GitHub Dependencies API

openapi: 3.2.0
info:
  version: 1.1.4
  title: github-repos-api Dependencies API
  description: 'Use the REST API to create, manage and control the workflow of public and

    private GitHub repositories.'
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact
servers:
- url: '{protocol}://{hostname}'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: api.github.com
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: https
tags:
- name: Dependencies
paths:
  /repos/{owner}/{repo}/dependency-graph/compare/{basehead}:
    get:
      summary: GitHub Get Diff of the Dependencies Between Commits
      description: Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.
      tags:
      - Dependencies
      operationId: getDiffOfTheDependenciesBetweenCommits
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/dependency-review#get-a-diff-of-the-dependencies-between-commits
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - name: basehead
        description: The base and head Git revisions to compare. The Git revisions will be resolved to commit SHAs. Named revisions will be resolved to their corresponding HEAD commits, and an appropriate merge base will be determined. This parameter expects the format `{base}...{head}`.
        in: path
        required: true
        schema:
          type: string
        example: example_value
      - $ref: '#/components/parameters/manifest-path'
      - in: header
        name: Authorization
        schema:
          type: string
        example: example_value
      - in: header
        name: X-GitHub-Api-Version
        schema:
          type: string
          default: '2022-11-28'
        example: example_value
      - in: header
        name: Accept
        schema:
          type: string
          default: application/vnd.github+json
        example: example_value
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dependency-graph-diff'
              examples:
                default:
                  $ref: '#/components/examples/diff-range-response'
          headers:
            Link:
              $ref: '#/components/headers/link'
        '403':
          $ref: '#/components/responses/dependency_review_forbidden'
        '404':
          $ref: '#/components/responses/not_found'
      x-github:
        githubCloudOnly: false
        category: dependency-graph
        subcategory: dependency-review
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/dependency-graph/snapshots:
    post:
      summary: GitHub Create Snapshot of Dependencies for Repository
      description: 'Create a new snapshot of a repository''s dependencies.


        The authenticated user must have access to the repository.


        OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.'
      tags:
      - Dependencies
      operationId: createSnapshotOfDependenciesForRepository
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/dependency-submission#create-a-snapshot-of-dependencies-for-a-repository
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - in: header
        name: Authorization
        schema:
          type: string
        example: example_value
      - in: header
        name: X-GitHub-Api-Version
        schema:
          type: string
          default: '2022-11-28'
        example: example_value
      - in: header
        name: Accept
        schema:
          type: string
          default: application/vnd.github+json
        example: example_value
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/snapshot'
            examples:
              example-of-a-dependency-submission:
                $ref: '#/components/examples/dependency-graph-create-snapshot-request'
      responses:
        '201':
          description: Response
          content:
            application/json:
              schema:
                type: object
                required:
                - id
                - created_at
                - result
                - message
                properties:
                  id:
                    type: integer
                    description: ID of the created snapshot.
                  created_at:
                    type: string
                    description: The time at which the snapshot was created.
                  result:
                    type: string
                    description: Either "SUCCESS", "ACCEPTED", or "INVALID". "SUCCESS" indicates that the snapshot was successfully created and the repository's dependencies were updated. "ACCEPTED" indicates that the snapshot was successfully created, but the repository's dependencies were not updated. "INVALID" indicates that the snapshot was malformed.
                  message:
                    type: string
                    description: message providing further details about the result, such as why the dependencies were not updated.
              examples:
                example-of-a-dependency-submission:
                  $ref: '#/components/examples/dependency-graph-create-snapshot-success'
      x-github:
        githubCloudOnly: false
        enabledForGitHubApps: true
        category: dependency-graph
        subcategory: dependency-submission
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  examples:
    dependency-graph-create-snapshot-success:
      value:
        id: 12345
        created_at: '2018-05-04T01:14:52Z'
        message: Dependency results for the repo have been successfully updated.
        result: SUCCESS
    dependency-graph-create-snapshot-request:
      value:
        version: 0
        sha: ce587453ced02b1526dfb4cb910479d431683101
        ref: refs/heads/main
        job:
          correlator: yourworkflowname_youractionname
          id: yourrunid
        detector:
          name: octo-detector
          version: 0.0.1
          url: https://github.com/octo-org/octo-repo
        scanned: '2022-06-14T20:25:00Z'
        manifests:
          package-lock.json:
            name: package-lock.json
            file:
              source_location: src/package-lock.json
            resolved:
              '@actions/core':
                package_url: pkg:/npm/%40actions/core@1.1.9
                dependencies:
                - '@actions/http-client'
              '@actions/http-client':
                package_url: pkg:/npm/%40actions/http-client@1.0.7
                dependencies:
                - tunnel
              tunnel:
                package_url: pkg:/npm/tunnel@0.0.6
    diff-range-response:
      value:
      - change_type: removed
        manifest: package.json
        ecosystem: npm
        name: helmet
        version: 4.6.0
        package_url: pkg:npm/helmet@4.6.0
        license: MIT
        source_repository_url: https://github.com/helmetjs/helmet
        vulnerabilities: []
        scope: unknown
      - change_type: added
        manifest: package.json
        ecosystem: npm
        name: helmet
        version: 5.0.0
        package_url: pkg:npm/helmet@5.0.0
        license: MIT
        scope: unknown
        source_repository_url: https://github.com/helmetjs/helmet
        vulnerabilities: []
      - change_type: added
        manifest: Gemfile
        ecosystem: rubygems
        name: ruby-openid
        version: 2.7.0
        scope: unknown
        package_url: pkg:gem/ruby-openid@2.7.0
        license: MIT
        source_repository_url: https://github.com/openid/ruby-openid
        vulnerabilities:
        - severity: critical
          advisory_ghsa_id: GHSA-fqfj-cmh6-hj49
          advisory_summary: Ruby OpenID
          advisory_url: https://github.com/advisories/GHSA-fqfj-cmh6-hj49
  responses:
    dependency_review_forbidden:
      description: Response if GitHub Advanced Security is not enabled for this repository
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
  schemas:
    dependency:
      type: object
      properties:
        package_url:
          type: string
          description: Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details.
          example: pkg:/npm/%40actions/http-client@1.0.11
          pattern: ^pkg
        metadata:
          $ref: '#/components/schemas/metadata'
        relationship:
          type: string
          description: notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency.
          example: direct
          enum:
          - direct
          - indirect
        scope:
          type: string
          description: notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes.
          example: runtime
          enum:
          - runtime
          - development
        dependencies:
          type: array
          description: Array of package-url (PURLs) of direct child dependencies.
          example:
          - '@actions/http-client'
          items:
            type: string
      additionalProperties: false
    metadata:
      title: metadata
      description: User-defined metadata to store domain-specific information limited to 8 keys with scalar values.
      type: object
      maxProperties: 8
      additionalProperties:
        anyOf:
        - type: string
        - type: number
        - type: boolean
    snapshot:
      title: snapshot
      description: Create a new snapshot of a repository's dependencies.
      type: object
      properties:
        version:
          description: The version of the repository snapshot submission.
          type: integer
          example: 42
        job:
          type: object
          properties:
            id:
              type: string
              description: The external ID of the job.
              example: 5622a2b0-63f6-4732-8c34-a1ab27e102a11
            correlator:
              type: string
              description: Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of `job.correlator` and `detector.name` will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given "wave" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.
              example: yourworkflowname_yourjobname
            html_url:
              type: string
              description: The url for the job.
              example: http://example.com/build
          required:
          - id
          - correlator
          additionalProperties: false
        sha:
          description: 'The commit SHA associated with this dependency snapshot. Maximum length: 40 characters.'
          type: string
          example: ddc951f4b1293222421f2c8df679786153acf689
          minLength: 40
          maxLength: 40
        ref:
          description: The repository branch that triggered this snapshot.
          type: string
          pattern: ^refs/
          example: refs/heads/main
        detector:
          type: object
          description: description of the detector used.
          properties:
            name:
              type: string
              description: The name of the detector used.
              example: docker buildtime detector
            version:
              type: string
              description: The version of the detector used.
              example: 1.0.0
            url:
              type: string
              description: The url of the detector used.
              example: http://example.com/docker-buildtimer-detector
          required:
          - name
          - version
          - url
          additionalProperties: false
        metadata:
          $ref: '#/components/schemas/metadata'
        manifests:
          type: object
          description: collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.
          additionalProperties:
            $ref: '#/components/schemas/manifest'
        scanned:
          type: string
          format: date-time
          description: The time at which the snapshot was scanned.
          example: '2020-06-13T14:52:50-05:00'
      required:
      - detector
      - version
      - ref
      - sha
      - job
      - scanned
      additionalProperties: false
    dependency-graph-diff:
      title: Dependency Graph Diff
      description: diff of the dependencies between two commits.
      type: array
      items:
        type: object
        properties:
          change_type:
            type: string
            enum:
            - added
            - removed
          manifest:
            type: string
            example: path/to/package-lock.json
          ecosystem:
            type: string
            example: npm
          name:
            type: string
            example: '@actions/core'
          version:
            type: string
            example: 1.0.0
          package_url:
            type: string
            example: pkg:/npm/%40actions/core@1.1.0
          license:
            type: string
            example: MIT
          source_repository_url:
            type: string
            example: https://github.com/github/actions
          vulnerabilities:
            type: array
            items:
              type: object
              properties:
                severity:
                  type: string
                  example: critical
                advisory_ghsa_id:
                  type: string
                  example: GHSA-rf4j-j272-fj86
                advisory_summary:
                  type: string
                  example: summary of the advisory.
                advisory_url:
                  type: string
                  example: https://github.com/advisories/GHSA-rf4j-j272-fj86
              required:
              - severity
              - advisory_ghsa_id
              - advisory_summary
              - advisory_url
          scope:
            description: Where the dependency is utilized. `development` means that the dependency is only utilized in the development environment. `runtime` means that the dependency is utilized at runtime and in the development environment.
            type: string
            enum:
            - unknown
            - runtime
            - development
        required:
        - change_type
        - manifest
        - ecosystem
        - name
        - version
        - package_url
        - license
        - source_repository_url
        - vulnerabilities
        - scope
    manifest:
      type: object
      properties:
        name:
          type: string
          description: The name of the manifest.
          example: package-lock.json
        file:
          type: object
          properties:
            source_location:
              type: string
              description: The path of the manifest file relative to the root of the Git repository.
              example: /src/build/package-lock.json
          additionalProperties: false
        metadata:
          $ref: '#/components/schemas/metadata'
        resolved:
          type: object
          description: collection of resolved package dependencies.
          additionalProperties:
            $ref: '#/components/schemas/dependency'
      required:
      - name
      additionalProperties: false
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
  headers:
    link:
      example: <https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"
      schema:
        type: string
  parameters:
    manifest-path:
      name: name
      description: The full path, relative to the repository root, of the dependency manifest file.
      in: query
      required: false
      schema:
        type: string
    owner:
      name: owner
      description: The account owner of the repository. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
    repo:
      name: repo
      description: The name of the repository without the `.git` extension. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/