segment, including any embedded slash. The unified read target is a query value: encode a literal plus sign as `%2B` and a literal fragment marker as `%23`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`; job events use `no-store, no-transform` to preserve streaming. When available, successful and rate-limited responses from operations that document them include `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` for the shared usage window. All three header values must be available; a credential type alone does not guarantee these headers. Reset is an absolute Unix epoch timestamp in seconds (UTC), rounded up, not a delay. These snapshots support pacing; concurrent requests and other quotas can still cause 429. Honor `Retry-After` when supplied. The trio is omitted when usage metadata is unavailable, and is not exposed for generated examples, Research, feedback, language discovery, SBOM/licenses generation and licenses views, or job submission, events and results. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Research, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Current source-advisory evidence by ID, independent of package-version assessment. name: Vulnerabilities - description: >- Find exact text across ordered source and hosted-documentation scopes, check coverage, and follow exact reads. name: Grep - description: >- Browse package, repository or hosted-site paths and follow exact read and browse actions. name: List - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Read an exact documentation page or source file and retain the page, package-version or repository-commit details needed to cite it. name: Read - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: Stable exact-tree source comparison. name: Code Diff - description: >- Preview target resolution, cited questions and SBOM generation, plus the deprecated source comparison alias. Use /v1/code/diff for stable source comparison. name: Experimental paths: /v1/experimental/license-reports/{id}: get: tags: - Experimental summary: Preview a compact report for a completed analysis description: > Retrieve compact report `schema_version: 2` for an existing authorized CycloneDX SBOM job. Use the analysis ID returned by `POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx`, after its existing status/events indicate success. A component `bom_ref` is not an analysis ID. The synchronous compact POST returns no job ID. ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --output license-report.json \ 'https://api.githits.dev/v1/experimental/license-reports/{id}' ``` `/path/to/private-auth.conf` is your own protected curl configuration containing your authorization header, kept outside the repository. Use a credential with access to the submitted job, such as the submission credential. Check curl's exit status: failures save a JSON problem rather than a report. This read fetches one existing authorized result and projects it; it never resubmits, resolves, enriches or fetches source URLs. Operation cost is 0, with no new analysis reservation. The original job's status/events/result links, representation, owner/expiry gates and retention stay unchanged. No query parameters or `Accept`-based report selection are supported. The legacy `/v1/experimental/licenses/{id}` read remains schema 1, and the original CycloneDX result remains available through the job's `result_url`. **Interpret the report** The compact POST documents the full report semantics. Keep every original occurrence and supplied identity qualifier; `bom_ref` and typed `inputs` retain attribution. Reported choices, publisher statements/context and observed file detections remain distinct. Original source observations and latest-attempt state/time do not certify your installed artifact. Local source does not prove first-party ownership. No license normalization, inferred AND/OR or pass/fail verdict is added. Purpose-specific fields are already JSON objects/arrays; they replace JSON strings inside generic property containers. `license_evidence` retains independent occurrence limitations and manifest/legacy detail only when it is not a mirror of canonical publisher evidence. Inventory coverage and named declaration gaps are not license completeness. Missing requirements never imply unrestricted selection. Empty matched-version lists do not imply no lock evidence; original provider proofs remain in the schema-1 view/SBOM. Null, absent facts, empty choices, unfamiliar statuses and unresolved references retain uncertainty. HTTP 200 does not establish that every dependency or license is known. Report output is bounded at 16,777,216 bytes and is never truncated. Dependency adjacency, component/reference digests and generic SBOM/debug properties are omitted from this compact view. **Handle errors** Problems use `application/problem+json`; branch on `code`, keep `X-Request-ID`, and honor `Retry-After`. | Status / code | Meaning and next action | | --- | --- | | 400 `VALIDATION_ERROR` / `INVALID_SESSION_ID` | Remove query parameters or correct the named field/session header. | | 401 / 403 | Check credential, ownership/account eligibility and required terms. | | 404 `ANALYSIS_NOT_FOUND` | Check the submission ID and credential. Missing, malformed, expired and inaccessible IDs share this response after authentication. | | 409 `ANALYSIS_PENDING` | Wait through existing status/events, then retry the same read. | | 409 `ANALYSIS_FAILED` | Inspect the safe open `failure_code` and job status before deliberately submitting new work. | | 409 `INCOMPATIBLE_ANALYSIS` | Use a job submitted with `kind=sbom&format=cyclonedx`; audit/SPDX/text jobs are not converted. | | 422 `LICENSE_REPORT_TOO_LARGE` | The compact report exceeds its limit. Read the original available job result or request a smaller inventory. | | 429 / 502 / 503 / 504 | Respect retry guidance and retain the job/request IDs. Retry the existing read for transient failures instead of creating another analysis. | Responses use `Cache-Control: no-store`. Stable promotion is a later acceptance step; current schema-1 endpoints and saved reports remain unchanged. operationId: get_compact_dependency_licenses parameters: - description: >- Analysis id returned in the HTTP 202 JSON response from POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx. Use a credential that can access that job, such as the credential used to submit it. A component bom_ref is not a job id. Missing, malformed, expired or inaccessible ids return ANALYSIS_NOT_FOUND after authentication. in: path name: id required: true schema: type: string - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created. in: header name: X-GitHits-Session-ID required: false schema: maxLength: 64 minLength: 1 pattern: ^[A-Za-z0-9_-]{1,64}$ type: string responses: '200': content: application/json: example: components: - bom_ref: root external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: - app/package.json license_evidence: applicability_reason: uploaded_declaration artifact_verification: not_checked interpretation_methods: - spdx_expression issues: - code: deprecated identifier: GPL-2.0 origin_scope: manifest raw: GPL-2.0+ source: manifest_declared status: expression syntax: spdx licenses: - acknowledgement: declared expression: GPL-2.0+ name: license-example observed_licenses: [] publisher_evidence: null purl: null record_kind: manifest scope: null source_evidence: null type: library version: 1.0.0 - bom_ref: registry context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: - comment: '{"basis":"package_metadata"}' type: vcs url: https://example.com/dependency inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] license_evidence: applicability_reason: publisher_release_metadata artifact_verification: not_checked source: registry_declared licenses: - acknowledgement: declared expression: MIT metadata_status: available name: dependency observed_licenses: [] publisher_evidence: capture_status: present controlling_index: 0 coverage: complete expression: MIT observations: - interpretation: expression: MIT interpretation_methods: - spdx_expression issues: [] status: expression syntax: spdx observation: field: license relation: single scope: release source: npm_manifest statements: - MIT status: present version: 1.0.0 relationship: controlling reason: publisher_release_metadata status: expression purl: pkg:npm/dependency@1.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_REGISTRY type: library version: 1.0.0 - bom_ref: substitution context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - php/composer.lock manifest_paths: [] license_evidence: applicability_reason: source_substitution artifact_verification: not_checked lookup_basis: registry_name_version source: registry_declared licenses: [] metadata_status: available name: example/substitution observed_licenses: [] publisher_evidence: capture_status: present controlling_index: 0 coverage: complete expression: MIT observations: - interpretation: expression: MIT interpretation_methods: - spdx_expression issues: [] status: expression syntax: spdx observation: field: license relation: single scope: release source: composer_manifest statements: - MIT status: present version: 1.0.0 relationship: controlling reason: publisher_release_metadata status: expression purl: pkg:composer/example/substitution@1.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_GIT source_revision: 0123456789abcdef0123456789abcdef01234567 type: library version: 1.0.0 - bom_ref: unavailable context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] licenses: [] metadata_status: unavailable name: missing-metadata observed_licenses: [] publisher_evidence: null purl: pkg:npm/missing-metadata@2.0.0 record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_REGISTRY type: library version: 2.0.0 - bom_ref: local context: conditions: cpu: - x86_64 engines: [] os: - linux dev_only: false group_conditions: [] optional: true source: {} external_references: [] inputs: lockfile_paths: - app/package-lock.json manifest_paths: [] licenses: [] metadata_reason: non_registry_source metadata_status: not_eligible name: local-dependency observed_licenses: [] publisher_evidence: null purl: null purl_omission_reason: non_registry_source record_kind: locked_package resolution_basis: lockfile_record scope: null source_evidence: null source_kind: LOCKED_PACKAGE_SOURCE_KIND_LOCAL type: library version: null - bom_ref: catalog external_references: [] inputs: lockfile_paths: [] manifest_paths: - native/vcpkg.json licenses: [] metadata_status: unavailable name: catalog-dependency observed_licenses: [] publisher_evidence: null purl: null record_kind: resolved_package resolution_basis: current_public_catalog resolution_limitation: vcpkg_baseline_not_applied scope: null source_evidence: null type: library version: 1.0.0 - bom_ref: go external_references: [] inputs: lockfile_paths: [] manifest_paths: - go.mod licenses: [] name: example.com/source observed_licenses: - license: name: Apache-2.0 - license: name: MIT publisher_evidence: null purl: pkg:golang/example.com/source@v1.0.0 record_kind: resolved_package scope: null source_evidence: checked_at: '2026-10-22T12:00:00Z' files: - detected_licenses: - Apache-2.0 path: LICENSE - detected_licenses: - MIT path: nested/LICENSE last_attempt_at: '2026-10-22T12:00:00Z' last_attempt_status: ambiguous method: