GitHub: Dependency graph schemas

← Dependency graph operations · All schemas

Create a snapshot of dependencies for a repository — request body — body

Field	Type	Presence	Description and constraints
$	object	Root	Create a new snapshot of a repository's dependencies. Additional keys: not allowed
detector	object	Required within parent	A description of the detector used. Additional keys: not allowed
detector.name	string	Required within parent	The name of the detector used.
detector.url	string	Required within parent	The url of the detector used.
detector.version	string	Required within parent	The version of the detector used.
job	object	Required within parent	Additional keys: not allowed
job.correlator	string	Required within parent	Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of `job.correlator` and `detector.name` will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given "wave" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.
job.html_url	string	Optional	The url for the job.
job.id	string	Required within parent	The external ID of the job.
manifests	object	Optional	A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies. Additional keys: see wildcard field
manifests.*	Model	Additional keys	Expand Create a snapshot of dependencies for a repository — request body — body manifests value
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
ref	string	Required within parent	The repository branch that triggered this snapshot. Pattern: ^refs/
scanned	string	Required within parent	The time at which the snapshot was scanned. Format: date-time
sha	string	Required within parent	The commit SHA associated with this dependency snapshot. Maximum length: 64 characters. Maximum length: 64 Minimum length: 40
version	integer	Required within parent	The version of the repository snapshot submission.

Referenced models: Create a snapshot of dependencies for a repository — request body — body manifests value, Create a snapshot of dependencies for a repository — request body — body metadata

Create a snapshot of dependencies for a repository — request body — body manifests value

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
file	object	Optional	Additional keys: not allowed
file.source_location	string	Optional	The path of the manifest file relative to the root of the Git repository.
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
name	string	Required within parent	The name of the manifest.
resolved	object	Optional	A collection of resolved package dependencies. Additional keys: see wildcard field
resolved.*	Model	Additional keys	Expand Create a snapshot of dependencies for a repository — request body — body manifests value resolved value

Referenced models: Create a snapshot of dependencies for a repository — request body — body manifests value resolved value, Create a snapshot of dependencies for a repository — request body — body metadata

Create a snapshot of dependencies for a repository — request body — body manifests value resolved value

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
dependencies	array	Optional	Array of package-url (PURLs) of direct child dependencies.
dependencies[]	string	Each item
metadata	Model	Optional	Expand Create a snapshot of dependencies for a repository — request body — body metadata
package_url	string	Optional	Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details. Pattern: ^pkg
relationship	string	Optional	A notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency. One of: direct, indirect
scope	string	Optional	A notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes. One of: runtime, development

Referenced models: Create a snapshot of dependencies for a repository — request body — body metadata

Create a snapshot of dependencies for a repository — request body — body metadata

Field	Type	Presence	Description and constraints
$	object	Root	User-defined metadata to store domain-specific information limited to 8 keys with scalar values. Maximum fields: 8 Additional keys: see wildcard field
$.*	JSON	Additional keys
$.* (anyOf 1)	JSON	Alternative
$.* (anyOf 1) (anyOf 1)	string	Alternative
$.* (anyOf 1) (anyOf 2)	number	Alternative
$.* (anyOf 1) (anyOf 3)	boolean	Alternative
$.* (anyOf 2)	null	Alternative

Export a software bill of materials (SBOM) for a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root	A schema for the SPDX JSON format returned by the Dependency Graph.
sbom	object	Required within parent
sbom.SPDXID	string	Required within parent	The SPDX identifier for the SPDX document.
sbom.comment	string	Optional	An optional comment about the SPDX document.
sbom.creationInfo	object	Required within parent
sbom.creationInfo.created	string	Required within parent	The date and time the SPDX document was created.
sbom.creationInfo.creators	array	Required within parent	The tools that were used to generate the SPDX document.
sbom.creationInfo.creators[]	string	Each item
sbom.dataLicense	string	Required within parent	The license under which the SPDX document is licensed.
sbom.documentNamespace	string	Required within parent	The namespace for the SPDX document.
sbom.name	string	Required within parent	The name of the SPDX document.
sbom.packages	array	Required within parent
sbom.packages[]	object	Each item
sbom.packages[].SPDXID	string	Optional	A unique SPDX identifier for the package.
sbom.packages[].copyrightText	string	Optional	The copyright holders of the package, and any dates present with those notices, if available.
sbom.packages[].downloadLocation	string	Optional	The location where the package can be downloaded, or NOASSERTION if this has not been determined.
sbom.packages[].externalRefs	array	Optional
sbom.packages[].externalRefs[]	object	Each item
sbom.packages[].externalRefs[].referenceCategory	string	Required within parent	The category of reference to an external resource this reference refers to.
sbom.packages[].externalRefs[].referenceLocator	string	Required within parent	A locator for the particular external resource this reference refers to.
sbom.packages[].externalRefs[].referenceType	string	Required within parent	The category of reference to an external resource this reference refers to.
sbom.packages[].filesAnalyzed	boolean	Optional	Whether the package's file content has been subjected to analysis during the creation of the SPDX document.
sbom.packages[].licenseConcluded	string	Optional	The license of the package as determined while creating the SPDX document.
sbom.packages[].licenseDeclared	string	Optional	The license of the package as declared by its author, or NOASSERTION if this information was not available when the SPDX document was created.
sbom.packages[].name	string	Optional	The name of the package.
sbom.packages[].supplier	string	Optional	The distribution source of this package, or NOASSERTION if this was not determined.
sbom.packages[].versionInfo	string	Optional	The version of the package. If the package does not have an exact version specified, a version range is given.
sbom.relationships	array	Optional
sbom.relationships[]	object	Each item
sbom.relationships[].relatedSpdxElement	string	Optional	The SPDX identifier of the package that is the target of the relationship.
sbom.relationships[].relationshipType	string	Optional	The type of relationship between the two SPDX elements.
sbom.relationships[].spdxElementId	string	Optional	The SPDX identifier of the package that is the source of the relationship.
sbom.spdxVersion	string	Required within parent	The version of the SPDX specification that this document conforms to.

Get a diff of the dependencies between commits — response body

Field	Type	Presence	Description and constraints
$	array	Root	A diff of the dependencies between two commits.
$[]	object	Each item
$[].change_type	string	Required within parent	Known values: added, removed
$[].ecosystem	string	Required within parent
$[].license	JSON	Required within parent
$[].license (anyOf 1)	string	Alternative
$[].license (anyOf 2)	null	Alternative
$[].manifest	string	Required within parent
$[].name	string	Required within parent
$[].package_url	JSON	Required within parent
$[].package_url (anyOf 1)	string	Alternative
$[].package_url (anyOf 2)	null	Alternative
$[].scope	string	Required within parent	Where the dependency is utilized. `development` means that the dependency is only utilized in the development environment. `runtime` means that the dependency is utilized at runtime and in the development environment. Known values: unknown, runtime, development
$[].source_repository_url	JSON	Required within parent
$[].source_repository_url (anyOf 1)	string	Alternative
$[].source_repository_url (anyOf 2)	null	Alternative
$[].version	string	Required within parent
$[].vulnerabilities	array	Required within parent
$[].vulnerabilities[]	object	Each item
$[].vulnerabilities[].advisory_ghsa_id	string	Required within parent
$[].vulnerabilities[].advisory_summary	string	Required within parent
$[].vulnerabilities[].advisory_url	string	Required within parent
$[].vulnerabilities[].severity	string	Required within parent