Experimental

Report dependency licenses from uploaded files

Create a JSON license report from your project’s manifests and lockfiles, including transitive dependencies found during analysis. The report lists projects, packages and source/file entries, their license choices, source observations and coverage. It can contain incomplete results or unknown licenses; HTTP 200 does not mean every dependency or license is known.

First request

Use a GitHits Bearer credential for an active account with the required terms accepted. In these examples, /path/to/private-auth.conf is your own protected curl configuration containing header = "Authorization: Bearer <token>"; replace the placeholder privately and keep the file outside your repository.

Run from your repository root:

curl --config /path/to/private-auth.conf \
  --fail-with-body --silent --show-error \
  --form 'files[]=@package.json;filename=package.json' \
  --form 'files[]=@package-lock.json;filename=package-lock.json' \
  --output licenses.json \
  'https://api.githits.dev/v1/experimental/licenses'

Repeat the literal field name files[] for each file. For a nested project, preserve the path in both places, for example files[]=@app/package.json;filename=app/package.json. This lets related manifests and lockfiles be associated. Let curl set the multipart Content-Type and boundary. Only files[] parts are accepted: do not send query parameters, kind, format, repository URLs, archives, base64 data or policy files. Accept does not change the response format.

On HTTP 200, licenses.json contains the report itself, with schema_version, inventory and components. On an HTTP error, curl exits unsuccessfully and writes a JSON problem to that file; check the exit status before treating it as a report. Save a successful response: this synchronous operation returns no job ID or retrieval URL. A component’s bom_ref is not an analysis job ID.

Inputs and limits

Supported inputs are the same as Generate an SBOM (POST /v1/experimental/sbom): for example Cargo.toml/Cargo.lock, package.json/package-lock.json, or supported pnpm and Yarn lockfiles. Lockfiles can be uploaded alone; manifests without a compatible lockfile resolve dependencies separately. File contents determine support. go.sum and requirements.txt are unsupported companion files. One unusable file rejects the whole upload; inspect the problem’s files entries for its path and status.

Send 1–256 raw UTF-8 files, each at most 5,242,880 bytes. The entire multipart request, including boundaries and headers, must fit within 8,000,000 bytes. Each filename is a repository-relative path of at most 1,024 UTF-8 bytes, without backslashes, control characters, or empty, dot or parent path segments.

The upload must finish within 30 seconds. After upload, analysis can wait up to 150 seconds for a response. A timeout does not guarantee that processing stopped. Repeating POST creates another analysis; there is no idempotency key or saved result to resume.

Long-running work and usage

For work that may outlast the synchronous request, submit POST /v1/experimental/lockfile-jobs?kind=sbom&format=cyclonedx with the same files. Its HTTP 202 JSON response supplies an analysis id, plus status_url, events_url, result_url and expires_at. Follow status or events until state=succeeded, then read GET /v1/experimental/licenses/{id} using that analysis ID. The Get dependency licenses operation shows the complete workflow.

At current default policy, creating an analysis reserves 100 weighted units from your daily allowance. Processing failures do not automatically refund that reservation. Reading an existing job’s licenses report does not start another analysis or consume another analysis reservation. The x-githits-cost value of 1 is provisional operation metadata, not an additional charge. Avoid unconditional POST retries.

Read the report

Keep separate component entries even when their names, versions or package URLs match. Use bom_ref for reported relationships and properties for input-file attribution. licenses contains license-choice objects; observed_licenses contains separate observations. publisher_evidence explains original publisher statements and their context; source_evidence explains source-file detections and attempt history. These evidence fields are JSON objects already; do not decode them as JSON strings. Some named properties[].value strings contain additional JSON and need a separate parse, as described in the response schemas.

Null identity or evidence fields mean unavailable information. Empty license arrays mean no entries were reported, not that every file was checked or that a package has no license. Read inventory.completeness alongside the component list. Dependency coverage is in inventory.compositions and the inventory.properties entry named githits:dependency_coverage; parse that entry’s value as JSON. Notices are properties named githits:notice. No chosen license, relationship between separate choices, or pass/fail decision is inferred. Response keys use snake_case; embedded CycloneDX choice, composition, dependency, reference and hash objects retain standard keys such as dependsOn.

Handle errors

Problems use application/problem+json. Branch on code, keep X-Request-ID for support, and respect Retry-After when present.