licensecheck module: example.com/source provider: pkg_go_dev status: ambiguous url: >- https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses version: v1.0.0 type: library version: v1.0.0 - bom_ref: failed-root external_references: [] inputs: lockfile_paths: [] manifest_paths: - unresolved/package.json licenses: [] name: unresolved-project observed_licenses: [] publisher_evidence: null purl: null record_kind: manifest scope: null source_evidence: null type: library version: null inventory: completeness: mixed_dependency_inventory component_type_basis: library_assumed_from_inventory coverage: - aggregate: incomplete assemblies: - root - registry - substitution - unavailable - local - catalog - go - failed-root - aggregate: unknown dependencies: - root - registry - substitution - unavailable - local - catalog - go - failed-root declaration_agreement: - declaration_path: app/package.json declared_scope: dependencies locked_versions: - 1.0.0 matched_versions: [] name: dependency path: app/package-lock.json recorded_scopes: - dependencies requested_requirement: ^2.0.0 requirement_status: recorded status: version_mismatch declarations: - declared_requirement: ^2.0.0 declared_scope: dependencies manifest_path: app/package.json name: dependency optional: 'false' source_type: registry - declared_requirement: ^9.0.0 declared_scope: dependencies manifest_path: unresolved/package.json name: never-resolved-dependency optional: 'false' source_type: registry - declared_requirement: v1.0.0 indirect: 'true' manifest_path: go.mod name: example.com/source source_type: registry dependency_coverage: catalog: reasons: - not_expanded state: unknown failed-root: reasons: - not_expanded state: unknown go: reasons: - not_expanded state: unknown local: reasons: - not_expanded state: unknown registry: reasons: - not_expanded state: unknown root: reasons: - not_expanded state: unknown substitution: reasons: - not_expanded state: unknown unavailable: reasons: - not_expanded state: unknown lockfiles: - association_diagnostics: [] association_status: associated completeness: LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY format: LOCKFILE_FORMAT_NPM_PACKAGE_LOCK manifest_lock_consistency: not_checked manifest_paths: - app/package.json native_format_version: '3' path: app/package-lock.json projection_notices: - Target conditions were retained, not evaluated. manifest_associations: app/package.json: - app/package-lock.json notices: - >- Recorded inventory, not an exact installed build; artifacts were not inspected. primary_subject: id: root resolution_basis: lockfile_records_and_manifest_resolution resolutions: - diagnostics: - reason: vcpkg_baseline_not_applied path: native/vcpkg.json status: partial - diagnostics: - name: '' reason: resolution_failed path: unresolved/package.json status: partial schema_version: 2 schema: $ref: '#/components/schemas/CompactDependencyLicensesReport' description: >- JSON license report, at most 16,777,216 bytes. Read inventory coverage and component evidence together; a successful response may be partial and does not provide a pass/fail decision. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '400': content: application/problem+json: examples: invalid_session_id: value: code: INVALID_SESSION_ID detail: >- X-GitHits-Session-ID must occur once and match [A-Za-z0-9_-]{1,64}. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Invalid session ID type: about:blank upstream_validation: summary: Invalid request without a field-specific explanation value: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank validation: value: code: VALIDATION_ERROR detail: >- query: contains unknown parameters; use only the documented parameters. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- VALIDATION_ERROR, INVALID_SESSION_ID. Correct the field named in detail or the session header. These operations accept no query parameters. INVALID_SESSION_ID: a supplied session header is invalid or duplicated. VALIDATION_ERROR details identify the first invalid field and a reason when available. Array indices are zero-based; submitted values and unknown keys are not echoed. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: AUTHENTICATION_REQUIRED. Supply a valid Bearer credential. headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer challenge. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- FORBIDDEN, ACCOUNT_INACTIVE, TERMS_ACCEPTANCE_REQUIRED. Check credential access, account eligibility and required terms; follow terms_url or acceptance_url when provided. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '404': content: application/problem+json: example: code: ANALYSIS_NOT_FOUND detail: The analysis is unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 404 title: Analysis request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- ANALYSIS_NOT_FOUND. Check the submission id and credential. Missing, expired and inaccessible jobs have the same response. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: GET, HEAD.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '409': content: application/problem+json: example: code: ANALYSIS_PENDING detail: The analysis has not finished. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 409 title: Analysis request failed type: about:blank schema: oneOf: - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - ANALYSIS_PENDING type: string detail: enum: - The analysis has not finished. type: string title: enum: - Analysis request failed type: string required: - code - title - detail type: object - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - ANALYSIS_FAILED type: string detail: enum: - The analysis failed. type: string failure_code: description: >- Failure code from the analysis; new codes can appear. Internal diagnostics are not included. type: string title: enum: - Analysis request failed type: string required: - code - title - detail - failure_code type: object - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - INCOMPATIBLE_ANALYSIS type: string type: object description: >- ANALYSIS_PENDING, ANALYSIS_FAILED, INCOMPATIBLE_ANALYSIS. For ANALYSIS_PENDING, wait through status/events and retry this GET. For ANALYSIS_FAILED, inspect failure_code before submitting new work. For INCOMPATIBLE_ANALYSIS, use a job created with kind=sbom&format=cyclonedx. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '422': content: application/problem+json: example: code: LICENSE_REPORT_TOO_LARGE detail: The licenses report exceeds the response limit. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 422 title: Licenses request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- LICENSE_REPORT_TOO_LARGE. The JSON report is too large. Use the job's result_url to download its original CycloneDX document, or submit a smaller analysis if appropriate. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- RATE_LIMITED. Respect Retry-After when supplied before trying again. RATE_LIMITED can also mean your shared daily allowance is exhausted. When Retry-After is supplied, wait until that delay or HTTP date before trying again. headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: >- Delay in seconds or an HTTP date indicating when to retry, when supplied. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '500': description: >- A request ID could not be assigned. The response has an empty body and no X-Request-ID or problem object; try again later. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- UPSTREAM_ERROR. The analysis result could not be read. Keep X-Request-ID for support and report a persistent failure; a new submission creates another analysis. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '503': content: application/problem+json: example: code: ANALYSIS_UNAVAILABLE detail: Analysis is temporarily unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 503 title: Analysis request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- ANALYSIS_UNAVAILABLE, UPSTREAM_UNAVAILABLE. Retry reading the same job later; this does not start another analysis. QUOTA_UNAVAILABLE: your daily allowance could not be checked. This is temporary; retry the same request later (retryable=true). headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- TIMEOUT. Retry reading the same job later; this does not start another analysis. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string security: - bearer_auth: [] components: schemas: CompactDependencyLicensesReport: additionalProperties: true description: >- Compact experimental license evidence, report schema 2. Preserve separate choices/occurrences/context/observations. HTTP 200 is not complete license coverage or a policy verdict. Legacy license endpoints keep schema 1. properties: components: description: >- Every original occurrence in producer order, with the selected primary subject first when supplied. Do not merge by coordinate. items: $ref: '#/components/schemas/CompactDependencyLicensesComponent' description: One original occurrence. type: array inventory: $ref: '#/components/schemas/CompactDependencyLicensesInventory' description: Input and coverage context for the component occurrences. schema_version: description: >- Compact experimental report structure version. Check before decoding; future versions require matching client support. enum: - 2 type: integer required: - schema_version - inventory - components type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: Link for accepting the required terms, when provided. type: string code: description: The stable uppercase API error code. type: string detail: description: >- Human-readable explanation. Wording can change; use code and structured fields for program logic. Validation errors identify the first invalid field (including zero-based array indices) and a reason; version errors can include canonical-version guidance. type: string instance: description: >- Request ID matching the X-Request-ID response header; include it when seeking support. type: string retryable: description: >- Whether retrying later may help, when supplied. Follow this flag for lookup/provider outcomes and temporary daily-allowance failures; malformed evidence can be nonretryable. type: boolean status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: Link to the terms that require acceptance, when provided. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object CompactDependencyLicensesComponent: additionalProperties: true description: >- One original occurrence, preserving repeated coordinates, qualifiers, excluded scopes and source/file/project subjects. The compact report omits graph/checksum/property-bag machinery, without inventing evidence. properties: bom_ref: description: >- Opaque reference for this occurrence, used by inventory relationships. null means no reference was available. Do not merge entries by name, version or package URL. type: - string - 'null' component_type_basis: description: >- Original qualification of this occurrence classification, including assumed or generic subject types. type: string context: additionalProperties: true description: >- Original structured occurrence conditions/platform/source context. Conditions are retained, never evaluated; unfamiliar fields and values remain evidence. type: object external_references: description: >- Original source/license/distribution and other references with