GitHub: Create a snapshot of dependencies for a repository

← Dependency graph operations · Get started

Operation github.dependency_graph_create_repository_snapshot

Provider route: POST /repos/{owner}/{repo}/dependency-graph/snapshots. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["dependencyGraph"]["dependencyGraphCreateRepositorySnapshot"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.dependencyGraph.dependencyGraphCreateRepositorySnapshot(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.dependency_graph.dependency_graph_create_repository_snapshot(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
body	Model	Required within parent	Expand Create a snapshot of dependencies for a repository — request body — body

Referenced models: Create a snapshot of dependencies for a repository — request body — body

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	object	Root
created_at	string	Required within parent	The time at which the snapshot was created.
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	ID of the created snapshot.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
message	string	Required within parent	A message providing further details about the result, such as why the dependencies were not updated.
result	string	Required within parent	Either “SUCCESS”, “ACCEPTED”, or “INVALID”. “SUCCESS” indicates that the snapshot was successfully created and the repository’s dependencies were updated. “ACCEPTED” indicates that the snapshot was successfully created, but the repository’s dependencies were not updated. “INVALID” indicates that the snapshot was malformed.

Schemas

Create a snapshot of dependencies for a repository — request body — body

Field	Type	Presence	Description and constraints
$	object	Root	Create a new snapshot of a repository's dependencies. Additional keys: not allowed
detector	object	Required within parent	A description of the detector used. Additional keys: not allowed
detector.name	string	Required within parent	The name of the detector used.
detector.url	string	Required within parent	The url of the detector used.
detector.version	string	Required within parent	The version of the detector used.
job	object	Required within parent	Additional keys: not allowed
job.correlator	string	Required within parent	Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of `job.correlator` and `detector.name` will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given "wave" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.
job.html_url	string	Optional	The url for the job.
job.id	string	Required within parent	The external ID of the job.
manifests	object	Optional	A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies. Additional keys: see wildcard field
manifests.*	Model	Additional keys	Expand Create a snapshot of dependencies for a repository — request body — body manifests value
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
ref	string	Required within parent	The repository branch that triggered this snapshot. Pattern: ^refs/
scanned	string	Required within parent	The time at which the snapshot was scanned. Format: date-time
sha	string	Required within parent	The commit SHA associated with this dependency snapshot. Maximum length: 64 characters. Maximum length: 64 Minimum length: 40
version	integer	Required within parent	The version of the repository snapshot submission.

Referenced models: Create a snapshot of dependencies for a repository — request body — body manifests value, Create a snapshot of dependencies for a repository — request body — body metadata

Create a snapshot of dependencies for a repository — request body — body manifests value

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
file	object	Optional	Additional keys: not allowed
file.source_location	string	Optional	The path of the manifest file relative to the root of the Git repository.
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
name	string	Required within parent	The name of the manifest.
resolved	object	Optional	A collection of resolved package dependencies. Additional keys: see wildcard field
resolved.*	Model	Additional keys	Expand Create a snapshot of dependencies for a repository — request body — body manifests value resolved value

Referenced models: Create a snapshot of dependencies for a repository — request body — body manifests value resolved value, Create a snapshot of dependencies for a repository — request body — body metadata

Create a snapshot of dependencies for a repository — request body — body metadata

Field	Type	Presence	Description and constraints
$	object	Root	User-defined metadata to store domain-specific information limited to 8 keys with scalar values. Maximum fields: 8 Additional keys: see wildcard field
$.*	JSON	Additional keys
$.* (anyOf 1)	JSON	Alternative
$.* (anyOf 1) (anyOf 1)	string	Alternative
$.* (anyOf 1) (anyOf 2)	number	Alternative
$.* (anyOf 1) (anyOf 3)	boolean	Alternative
$.* (anyOf 2)	null	Alternative

Create a snapshot of dependencies for a repository — request body — body manifests value resolved value

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
dependencies	array	Optional	Array of package-url (PURLs) of direct child dependencies.
dependencies[]	string	Each item
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
package_url	string	Optional	Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details. Pattern: ^pkg
relationship	string	Optional	A notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency. One of: direct, indirect
scope	string	Optional	A notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes. One of: runtime, development

Referenced models: Create a snapshot of dependencies for a repository — request body — body metadata

Policy, approvals and errors

SDK function policy ID: github.dependency_graph_create_repository_snapshot. Catalog operation: dependency-graph/create-repository-snapshot. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source