Status / code	What to do
400 `VALIDATION_ERROR` / `INVALID_SESSION_ID`	Correct the field named in `detail`, the upload parts, or the session header.
401 / 403	Check the credential, account access and required terms; use any provided terms/acceptance links.
408 / 413 / 415	Meet the upload deadline and size/path/count limits; send valid multipart data.
422 `UNUSABLE_MANIFEST` / `NO_MANIFEST_EVIDENCE`	Correct the reported files or supply a supported manifest/lockfile with package evidence. A file can be rejected after the analysis units were already reserved.
422 `LICENSE_REPORT_TOO_LARGE` / `SBOM_OUTPUT_TOO_LARGE`	The report or underlying inventory exceeds its output limit. Request a smaller inventory if possible. The JSON report limit is 16,777,216 bytes; using jobs does not raise it. Jobs also let you download the original CycloneDX document through `result_url` when that document is available.
429 `RATE_LIMITED`	Wait until the supplied `Retry-After` time before trying again.
502 `UPSTREAM_ERROR`	The analysis result could not be read. Keep `X-Request-ID` and report a persistent failure; repeating POST may create another charged analysis.
503	Try again later. If you already have an analysis job, keep its ID and retry reads rather than submitting another job.
504 `TIMEOUT`	Processing may still have run. Prefer the job workflow for future submissions and do not assume a repeated POST is free.

Responses must not be cached (Cache-Control: no-store).

POST

experimental

licenses

Report dependency licenses from uploaded files

curl --request POST \
  --url https://api.githits.dev/v1/experimental/licenses \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data' \
  --form 'files[]=@example-file;type=application/octet-stream'

import requests

url = "https://api.githits.dev/v1/experimental/licenses"

files = { "files[]": ("example-file", open("example-file", "rb"), "application/octet-stream") }
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('files[]', '<string>');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