non-hash metadata and owner/scope comments. Component and reference digests are omitted in this compact contract. URLs are never fetched and do not prove artifact inspection. items: additionalProperties: true type: object type: array inputs: $ref: '#/components/schemas/CompactDependencyLicensesInputs' description: Typed original input attribution for this occurrence. license_evidence: $ref: '#/components/schemas/CompactDependencyLicensesEvidence' description: Optional independent or legacy license facts, only when supplied. licenses: description: >- Reported license-choice objects, usually containing expression (for example MIT OR Apache-2.0) or license with an id/name, and optional acknowledgement. Keep each choice intact. Separate entries do not imply AND or OR, and an empty array means no choices were reported. These are evidence, not a pass/fail decision. items: additionalProperties: true type: object type: array metadata_reason: description: >- Original open reason metadata could not apply, for example non_registry_source or non_public_registry_source. type: string metadata_status: description: >- Original metadata acquisition status, distinguishing available, unavailable and not_eligible; available does not mean a license is known. type: string name: description: >- Reported project, package, source or file name. A name alone does not identify a unique package occurrence. type: string observed_licenses: description: >- Independent license observations, such as licenses identified in source files. Keep these separate from licenses and publisher statements; see source_evidence for file paths and detection status. An empty array means no observations were reported, not that every file was checked. items: additionalProperties: true type: object type: array publisher_evidence: additionalProperties: true description: >- Original publisher license statements and the context needed to interpret them. This is already a JSON object. observations retains statement text, source, scope, field, version, interpretation/issues and relationship. capture_status describes retained statement capture; coverage concerns that statement collection, not your dependency inventory. status/reason/expression describe interpretation. controlling_index identifies the selected observation when one was selected. Package/repository context may not apply to a specific release. null means no publisher evidence object was available, not that the package has no license. Accept unfamiliar statuses and additional fields. The redundant derived display_value hint is omitted; all substantive observations and limitations remain. type: - object - 'null' purl: description: >- Package URL (PURL), or null when unavailable. Its presence identifies a package coordinate; it does not verify your installed artifact. type: - string - 'null' purl_omission_reason: description: >- Original reason no usable package URL was supplied; the gateway never fabricates one. type: string record_kind: description: >- Why this entry is included: examples are manifest for an uploaded project, resolved_package for a dependency found by resolution, and locked_package for a lockfile occurrence. null means unspecified. Other values can appear. type: - string - 'null' resolution_basis: description: >- Original occurrence version-selection basis, for example lockfile_record or current_public_catalog; not an installed-build claim. type: string resolution_limitation: description: >- Original limitation on occurrence resolution, for example vcpkg_baseline_not_applied. type: string scope: description: >- Reported component scope, for example excluded. null means the scope was not specified. Entries with excluded scope remain in the report. type: - string - 'null' source_evidence: additionalProperties: true description: >- Source-file license detection details, already a JSON object. provider/method identify the detection service and technique; module/version identify what was examined. files contains path and detected_licenses, including nested license files. checked_at/status describe the available observation; last_attempt_at/last_attempt_status describe the latest attempt, which can fail while an older observation remains. null means no source observation was available. Accept unfamiliar statuses and additional fields; this does not certify an installed artifact. type: - object - 'null' source_kind: description: >- Original open source kind, including local/Git/registry distinctions. Local does not establish first-party ownership. type: string source_locator_omission_reason: description: Original reason the source locator could not be published or used. type: string source_revision: description: >- Original recorded source revision. Its presence does not prove that commit or its license was inspected. type: string source_revision_omission_reason: description: Original reason a source revision was unavailable or withheld. type: string source_selector: description: >- Original recorded source selector, preserved without resolving or fetching it. type: string source_selector_basis: description: Original basis attributing the recorded selector to its input. type: string source_selector_kind: description: Original open selector kind, such as branch, tag or commit. type: string source_selector_omission_reason: description: Original reason a selector was unavailable or withheld. type: string type: description: >- Component classification, for example library or file. Additional string values can appear; accept unfamiliar classifications. type: string version: description: Reported version text, or null when no version was available. type: - string - 'null' required: - bom_ref - name - version - purl - type - scope - record_kind - licenses - observed_licenses - publisher_evidence - source_evidence - external_references - inputs type: object CompactDependencyLicensesInventory: additionalProperties: true description: >- Typed original input attribution and meaningful inventory/acquisition/coverage gaps. No dependency adjacency or generic property container is exposed. properties: completeness: description: >- How the inventory was built, for example recorded_lockfile_inventory, resolved_manifest_inventory, partial_manifest_inventory or mixed_dependency_inventory. null means unreported, and additional values can appear. This does not measure license coverage; HTTP 200 or a component count does not prove completeness. type: - string - 'null' component_type_basis: description: >- Original open basis qualifying inventory component classifications, including assumptions. type: string coverage: description: >- Original coverage groups with explicit scope/reference membership, independent of licenses or reported adjacency. items: $ref: '#/components/schemas/CompactDependencyLicensesCoverage' description: One original coverage group. type: array declaration_agreement: description: >- Named declaration/lock agreement outcomes, preserving gaps without provider proof catalogues or recomputing policy. Empty version lists on a matched outcome do not mean no lock evidence; provider proof remains in schema 1 and the original SBOM. items: additionalProperties: true description: One original agreement summary. properties: declaration_path: description: Original declaration path value; vocabulary remains open. type: - string - 'null' declared_scope: description: Original declared scope value; vocabulary remains open. type: - string - 'null' locked_versions: description: Original locked versions, without gateway matching. items: type: - string - 'null' type: array matched_versions: description: Original matched versions, without gateway matching. items: type: - string - 'null' type: array name: description: Original name value; vocabulary remains open. type: - string - 'null' path: description: Original path value; vocabulary remains open. type: - string - 'null' recorded_scopes: description: Original recorded scopes, without gateway matching. items: type: string type: array requested_requirement: description: Original requested requirement value; vocabulary remains open. type: - string - 'null' requirement_status: description: Original requirement status value; vocabulary remains open. type: - string - 'null' status: description: Original status value; vocabulary remains open. type: - string - 'null' type: object type: array declarations: description: >- Original named direct requests. These can be the only missing dependency names after a wholesale resolver failure; never treat them as resolved package components. items: additionalProperties: true description: Minimal original declaration summary. properties: declared_requirement: description: >- Original requested range/text, not a selected version. Absence means not recorded or withheld, never an unconstrained requirement. type: string declared_scope: description: Original request scope. type: string indirect: description: >- Original producer indirect flag text; do not coerce absence into false. type: string manifest_path: description: Original declaring input path. type: string name: description: Original requested dependency name. type: string optional: description: >- Original producer optional flag text; unfamiliar strings are accepted. type: string source_type: description: Original source type for the request. type: string type: object type: array dependency_coverage: additionalProperties: $ref: '#/components/schemas/CompactDependencyLicensesDependencyCoverage' description: Original coverage for this reference. description: >- Original reference-keyed outgoing dependency coverage. Keep unresolved refs and complete/incomplete/unknown entries; a missing owner never implies completeness. type: object lockfiles: description: >- Input association/completeness summaries without generic SBOM bookkeeping. items: $ref: '#/components/schemas/CompactDependencyLicensesLockfile' description: One meaningful lockfile input summary. type: array manifest_associations: additionalProperties: description: Original associated lockfile paths for this manifest. items: type: string type: array description: >- Original manifest-path to lockfile-path associations. These are not a lock freshness check. type: object notices: description: >- Every supplied inventory notice, in original order; absence is not a completion assertion. items: type: string type: array primary_subject: additionalProperties: true description: >- Original selected primary occurrence reference or absence reason; no project root is fabricated. type: object resolution_basis: description: >- Original open inventory-construction/resolution basis; not an observed installation. type: string resolutions: description: >- Original resolution outcomes for inputs, including meaningful diagnostics. items: $ref: '#/components/schemas/CompactDependencyLicensesResolution' description: One input-resolution outcome. type: array required: - completeness - notices - coverage type: object CompactDependencyLicensesInputs: additionalProperties: true description: >- Original input-path evidence for this occurrence. Repetitions remain; empty arrays mean no paths were supplied, not complete attribution. properties: lockfile_paths: description: >- Supplied lockfile paths, preserving producer property order and repetitions. items: type: string type: array manifest_paths: description: >- Supplied manifest