GitHub Dependency Graph API

openapi: 3.2.0
info:
  version: 1.1.4
  title: GitHub v3 REST Dependency Graph API
  description: GitHub's v3 REST API.
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  x-github-plan: ghes
  x-github-release: 3.9
servers:
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:
- name: Dependency-Graph
  description: Endpoints to access Dependency Graph features.
paths:
  /repos/{owner}/{repo}/dependency-graph/compare/{basehead}:
    get:
      summary: GitHub Get a Diff of the Dependencies Between Commits
      description: Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.
      tags:
      - Dependency-Graph
      operationId: dependency-graph/diff-range
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/dependency-review#get-a-diff-of-the-dependencies-between-commits
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - name: basehead
        description: The base and head Git revisions to compare. The Git revisions will be resolved to commit SHAs. Named revisions will be resolved to their corresponding HEAD commits, and an appropriate merge base will be determined. This parameter expects the format `{base}...{head}`.
        in: path
        required: true
        schema:
          type: string
        example: example_value
      - $ref: '#/components/parameters/manifest-path'
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dependency-graph-diff'
              examples:
                default:
                  $ref: '#/components/examples/diff-range-response'
          headers:
            Link:
              $ref: '#/components/headers/link'
        '403':
          $ref: '#/components/responses/dependency_review_forbidden'
        '404':
          $ref: '#/components/responses/not_found'
      x-github:
        githubCloudOnly: false
        category: dependency-graph
        subcategory: dependency-review
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/dependency-graph/sbom:
    get:
      summary: GitHub Export a Software Bill of Materials (SBOM) for a Repository
      description: Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.
      tags:
      - Dependency-Graph
      operationId: dependency-graph/export-sbom
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/sboms#export-a-software-bill-of-materials-sbom-for-a-repository
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dependency-graph-spdx-sbom'
              examples:
                default:
                  $ref: '#/components/examples/dependency-graph-export-sbom-response'
          headers:
            Link:
              $ref: '#/components/headers/link'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
      x-github:
        githubCloudOnly: false
        category: dependency-graph
        subcategory: sboms
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/dependency-graph/snapshots:
    post:
      summary: GitHub Create a Snapshot of Dependencies for a Repository
      description: 'Create a new snapshot of a repository''s dependencies.


        The authenticated user must have access to the repository.


        OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.'
      tags:
      - Dependency-Graph
      operationId: dependency-graph/create-repository-snapshot
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/dependency-submission#create-a-snapshot-of-dependencies-for-a-repository
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/snapshot'
            examples:
              example-of-a-dependency-submission:
                $ref: '#/components/examples/dependency-graph-create-snapshot-request'
      responses:
        '201':
          description: Response
          content:
            application/json:
              schema:
                type: object
                required:
                - id
                - created_at
                - result
                - message
                properties:
                  id:
                    type: integer
                    description: ID of the created snapshot.
                  created_at:
                    type: string
                    description: The time at which the snapshot was created.
                  result:
                    type: string
                    description: Either "SUCCESS", "ACCEPTED", or "INVALID". "SUCCESS" indicates that the snapshot was successfully created and the repository's dependencies were updated. "ACCEPTED" indicates that the snapshot was successfully created, but the repository's dependencies were not updated. "INVALID" indicates that the snapshot was malformed.
                  message:
                    type: string
                    description: A message providing further details about the result, such as why the dependencies were not updated.
              examples:
                example-of-a-dependency-submission:
                  $ref: '#/components/examples/dependency-graph-create-snapshot-success'
      x-github:
        githubCloudOnly: false
        enabledForGitHubApps: true
        category: dependency-graph
        subcategory: dependency-submission
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  examples:
    dependency-graph-export-sbom-response:
      value:
        sbom:
          SPDXID: SPDXRef-DOCUMENT
          spdxVersion: SPDX-2.3
          creationInfo:
            created: '2021-09-01T00:00:00Z'
            creators:
            - 'Tool: GitHub.com-Dependency-Graph'
          name: github/example
          dataLicense: CC0-1.0
          documentDescribes:
          - github/example
          documentNamespace: https://github.com/github/example/dependency_graph/sbom-abcdef123456
          packages:
          - SPDXID: SPDXRef-Package
            name: rubygems:rails
            versionInfo: 1.0.0
            downloadLocation: NOASSERTION
            filesAnalyzed: false
            licenseConcluded: MIT
            licenseDeclared: MIT
    dependency-graph-create-snapshot-success:
      value:
        id: 12345
        created_at: '2018-05-04T01:14:52Z'
        message: Dependency results for the repo have been successfully updated.
        result: SUCCESS
    dependency-graph-create-snapshot-request:
      value:
        version: 0
        sha: ce587453ced02b1526dfb4cb910479d431683101
        ref: refs/heads/main
        job:
          correlator: yourworkflowname_youractionname
          id: yourrunid
        detector:
          name: octo-detector
          version: 0.0.1
          url: https://github.com/octo-org/octo-repo
        scanned: '2022-06-14T20:25:00Z'
        manifests:
          package-lock.json:
            name: package-lock.json
            file:
              source_location: src/package-lock.json
            resolved:
              '@actions/core':
                package_url: pkg:/npm/%40actions/core@1.1.9
                dependencies:
                - '@actions/http-client'
              '@actions/http-client':
                package_url: pkg:/npm/%40actions/http-client@1.0.7
                dependencies:
                - tunnel
              tunnel:
                package_url: pkg:/npm/tunnel@0.0.6
    diff-range-response:
      value:
      - change_type: removed
        manifest: package.json
        ecosystem: npm
        name: helmet
        version: 4.6.0
        package_url: pkg:npm/helmet@4.6.0
        license: MIT
        source_repository_url: https://github.com/helmetjs/helmet
        vulnerabilities: []
      - change_type: added
        manifest: package.json
        ecosystem: npm
        name: helmet
        version: 5.0.0
        package_url: pkg:npm/helmet@5.0.0
        license: MIT
        source_repository_url: https://github.com/helmetjs/helmet
        vulnerabilities: []
      - change_type: added
        manifest: Gemfile
        ecosystem: rubygems
        name: ruby-openid
        version: 2.7.0
        package_url: pkg:gem/ruby-openid@2.7.0
        license: null
        source_repository_url: https://github.com/openid/ruby-openid
        vulnerabilities:
        - severity: critical
          advisory_ghsa_id: GHSA-fqfj-cmh6-hj49
          advisory_summary: Ruby OpenID
          advisory_url: https://github.com/advisories/GHSA-fqfj-cmh6-hj49
  parameters:
    manifest-path:
      name: name
      description: The full path, relative to the repository root, of the dependency manifest file.
      in: query
      required: false
      schema:
        type: string
    owner:
      name: owner
      description: The account owner of the repository. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
    repo:
      name: repo
      description: The name of the repository without the `.git` extension. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
  schemas:
    dependency:
      type: object
      properties:
        package_url:
          type: string
          description: Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details.
          example: pkg:/npm/%40actions/http-client@1.0.11
          pattern: ^pkg
        metadata:
          $ref: '#/components/schemas/metadata'
        relationship:
          type: string
          description: A notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency.
          example: direct
          enum:
          - direct
          - indirect
        scope:
          type: string
          description: A notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes.
          example: runtime
          enum:
          - runtime
          - development
        dependencies:
          type: array
          description: Array of package-url (PURLs) of direct child dependencies.
          example: '@actions/http-client'
          items:
            type: string
      additionalProperties: false
    snapshot:
      title: snapshot
      description: Create a new snapshot of a repository's dependencies.
      type: object
      properties:
        version:
          description: The version of the repository snapshot submission.
          type: integer
          example: 42
        job:
          type: object
          properties:
            id:
              type: string
              description: The external ID of the job.
              example: 5622a2b0-63f6-4732-8c34-a1ab27e102a11
            correlator:
              type: string
              description: Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of `job.correlator` and `detector.name` will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given "wave" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.
              example: yourworkflowname_yourjobname
            html_url:
              type: string
              description: The url for the job.
              example: http://example.com/build
          required:
          - id
          - correlator
          additionalProperties: false
        sha:
          description: 'The commit SHA associated with this dependency snapshot. Maximum length: 40 characters.'
          type: string
          example: ddc951f4b1293222421f2c8df679786153acf689
          minLength: 40
          maxLength: 40
        ref:
          description: The repository branch that triggered this snapshot.
          type: string
          pattern: ^refs/
          example: refs/heads/main
        detector:
          type: object
          description: A description of the detector used.
          properties:
            name:
              type: string
              description: The name of the detector used.
              example: docker buildtime detector
            version:
              type: string
              description: The version of the detector used.
              example: 1.0.0
            url:
              type: string
              description: The url of the detector used.
              example: http://example.com/docker-buildtimer-detector
          required:
          - name
          - version
          - url
          additionalProperties: false
        metadata:
          $ref: '#/components/schemas/metadata'
        manifests:
          type: object
          description: A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.
          additionalProperties:
            $ref: '#/components/schemas/manifest'
        scanned:
          type: string
          format: date-time
          description: The time at which the snapshot was scanned.
          example: '2020-06-13T14:52:50-05:00'
      required:
      - detector
      - version
      - ref
      - sha
      - job
      - scanned
      additionalProperties: false
    dependency-graph-diff:
      title: Dependency Graph Diff
      description: A diff of the dependencies between two commits.
      type: array
      items:
        type: object
        properties:
          change_type:
            type: string
            enum:
            - added
            - removed
          manifest:
            type: string
            example: path/to/package-lock.json
          ecosystem:
            type: string
            example: npm
          name:
            type: string
            example: '@actions/core'
          version:
            type: string
            example: 1.0.0
          package_url:
            type:
            - string
            - 'null'
            example: pkg:/npm/%40actions/core@1.1.0
          license:
            type:
            - string
            - 'null'
            example: MIT
          source_repository_url:
            type:
            - string
            - 'null'
            example: https://github.com/github/actions
          vulnerabilities:
            type: array
            items:
              type: object
              properties:
                severity:
                  type: string
                  example: critical
                advisory_ghsa_id:
                  type: string
                  example: GHSA-rf4j-j272-fj86
                advisory_summary:
                  type: string
                  example: A summary of the advisory.
                advisory_url:
                  type: string
                  example: https://github.com/advisories/GHSA-rf4j-j272-fj86
              required:
              - severity
              - advisory_ghsa_id
              - advisory_summary
              - advisory_url
          scope:
            description: Where the dependency is utilized. `development` means that the dependency is only utilized in the development environment. `runtime` means that the dependency is utilized at runtime and in the development environment.
            type: string
            enum:
            - unknown
            - runtime
            - development
        required:
        - change_type
        - manifest
        - ecosystem
        - name
        - version
        - package_url
        - license
        - source_repository_url
        - vulnerabilities
        - scope
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
    dependency-graph-spdx-sbom:
      title: Dependency Graph SPDX SBOM
      description: A schema for the SPDX JSON format returned by the Dependency Graph.
      type: object
      properties:
        sbom:
          type: object
          properties:
            SPDXID:
              type: string
              example: SPDXRef-DOCUMENT
              description: The SPDX identifier for the SPDX document.
            spdxVersion:
              type: string
              example: SPDX-2.3
              description: The version of the SPDX specification that this document conforms to.
            creationInfo:
              type: object
              properties:
                created:
                  type: string
                  example: '2021-11-03T00:00:00Z'
                  description: The date and time the SPDX document was created.
                creators:
                  type: array
                  items:
                    type: string
                    example: GitHub
                  description: The tools that were used to generate the SPDX document.
              required:
              - created
              - creators
            name:
              type: string
              example: github/github
              description: The name of the SPDX document.
            dataLicense:
              type: string
              example: CC0-1.0
              description: The license under which the SPDX document is licensed.
            documentDescribes:
              type: array
              items:
                type: string
                example: github/github
              description: The name of the repository that the SPDX document describes.
            documentNamespace:
              type: string
              example: https://github.com/example/dependency_graph/sbom-123
              description: The namespace for the SPDX document.
            packages:
              type: array
              items:
                type: object
                properties:
                  SPDXID:
                    type: string
                    example: SPDXRef-Package
                    description: A unique SPDX identifier for the package.
                  name:
                    type: string
                    example: rubygems:github/github
                    description: The name of the package.
                  versionInfo:
                    type: string
                    example: 1.0.0
                    description: 'The version of the package. If the package does not have an exact version specified,

