--- title: "CreateDependencyMetadata" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/dependency-metadata" tags: ["DependencyMetadataService"] --- # CreateDependencyMetadata `POST /v1/namespaces/{tenant_meta.namespace}/dependency-metadata` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/dependency-metadata` - Auth: none declared Creates a dependency metadata object. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - DependencyMetadataServiceCreateDependencyMetadataBody: Information about the relationship between a root package version (importer) and one of its dependencies. DependencyMetadata objects are children of the root PackageVersion object and belong to the same project and namespace as the root PackageVersion object. They are connected to the importer project through spec.importer_data.project_uuid, and to the dependency project through spec.dependency_data.project_uuid. - `context` V1Context, required: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1DependencyMetadataSpec, required: DependencyMetadata specific data. - `dependency_data` DependencyMetadataDependencyData: Information about the dependency. - `abstract` boolean: True if the dependency is an abstract dependency, such as a secondary Pom file. - `approximation` boolean: True if this is an approximate dependency based on unresolved package dependencies. - `callgraph_available` boolean: True if the call graph is available. - `container_data` V1ContainerDependencyMetadata - `first_reachable_time` string, date-time: First time this dependency was determined to be reachable in an application image. - `last_reachable_time` string, date-time: Most recent time this dependency was determined to be reachable in an application image. - `layers` V1ContainerLayerMetadata[]: Layers of the container image where a dependency is found. This is an optional field. It is only set when target dependency is found via container image scan. - `base_layer` boolean: Set to true if this is the base image layer. - `digest` string, required: The SHA256 digest of the container image layer. - `file_locations` string[]: File locations on the container file system that reference the dependency. - `reachable_count` string, uint64: Number of times this dependency was determined to be reachable in an application image. This number is used for trending and it's not meant for exact usage tracking. - `runtime_files` string[]: Files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when the dependency is found to be used at runtime in the container image. - `user_application_dependency` boolean: Set to true if this is a user application dependency. - `declared_licenses` V1LicenseDependencyMetadata[]: Declared license information for the dependency. - `category` string: License category (e.g. "Restricted"). - `spdx_id` string: SPDX license identifier (e.g. "Apache-2.0"). - `type` string: License classification (based on licenseclassifier by Google). - `direct` boolean, required: True if this is a direct dependency. - `discovered_licenses` V1LicenseDependencyMetadata[]: Discovered license information for the dependency. - `category` string: License category (e.g. "Restricted"). - `spdx_id` string: SPDX license identifier (e.g. "Apache-2.0"). - `type` string: License classification (based on licenseclassifier by Google). - `discovery_type` 'DISCOVERY_TYPE_UNSPECIFIED' | 'DISCOVERY_TYPE_MANIFEST' | 'DISCOVERY_TYPE_PHANTOM' | 'DISCOVERY_TYPE_SEGMENT_MATCH': - DISCOVERY_TYPE_MANIFEST: Dependency was discovered through a manifest file. - DISCOVERY_TYPE_PHANTOM: Dependency was discovered through phantom dependency / imported dependency analysis. - DISCOVERY_TYPE_SEGMENT_MATCH: Dependency was discovered via code segment match. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE': - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `eol` boolean: Indicates whether the dependency is end of life. - `eol_timestamp` string, date-time: End of life timestamp for the dependency package version. - `forked` boolean: Set to true if the dependency is a downstream fork of a public dependency. True exactly when upstream_reference names a package, so both fields are written together. - `internal` boolean: True if the dependency is in the same namespace or, if the namespace is oss, in the same project as the importer. - `last_commit` string, date-time: Date that the dependency was last modified. - `locked` boolean: Set to true if the dependency is fixed to a specific version by a lock file at install time (outcome). If a dependency is locked, but not pinned, it could drift if the lock file is regenerated (for example, by 'npm update'). - `missing` boolean: True if the package version is missing for this dependency. - `namespace` string: Namespace to which the dependency package version object belongs. - `native_scope` string: Un-normalized native dependency scope from the package manager (e.g. Maven "provided"), before it is collapsed into scope. Empty