paths, preserving producer property order and repetitions. items: type: string type: array required: - manifest_paths - lockfile_paths type: object CompactDependencyLicensesEvidence: additionalProperties: true description: >- Occurrence license facts. With canonical publisher evidence only independent source, lookup_basis, artifact_verification and applicability_reason remain here; statements/interpretation stay with their canonical owner. Without it, retained legacy/manifest details are explicit. No missing fact is defaulted. properties: applicability_reason: description: >- Original producer applicability/conclusion-basis reason, such as source_substitution; no SPDX conclusion or policy verdict is exported. type: string artifact_verification: description: >- Original verification limitation, such as not_checked; absence never implies verified. type: string interpretation_methods: description: >- Original open interpretation-method names, without gateway reinterpretation. items: type: string type: array issues: description: >- Original interpretation issues, retaining identifiers, offsets and unfamiliar issue shapes. items: additionalProperties: true type: - 'null' - boolean - object - array - number - string type: array lookup_basis: description: >- Original lookup basis, such as registry_name_version; not artifact inspection. type: string origin_scope: description: >- Original manifest/release/package/repository scope of legacy evidence. type: string raw: description: >- Original unnormalized license text when no canonical publisher object is available. type: string source: description: >- Original acquisition channel; registry_declared alone does not establish publisher-release applicability. type: string status: description: >- Original open legacy interpretation status, used only without canonical publisher evidence. type: string syntax: description: Original legacy statement syntax, not a gateway normalization rule. type: string type: object CompactDependencyLicensesCoverage: additionalProperties: true description: >- One original inventory/relationship coverage group. Preserve scope-key presence and references. Missing scope is unrecognized; missing or unfamiliar aggregate is not complete. This is not license coverage. properties: aggregate: description: >- Original open coverage state, for example incomplete or unknown. Accept unfamiliar values. type: - string - 'null' assemblies: description: >- Original component occurrence references covered by this group; presence identifies component-inventory scope. items: type: string type: array dependencies: description: >- Original references whose outgoing dependency coverage is described; these are not graph edges. items: type: string type: array services: description: >- Original service coverage references when supplied; do not reinterpret as components. items: type: string type: array type: object CompactDependencyLicensesDependencyCoverage: additionalProperties: true description: >- Original outgoing dependency coverage for one occurrence; independent of descendant completeness. Unfamiliar fields/codes and missing state remain evidence of uncertainty. properties: reasons: description: >- Original open reason codes explaining incomplete or unknown coverage. items: type: string type: array state: description: >- Open producer coverage state; missing/null/unfamiliar values do not mean complete. type: - string - 'null' type: object CompactDependencyLicensesLockfile: additionalProperties: true description: >- License-relevant input summary. Generic record catalogues, counters, checksum machinery and producer format versions are omitted. properties: association_diagnostics: description: >- Original meaningful association diagnostics, including incomplete/ambiguous association. items: additionalProperties: true description: One original association diagnostic. type: object type: array association_status: description: >- Open manifest/lockfile association outcome; association does not prove freshness. type: - string - 'null' completeness: description: >- Open recorded-input completeness state; not installed-build or license completeness. type: - string - 'null' format: description: Open producer lockfile-format name, not a request selector. type: - string - 'null' manifest_lock_consistency: description: >- Original consistency state, such as not_checked; no check is invented. type: - string - 'null' manifest_paths: description: >- Original manifests associated with this input; absence does not establish that none exist. items: type: string type: array native_format_version: description: Native format version text, not producer protocol/capture version. type: - string - 'null' path: description: Original input lockfile path. type: - string - 'null' projection_notices: description: >- Original notices about retained/omitted input evidence and interpretation limits. items: type: string type: array type: object CompactDependencyLicensesResolution: additionalProperties: true description: >- Original input-resolution outcome with structured diagnostics. A successful report can contain partial or unknown outcomes. properties: diagnostics: description: >- Original structured resolution diagnostics; values and additions remain open. items: additionalProperties: true description: One original resolution diagnostic; no raw diagnostic is logged. type: object type: array path: description: Input path as supplied by the producer, when available. type: - string - 'null' status: description: Open original resolution status; accept unfamiliar values. type: - string - 'null' type: object securitySchemes: bearer_auth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.