Get Packages by License
curl --request GET \
--url https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packagesimport requests
url = "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"spdxId": "MIT",
"name": "MIT License",
"category": "PERMISSIVE",
"risk": "NONE",
"riskDescription": "Minimal restrictions on use, modification, and redistribution",
"totalCount": 85,
"packages": [
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"packageName": "lodash",
"packageVersion": "4.17.21",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
},
{
"id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"packageName": "express",
"packageVersion": "4.18.2",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
}
]
}
}
Project Licenses
Get Packages by License
Get all packages in a project that use a specific SPDX license
GET
/
project
/
{projectId}
/
results
/
sca
/
licenses
/
{spdxId}
/
packages
Get Packages by License
curl --request GET \
--url https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packagesimport requests
url = "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/project/{projectId}/results/sca/licenses/{spdxId}/packages")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"spdxId": "MIT",
"name": "MIT License",
"category": "PERMISSIVE",
"risk": "NONE",
"riskDescription": "Minimal restrictions on use, modification, and redistribution",
"totalCount": 85,
"packages": [
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"packageName": "lodash",
"packageVersion": "4.17.21",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
},
{
"id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"packageName": "express",
"packageVersion": "4.18.2",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
}
]
}
}
Path Parameters
string
required
The UUID of the project
string
required
The SPDX license identifier (e.g.,
MIT, Apache-2.0, GPL-3.0-only). Use UNKNOWN to retrieve packages with no detected license.Query Parameters
string
Filter by Git branch name
string
The UUID of the organization (required for permission resolution)
string[]
Filter by package ecosystem (e.g.,
npm, pip, maven, go). Can be specified multiple times.Authorization
Requiresread_scan_result permission on the project.
Response
boolean
Whether the request succeeded
object
Show License Detail Object
Show License Detail Object
string
SPDX license identifier
string
Human-readable license name
string
License category:
PERMISSIVE, WEAK_COPYLEFT, STRONG_COPYLEFT, or UNKNOWNstring
Risk level:
NONE, MEDIUM, HIGH, or UNKNOWNstring
Human-readable description of the risk implications
number
Total number of packages using this license
array
Show Package Item
Show Package Item
string
Package UUID
string
Package name (e.g.,
lodash, express)string
Package version
string
Package ecosystem (npm, pip, maven, etc.)
string[]
All SPDX license IDs associated with this package
boolean
Whether this is a transitive (indirect) dependency
boolean
Whether this is a dev-only dependency
boolean
Whether this package is ignored in license analysis
{
"success": true,
"data": {
"spdxId": "MIT",
"name": "MIT License",
"category": "PERMISSIVE",
"risk": "NONE",
"riskDescription": "Minimal restrictions on use, modification, and redistribution",
"totalCount": 85,
"packages": [
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"packageName": "lodash",
"packageVersion": "4.17.21",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
},
{
"id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"packageName": "express",
"packageVersion": "4.18.2",
"ecosystem": "npm",
"licenses": ["MIT"],
"isTransitive": false,
"isDev": false,
"isLicenseIgnored": false
}
]
}
}
⌘I