if none. - `orphan` boolean: Deprecated. - `package_name` string: Qualified dependency package name. Does not include the version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_uuid` string: the UUID of the dependency package version object. - `parent_count` integer: Total number of direct parents in dependency graph. - `parent_version_name` string: Fully qualified name of the direct parent of the dependency. For example, go://package@v1.2.3. - `patched` boolean: Indicates whether the dependency version was patched or not. - `pinned` boolean: Set to true of the dependency is fixed to a specific version by a manifest file (intent). For example, in package.json, "lodash": "4.17.21" is pinned while "lodash": "^4.0.0" is not (it's a range, "any 4.x"). - `project_paths` V1DependencyMetadataPath[]: List of all project paths to this dependency from the root package version (importer). - `nodes` string[]: List of nodes in a dependency path. - `project_uuid` string: The UUID of the project to which the dependency belongs. - `public` boolean: True if the dependency is public. - `purl` string: The purl for the dependency package version. - `reachable` 'REACHABILITY_TYPE_UNSPECIFIED' | 'REACHABILITY_TYPE_REACHABLE' | 'REACHABILITY_TYPE_UNREACHABLE' | 'REACHABILITY_TYPE_UNKNOWN' | 'REACHABILITY_TYPE_REACHABLE_BY_INCLUSION': - REACHABILITY_TYPE_REACHABLE: Call graph analysis determined that the dependency is likely reachable. - REACHABILITY_TYPE_UNREACHABLE: Call graph analysis determined that the dependency is likely not reachable. - REACHABILITY_TYPE_UNKNOWN: Not enough information to perform reachability analysis. - REACHABILITY_TYPE_REACHABLE_BY_INCLUSION: The vulnerability is assumed reachable due to how the dependency is typically used; no call paths exist for this finding. - `repo_name` string: Name of the repository to which the dependency belongs. - `resolved_version` string: Resolved dependency package version. For example, "v2.0.0". - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `unresolved_version` string: Unresolved dependency package version string. For example, "v2.0.0". - `upstream_reference` string: The public package this private dependency was forked from, so its vulnerabilities can be attributed to the fork. Empty means the resolver has not run yet; "N/A" means it ran and found no upstream. - `utilization` number, float: Percent of the dependency used based on the call graph. Implementation pending. - `vendored` boolean: True if the dependency is a vendored dependency. - `importer_data` DependencyMetadataImporterData: Information about the root package version (importer), that imports the dependency in one or more versions, either directly or indirectly. - `callgraph_available` boolean, required: True if the call graph is available for the root package version. - `container_base_image` V1ContainerBaseImage: The base image of a container Image. - `chain_id` string: Chain ID for the base image's layers. - `digest` string: The SHA256 digest of the base image. - `name` string: The name of the base image. For example, "debian:bookworm-slim". - `package_version_uuid` string: The UUID of the base image's own PackageVersion, if it has been scanned. Populated by the scanner from the in-memory base image lookup at scan time; consumers that need this after the fact and find it unset may fall back to a digest-based PackageVersion lookup. - `update_options` V1ContainerImageUpdateOptions: ContainerImageUpdateOptions groups possible base image update candidates. - `latest_version` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `next_version` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `refreshed` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `update_time` string, date-time: Time when these update options were determined. - `package_name` string, required: Qualified package name of the root package version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_name` string, required: Fully qualified name of the root package version. For example, go://package@v1.2.3. - `package_version_ref` string, required: Resolved ref of the source control version for the root package version. Can be a tag, a branch or a SHA. - `package_version_sha` string: SHA of the source control version for the root package version. Because the SHA might not be possible to resolved, this field is optional. Only set for OSS projects. - `package_version_uuid` string, required: The UUID of the importer package version object. This is the same as the parent UUID of this object (meta.parent_uuid). - `project_uuid` string, required: The UUID of the project to which the root package belongs. - `version_name` string: Version number of the root package version. For example, for go://package@v1.2.3 this is set to "v1.2.3". - `tenant_meta` object: Information about the tenant to which the root package (importer) belongs. - `uuid` string: The UUID of the object. ## Response `200` A successful