fetch('https://api.githits.dev/v1/experimental/licenses', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.githits.dev/v1/experimental/licenses",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.githits.dev/v1/experimental/licenses"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.githits.dev/v1/experimental/licenses")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.githits.dev/v1/experimental/licenses")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "components": [
    {
      "bom_ref": "root",
      "external_references": [],
      "hashes": [],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT"
        }
      ],
      "name": "project",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "manifest"
        },
        {
          "name": "githits:manifest_path",
          "value": "package.json"
        }
      ],
      "publisher_evidence": null,
      "purl": null,
      "record_kind": "manifest",
      "scope": null,
      "source_evidence": null,
      "type": "library",
      "version": null
    },
    {
      "bom_ref": "a",
      "external_references": [
        {
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "reference-digest"
            }
          ],
          "type": "vcs",
          "url": "https://example.com/source"
        },
        {
          "type": "distribution",
          "url": "https://example.com/artifact.tgz"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "package-digest"
        }
      ],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT",
          "future_choice": true
        },
        {
          "license": {
            "name": "Opaque publisher terms"
          }
        }
      ],
      "name": "dependency",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "locked_package"
        },
        {
          "name": "githits:lockfile_path",
          "value": "one/package-lock.json"
        },
        {
          "name": "githits:license_artifact_verification",
          "value": "not_checked"
        }
      ],
      "publisher_evidence": {
        "capture_status": "present",
        "controlling_index": 0,
        "coverage": "complete",
        "display_value": "MIT",
        "expression": "MIT",
        "observations": [
          {
            "interpretation": {
              "expression": "MIT",
              "interpretation_methods": [
                "spdx_expression"
              ],
              "issues": [],
              "status": "expression",
              "syntax": "spdx"
            },
            "observation": {
              "field": "license",
              "relation": "single",
              "scope": "release",
              "source": "npm_registry",
              "statements": [
                "MIT"
              ],
              "status": "present",
              "version": "1.0.0"
            },
            "relationship": "controlling"
          }
        ],
        "reason": "publisher_release_metadata",
        "status": "expression"
      },
      "purl": "pkg:npm/dependency@1.0.0",
      "record_kind": "locked_package",
      "scope": "excluded",
      "source_evidence": null,
      "type": "library",
      "version": "1.0.0"
    },
    {
      "bom_ref": "b",
      "external_references": [
        {
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "reference-digest"
            }
          ],
          "type": "vcs",
          "url": "https://example.com/source"
        },
        {
          "type": "distribution",
          "url": "https://example.com/artifact.tgz"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "package-digest"
        }
      ],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT",
          "future_choice": true
        },
        {
          "license": {
            "name": "Opaque publisher terms"
          }
        }
      ],
      "name": "dependency",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "locked_package"
        },
        {
          "name": "githits:lockfile_path",
          "value": "two/package-lock.json"
        },
        {
          "name": "githits:license_artifact_verification",
          "value": "not_checked"
        }
      ],
      "publisher_evidence": {
        "capture_status": "present",
        "controlling_index": 0,
        "coverage": "complete",
        "display_value": "MIT",
        "expression": "MIT",
        "observations": [
          {
            "interpretation": {
              "expression": "MIT",
              "interpretation_methods": [
                "spdx_expression"
              ],
              "issues": [],
              "status": "expression",
              "syntax": "spdx"
            },
            "observation": {
              "field": "license",
              "relation": "single",
              "scope": "release",
              "source": "npm_registry",
              "statements": [
                "MIT"
              ],
              "status": "present",
              "version": "1.0.0"
            },
            "relationship": "controlling"
          }
        ],
        "reason": "publisher_release_metadata",
        "status": "expression"
      },
      "purl": "pkg:npm/dependency@1.0.0",
      "record_kind": "locked_package",
      "scope": "excluded",
      "source_evidence": null,
      "type": "library",
      "version": "1.0.0"
    },
    {
      "bom_ref": "go",
      "external_references": [],
      "hashes": [],
      "licenses": [],
      "name": "example.com/source",
      "observed_licenses": [
        {
          "license": {
            "name": "Apache-2.0"
          }
        },
        {
          "license": {
            "name": "MIT"
          }
        }
      ],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "resolved_package"
        },
        {
          "name": "githits:manifest_path",
          "value": "go.mod"
        }
      ],
      "publisher_evidence": null,
      "purl": "pkg:golang/example.com/source@v1.0.0",
      "record_kind": "resolved_package",
      "scope": null,
      "source_evidence": {
        "checked_at": "2026-10-22T12:00:00Z",
        "files": [
          {
            "detected_licenses": [
              "Apache-2.0"
            ],
            "path": "LICENSE"
          },
          {
            "detected_licenses": [
              "MIT"
            ],
            "path": "nested/LICENSE"
          }
        ],
        "last_attempt_at": "2026-10-22T12:00:00Z",
        "last_attempt_status": "ambiguous",
        "method": "licensecheck",
        "module": "example.com/source",
        "provider": "pkg_go_dev",
        "status": "ambiguous",
        "url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
        "version": "v1.0.0"
      },
      "type": "library",
      "version": "v1.0.0"
    },
    {
      "bom_ref": "file",
      "external_references": [],
      "hashes": [],
      "licenses": [],
      "name": "local subject",
      "observed_licenses": [],
      "properties": [],
      "publisher_evidence": null,
      "purl": null,
      "record_kind": null,
      "scope": null,
      "source_evidence": null,
      "type": "file",
      "version": null
    }
  ],
  "inventory": {
    "completeness": "recorded_lockfile_inventory",
    "compositions": [
      {
        "aggregate": "unknown",
        "assemblies": [
          "root",
          "a",
          "b",
          "go",
          "file"
        ]
      }
    ],
    "dependencies": [
      {
        "dependsOn": [
          "a"
        ],
        "ref": "root"
      },
      {
        "dependsOn": [
          "b"
        ],
        "ref": "a"
      }
    ],
    "properties": [
      {
        "name": "githits:completeness",
        "value": "recorded_lockfile_inventory"
      },
      {
        "name": "githits:notice",
        "value": "License metadata and connectivity may be incomplete."
      },
      {
        "name": "githits:resolutions",
        "value": "[{\"path\":\"package.json\",\"status\":\"partial\"}]"
      }
    ]
  },
  "schema_version": 1
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-GitHits-Client-Name

string

Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Client-Version

string

Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Agent

string

Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.

X-GitHits-Session-ID

string

Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.