                      a version range is given.'
                  downloadLocation:
                    type: string
                    example: NOASSERTION
                    description: 'The location where the package can be downloaded,

                      or NOASSERTION if this has not been determined.'
                  filesAnalyzed:
                    type: boolean
                    example: false
                    description: 'Whether the package''s file content has been subjected to

                      analysis during the creation of the SPDX document.'
                  licenseConcluded:
                    type: string
                    example: MIT
                    description: The license of the package as determined while creating the SPDX document.
                  licenseDeclared:
                    type: string
                    example: NOASSERTION
                    description: 'The license of the package as declared by its author, or NOASSERTION if this information

                      was not available when the SPDX document was created.'
                  supplier:
                    type: string
                    example: NOASSERTION
                    description: The distribution source of this package, or NOASSERTION if this was not determined.
                  externalRefs:
                    type: array
                    items:
                      type: object
                      properties:
                        referenceCategory:
                          type: string
                          example: PACKAGE-MANAGER
                          description: The category of reference to an external resource this reference refers to.
                        referenceLocator:
                          type: string
                          example: pkg:gem/rails@6.0.1
                          description: A locator for the particular external resource this reference refers to.
                        referenceType:
                          type: string
                          example: purl
                          description: The category of reference to an external resource this reference refers to.
                      required:
                      - referenceCategory
                      - referenceLocator
                      - referenceType
              required:
              - SPDXID
              - name
              - versionInfo
              - downloadLocation
              - filesAnalyzed
              - licenseConcluded
              - licenseDeclared
              - supplier
          required:
          - SPDXID
          - spdxVersion
          - creationInfo
          - name
          - dataLicense
          - documentDescribes
          - documentNamespace
          - packages
      required:
      - sbom
    manifest:
      type: object
      properties:
        name:
          type: string
          description: The name of the manifest.
          example: package-lock.json
        file:
          type: object
          properties:
            source_location:
              type: string
              description: The path of the manifest file relative to the root of the Git repository.
              example: /src/build/package-lock.json
          additionalProperties: false
        metadata:
          $ref: '#/components/schemas/metadata'
        resolved:
          type: object
          description: A collection of resolved package dependencies.
          additionalProperties:
            $ref: '#/components/schemas/dependency'
      required:
      - name
      additionalProperties: false
    metadata:
      title: metadata
      description: User-defined metadata to store domain-specific information limited to 8 keys with scalar values.
      type: object
      maxProperties: 8
      additionalProperties:
        anyOf:
        - type: string
        - type: number
        - type: boolean
  responses:
    dependency_review_forbidden:
      description: Response if GitHub Advanced Security is not enabled for this repository
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
  headers:
    link:
      example: <https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"
      schema:
        type: string
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/