response. - V1DependencyMetadata: Information about the relationship between a root package version (importer) and one of its dependencies. DependencyMetadata objects are children of the root PackageVersion object and belong to the same project and namespace as the root PackageVersion object. They are connected to the importer project through spec.importer_data.project_uuid, and to the dependency project through spec.dependency_data.project_uuid. - `context` V1Context, required: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1DependencyMetadataSpec, required: DependencyMetadata specific data. - `dependency_data` DependencyMetadataDependencyData: Information about the dependency. - `abstract` boolean: True if the dependency is an abstract dependency, such as a secondary Pom file. - `approximation` boolean: True if this is an approximate dependency based on unresolved package dependencies. - `callgraph_available` boolean: True if the call graph is available. - `container_data` V1ContainerDependencyMetadata - `first_reachable_time` string, date-time: First time this dependency was determined to be reachable in an application image. - `last_reachable_time` string, date-time: Most recent time this dependency was determined to be reachable in an application image. - `layers` V1ContainerLayerMetadata[]: Layers of the container image where a dependency is found. This is an optional field. It is only set when target dependency is found via container image scan. - `base_layer` boolean: Set to true if this is the base image layer. - `digest` string, required: The SHA256 digest of the container image layer. - `file_locations` string[]: File locations on the container file system that reference the dependency. - `reachable_count` string, uint64: Number of times this dependency was determined to be reachable in an application image. This number is used for trending and it's not meant for exact usage tracking. - `runtime_files` string[]: Files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when the dependency is found to be used at runtime in the container image. - `user_application_dependency` boolean: Set to true if this is a user application dependency. - `declared_licenses` V1LicenseDependencyMetadata[]: Declared license information for the dependency. - `category` string: License category (e.g. "Restricted"). - `spdx_id` string: SPDX license identifier (e.g. "Apache-2.0"). - `type` string: License classification (based on licenseclassifier by Google). - `direct` boolean, required: True if this is a direct dependency. - `discovered_licenses` V1LicenseDependencyMetadata[]: Discovered license information for the dependency. - `category` string: License category (e.g. "Restricted"). - `spdx_id` string: SPDX license identifier (e.g. "Apache-2.0"). - `type` string: License classification (based on licenseclassifier by Google). - `discovery_type` 'DISCOVERY_TYPE_UNSPECIFIED' | 'DISCOVERY_TYPE_MANIFEST' | 'DISCOVERY_TYPE_PHANTOM' | 'DISCOVERY_TYPE_SEGMENT_MATCH': - DISCOVERY_TYPE_MANIFEST: Dependency was discovered through a manifest file. - DISCOVERY_TYPE_PHANTOM: Dependency was discovered through phantom dependency / imported dependency analysis. - DISCOVERY_TYPE_SEGMENT_MATCH: Dependency was discovered via code segment match. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE': - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `eol` boolean: Indicates whether the dependency is end of life. - `eol_timestamp` string, date-time: End of life timestamp for the dependency package version. - `forked` boolean: Set to true if the dependency is a downstream fork of a public dependency. True exactly when upstream_reference names a package, so both fields are written together. - `internal` boolean: True if the dependency is in the same namespace or, if the namespace is oss, in the same project as the importer. - `last_commit` string, date-time: Date that the dependency was last modified. - `locked` boolean: Set to true if the dependency is fixed to a specific version by a lock file at install time (outcome). If a dependency is locked, but not pinned, it could drift if the lock file is regenerated (for example, by 'npm update'). - `missing` boolean: True if the package version is missing for this dependency. - `namespace` string: Namespace to which the dependency package version object belongs. - `native_scope` string: Un-normalized native dependency scope from the package manager (e.g. Maven "provided"), before it is collapsed into scope. Empty if none. - `orphan` boolean: Deprecated. - `package_name` string: Qualified dependency package name. Does not include the version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_uuid` string: the UUID of the dependency package version object. - `parent_count` integer: Total number of direct parents in dependency graph. - `parent_version_name` string: Fully qualified name of the direct parent of the dependency. For example, go://package@v1.2.3. - `patched` boolean: Indicates whether the dependency version was patched or not. - `pinned` boolean: Set to true of the dependency is fixed to a specific version by a manifest file (intent). For example, in package.json, "lodash": "4.17.21" is pinned while "lodash": "^4.0.0" is not (it's a range, "any 4.x"). - `project_paths` V1DependencyMetadataPath[]: List of all project paths to this dependency from the root package version (importer). - `nodes` string[]: List of nodes in a dependency path. - `project_uuid` string: The UUID of the project to which the dependency belongs. - `public` boolean: True if the dependency is public. - `purl` string: The purl for the dependency package version. - `reachable` 'REACHABILITY_TYPE_UNSPECIFIED' | 'REACHABILITY_TYPE_REACHABLE' | 'REACHABILITY_TYPE_UNREACHABLE' | 'REACHABILITY_TYPE_UNKNOWN' | 'REACHABILITY_TYPE_REACHABLE_BY_INCLUSION': - REACHABILITY_TYPE_REACHABLE: Call graph analysis determined that the dependency is likely reachable. - REACHABILITY_TYPE_UNREACHABLE: Call graph analysis determined that the dependency is likely not reachable. - REACHABILITY_TYPE_UNKNOWN: Not enough information to perform reachability analysis. - REACHABILITY_TYPE_REACHABLE_BY_INCLUSION: The vulnerability is assumed reachable due to how the dependency is typically used; no call paths exist for this finding. - `repo_name` string: Name of the repository to which the dependency belongs. - `resolved_version` string: Resolved dependency package version. For example, "v2.0.0". - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `unresolved_version` string: Unresolved dependency package version string. For example, "v2.0.0". - `upstream_reference` string: The public package this private dependency was forked from, so its vulnerabilities can be attributed to the fork. Empty means the resolver has not run yet; "N/A" means it ran and found no upstream. - `utilization` number, float: Percent of the dependency used based on the call graph. Implementation pending. - `vendored` boolean: True if the dependency is a vendored dependency. - `importer_data` DependencyMetadataImporterData: Information about the root package version (importer), that imports the dependency in one or more versions, either directly or indirectly. - `callgraph_available` boolean, required: True if the call graph is available for the root package version. - `container_base_image` V1ContainerBaseImage: The base image of a container Image. - `chain_id` string: Chain ID for the base image's layers. - `digest` string: The SHA256 digest of the base image. - `name` string: The name of the base image. For example, "debian:bookworm-slim". - `package_version_uuid` string: The UUID of the base image's own PackageVersion, if it has been scanned. Populated by the scanner from the in-memory base image lookup at scan time; consumers that need this after the fact and find it unset may fall back to a digest-based PackageVersion lookup. - `update_options` V1ContainerImageUpdateOptions: ContainerImageUpdateOptions groups possible base image update candidates. - `latest_version` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `next_version` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `refreshed` V1ContainerImageUpdateOption: ContainerImageUpdateOption describes a single base image update candidate. - `chain_id` string: Chain ID for the candidate image's layers. - `digest` string: The SHA256 digest of the candidate image (e.g., "sha256:..."). - `name` string: Full image reference including registry, repository, and tag (e.g., "docker.io/library/ubuntu:22.04"). - `package_version_uuid` string: UUID of the container PackageVersion produced by scanning this candidate. - `update_time` string, date-time: Time when these update options were determined. - `package_name` string, required: Qualified package name of the root package version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_name` string, required: Fully qualified name of the root package version. For example, go://package@v1.2.3. - `package_version_ref` string, required: Resolved ref of the source control version for the root package version. Can be a tag, a branch or a SHA. - `package_version_sha` string: SHA of the source control version for the root package version. Because the SHA might not be possible to resolved, this field is optional. Only set for OSS projects. - `package_version_uuid` string, required: The UUID of the importer package version object. This is the same as the parent UUID of this object (meta.parent_uuid). - `project_uuid` string, required: The UUID of the project to which the root package belongs. - `version_name` string: Version number of the root package version. For example, for go://package@v1.2.3 this is set to "v1.2.3". - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the object. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/dependency-metadata/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/9c1a64674369?raw)