Required string length: 1 - 64

Pattern: ^[A-Za-z0-9_-]{1,64}$

Body

multipart/form-data

Send a multipart upload. The complete request, including multipart headers and boundaries, must fit within 8,000,000 bytes.

files[]

file[]

required

Repeat the literal field name files[] once per file, with raw UTF-8 file contents rather than base64. Set each part's filename to the file's path relative to a common repository root, for example app/package.json and app/package-lock.json. Preserve directory structure so manifests can be associated with their lockfiles.

Send 1–256 files, each at most 5,242,880 bytes. Each filename must be at most 1,024 UTF-8 bytes and must be relative, with no empty, dot (.) or parent (..) path segments, backslashes or control characters. Every file must be a supported, readable manifest or lockfile; one unusable file rejects the entire upload.

Required array length: 1 - 256 elements

Response

JSON license report, at most 16,777,216 bytes. Read inventory coverage and component evidence together; a successful response may be partial and does not provide a pass/fail decision.

JSON license inventory with separate license choices, publisher statements and source-file observations, plus input attribution and coverage. It provides evidence for your own evaluation rather than an allow/deny result. Additional fields can appear.

components

object[]

required

All reported occurrences in their original order, with the selected primary project/source entry first when one exists. Keep repeated names, versions and package URLs separate; use bom_ref and input-path properties for attribution.

Show child attributes

inventory

object

required

Input provenance, inventory coverage and reported dependency relationships. Read these facts alongside the component list; successful analysis can still be partial.

Show child attributes

schema_version

enum<integer>

required

Version of this JSON report structure, currently 1.

Available options:

1

⌘I

Report dependency licenses from uploaded files

curl --request POST \
  --url https://api.githits.dev/v1/experimental/licenses \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data' \
  --form 'files[]=@example-file;type=application/octet-stream'

import requests

url = "https://api.githits.dev/v1/experimental/licenses"

files = { "files[]": ("example-file", open("example-file", "rb"), "application/octet-stream") }
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('files[]', '<string>');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

fetch('https://api.githits.dev/v1/experimental/licenses', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.githits.dev/v1/experimental/licenses",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.githits.dev/v1/experimental/licenses"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.githits.dev/v1/experimental/licenses")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.githits.dev/v1/experimental/licenses")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files[]\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "components": [
    {
      "bom_ref": "root",
      "external_references": [],
      "hashes": [],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT"
        }
      ],
      "name": "project",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "manifest"
        },
        {
          "name": "githits:manifest_path",
          "value": "package.json"
        }
      ],
      "publisher_evidence": null,
      "purl": null,
      "record_kind": "manifest",
      "scope": null,
      "source_evidence": null,
      "type": "library",
      "version": null
    },
    {
      "bom_ref": "a",
      "external_references": [
        {
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "reference-digest"
            }
          ],
          "type": "vcs",
          "url": "https://example.com/source"
        },
        {
          "type": "distribution",
          "url": "https://example.com/artifact.tgz"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "package-digest"
        }
      ],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT",
          "future_choice": true
        },
        {
          "license": {
            "name": "Opaque publisher terms"
          }
        }
      ],
      "name": "dependency",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "locked_package"
        },
        {
          "name": "githits:lockfile_path",
          "value": "one/package-lock.json"
        },
        {
          "name": "githits:license_artifact_verification",
          "value": "not_checked"
        }
      ],
      "publisher_evidence": {
        "capture_status": "present",
        "controlling_index": 0,
        "coverage": "complete",
        "display_value": "MIT",
        "expression": "MIT",
        "observations": [
          {
            "interpretation": {
              "expression": "MIT",
              "interpretation_methods": [
                "spdx_expression"
              ],
              "issues": [],
              "status": "expression",
              "syntax": "spdx"
            },
            "observation": {
              "field": "license",
              "relation": "single",
              "scope": "release",
              "source": "npm_registry",
              "statements": [
                "MIT"
              ],
              "status": "present",
              "version": "1.0.0"
            },
            "relationship": "controlling"
          }
        ],
        "reason": "publisher_release_metadata",
        "status": "expression"
      },
      "purl": "pkg:npm/dependency@1.0.0",
      "record_kind": "locked_package",
      "scope": "excluded",
      "source_evidence": null,
      "type": "library",
      "version": "1.0.0"
    },
    {
      "bom_ref": "b",
      "external_references": [
        {
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "reference-digest"
            }
          ],
          "type": "vcs",
          "url": "https://example.com/source"
        },
        {
          "type": "distribution",
          "url": "https://example.com/artifact.tgz"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "package-digest"
        }
      ],
      "licenses": [
        {
          "acknowledgement": "declared",
          "expression": "MIT",
          "future_choice": true
        },
        {
          "license": {
            "name": "Opaque publisher terms"
          }
        }
      ],
      "name": "dependency",
      "observed_licenses": [],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "locked_package"
        },
        {
          "name": "githits:lockfile_path",
          "value": "two/package-lock.json"
        },
        {
          "name": "githits:license_artifact_verification",
          "value": "not_checked"
        }
      ],
      "publisher_evidence": {
        "capture_status": "present",
        "controlling_index": 0,
        "coverage": "complete",
        "display_value": "MIT",
        "expression": "MIT",
        "observations": [
          {
            "interpretation": {
              "expression": "MIT",
              "interpretation_methods": [
                "spdx_expression"
              ],
              "issues": [],
              "status": "expression",
              "syntax": "spdx"
            },
            "observation": {
              "field": "license",
              "relation": "single",
              "scope": "release",
              "source": "npm_registry",
              "statements": [
                "MIT"
              ],
              "status": "present",
              "version": "1.0.0"
            },
            "relationship": "controlling"
          }
        ],
        "reason": "publisher_release_metadata",
        "status": "expression"
      },
      "purl": "pkg:npm/dependency@1.0.0",
      "record_kind": "locked_package",
      "scope": "excluded",
      "source_evidence": null,
      "type": "library",
      "version": "1.0.0"
    },
    {
      "bom_ref": "go",
      "external_references": [],
      "hashes": [],
      "licenses": [],
      "name": "example.com/source",
      "observed_licenses": [
        {
          "license": {
            "name": "Apache-2.0"
          }
        },
        {
          "license": {
            "name": "MIT"
          }
        }
      ],
      "properties": [
        {
          "name": "githits:record_kind",
          "value": "resolved_package"
        },
        {
          "name": "githits:manifest_path",
          "value": "go.mod"
        }
      ],
      "publisher_evidence": null,
      "purl": "pkg:golang/example.com/source@v1.0.0",
      "record_kind": "resolved_package",
      "scope": null,
      "source_evidence": {
        "checked_at": "2026-10-22T12:00:00Z",
        "files": [
          {
            "detected_licenses": [
              "Apache-2.0"
            ],
            "path": "LICENSE"
          },
          {
            "detected_licenses": [
              "MIT"
            ],
            "path": "nested/LICENSE"
          }
        ],
        "last_attempt_at": "2026-10-22T12:00:00Z",
        "last_attempt_status": "ambiguous",
        "method": "licensecheck",
        "module": "example.com/source",
        "provider": "pkg_go_dev",
        "status": "ambiguous",
        "url": "https://pkg.go.dev/example.com/source@v1.0.0?tab=licenses",
        "version": "v1.0.0"
      },
      "type": "library",
      "version": "v1.0.0"
    },
    {
      "bom_ref": "file",
      "external_references": [],
      "hashes": [],
      "licenses": [],
      "name": "local subject",
      "observed_licenses": [],
      "properties": [],
      "publisher_evidence": null,
      "purl": null,
      "record_kind": null,
      "scope": null,
      "source_evidence": null,
      "type": "file",
      "version": null
    }
  ],
  "inventory": {
    "completeness": "recorded_lockfile_inventory",
    "compositions": [
      {
        "aggregate": "unknown",
        "assemblies": [
          "root",
          "a",
          "b",
          "go",
          "file"
        ]
      }
    ],
    "dependencies": [
      {
        "dependsOn": [
          "a"
        ],
        "ref": "root"
      },
      {
        "dependsOn": [
          "b"
        ],
        "ref": "a"
      }
    ],
    "properties": [
      {
        "name": "githits:completeness",
        "value": "recorded_lockfile_inventory"
      },
      {
        "name": "githits:notice",
        "value": "License metadata and connectivity may be incomplete."
      },
      {
        "name": "githits:resolutions",
        "value": "[{\"path\":\"package.json\",\"status\":\"partial\"}]"
      }
    ]
  },
  "schema_version": 1
}

Get started

v1 reference

Report dependency licenses from uploaded files

Authorizations

Headers

Body

Response