--- title: "CreateOSSDependencyRequest" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/oss-dependency-requests" tags: ["OSSDependencyRequestService"] --- # CreateOSSDependencyRequest `POST /v1/namespaces/{tenant_meta.namespace}/oss-dependency-requests` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/oss-dependency-requests` - Auth: none declared Creates an OSS dependency request. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - OSSDependencyRequestServiceCreateOSSDependencyRequestBody: Represents a request to create OSS dependencies in the system. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1OSSDependencyRequestSpec, required - `dependencies` BomDependency[]: The list of dependencies to be created as OSS dependencies. - `abstract` boolean: Whether this is an abstract dependency, such as a secondary BOM file. - `cocoapod_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `composition_metadata` V1ContainerCompositionMetadata: ContainerCompositionMetadata is the metadata of the composition of a container image. - `package_type` 'CONTAINER_PACKAGE_TYPE_UNSPECIFIED' | 'CONTAINER_PACKAGE_TYPE_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY': ContainerPackageType is the type of container package. - CONTAINER_PACKAGE_TYPE_UNSPECIFIED: Unspecified container package type. - CONTAINER_PACKAGE_TYPE_LIBRARY: Library container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION: Application container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY: Application and Library container package type. - CONTAINER_PACKAGE_TYPE_OS_LIBRARY: OS Library container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION: OS Application container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY: OS Application and Library container package type. - `conan_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `container_layers` V1ContainerDependencyLayer[]: A list of layers where a dependency is introduced in final the container image. It is an optional field. Each entry contains the layer ID (the SHA256 digest of the layer) and the file locations within the layer that indicate the presence of the dependency in the container. - `digest` string, required: The SHA256 digest of the layer, where a dependency is found to be present in the container. - `file_locations` string[]: The locations of the files in the container, through which the dependency is evident to be present in the container. - `dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `eol_timestamp` string, date-time: End of life timestamp of the dependency if known. - `file_location_remote_paths` object: Maps each entry in file_locations (the local, scanned-workspace path) to the matched path in the dependency's own upstream source, when known. Only populated for IMPORTED_TYPE_SEGMENT_MATCH dependencies. - `file_locations` string[]: An optional field for BOM dependencies that are either vendored or discovered in containers and identify the list of file locations that this dependency is seen at. - `gem_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT': Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. - `github_action_kind` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST': The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. - `golang_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' - `hugging_face_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `import_path` string: The path the source imports this dependency by, set only when it differs from the path inside name. Empty whenever the two agree, which is every ordinary dependency. A Golang "replace" that redirects one module path to another leaves the source importing the original path, so name carries the module that supplied the code and this carries the path the compiler sees. - `imported_type` 'IMPORTED_TYPE_UNSPECIFIED' | 'IMPORTED_TYPE_IN_SOURCE' | 'IMPORTED_TYPE_NOT_IN_SOURCE' | 'IMPORTED_TYPE_PHANTOM' | 'IMPORTED_TYPE_SEGMENT_MATCH' | 'IMPORTED_TYPE_INSTALLED_IN_USE': ImportedType is the state of import. - IMPORTED_TYPE_UNSPECIFIED: UNSPECIFIED is the default state. This state denotes that imported dependency analysis has not been run yet for this dependency. - IMPORTED_TYPE_IN_SOURCE: IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is imported in source. - IMPORTED_TYPE_NOT_IN_SOURCE: NOT_IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is not imported in source. - IMPORTED_TYPE_PHANTOM: PHANTOM means the imported dependency analysis succeeded and found that the dependency is imported only in the source (a phantom dependency). - IMPORTED_TYPE_SEGMENT_MATCH: Dependency was discovered through code segment match. - IMPORTED_TYPE_INSTALLED_IN_USE: Dependency was discovered through installed dependencies and it is in use. - `js_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_DEPENDENCY' | 'SCOPE_DEV_DEPENDENCY' | 'SCOPE_OPTIONAL_DEPENDENCY' | 'SCOPE_PEER_DEPENDENCY': The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. - `locked` boolean: Set to true if the dependency is fixed to a specific version by a lock file at install time (outcome). If a dependency is locked, but not pinned, it could drift if the lock file is regenerated (for example, by 'npm update'). - `maven_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_COMPILE' | 'SCOPE_PROVIDED' | 'SCOPE_RUNTIME' | 'SCOPE_TEST' | 'SCOPE_SYSTEM' | 'SCOPE_CUSTOM' | 'SCOPE_VENDORED_CODE' | 'SCOPE_IMPORT': - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. - `name` string, required - `nuget_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `packagist_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT': Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. - `patched` boolean: patched indicates whether the dependency version was patched or not. - `pinned` boolean: Set to true of the dependency is fixed to a specific version by a manifest file (intent). For example, in package.json, "lodash": "4.17.21" is pinned while "lodash": "^4.0.0" is not (it's a range, "any 4.x"). - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE': Type of source control platform a resource was discovered on. - `public` boolean: A boolean to know if the dependency is public or not. This field might not be set. - `purl` string: purl is the package URL notation of the dependency. Populated only for containers and OS packages. - `pypi_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_OPTIONAL': Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. - `release_date` string, date-time: The date that the dependency was released, if known. - `runtime_files` V1ContainerRuntimeDependencyFile[]: A list of files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when a dependency is found to be used at runtime in the container image. - `digests` V1Digest[]: Digest of the file. - `algorithm` 'DIGEST_TYPE_UNSPECIFIED' | 'DIGEST_TYPE_SHA1' | 'DIGEST_TYPE_SHA256' | 'DIGEST_TYPE_SHA512' | 'DIGEST_TYPE_MD5', required - `value` string, required: Digest value of the file. - `file_type` 'FILE_TYPE_UNSPECIFIED' | 'FILE_TYPE_FILE' | 'FILE_TYPE_SYMLINK' - `path` string: Path of the dependency file as seen in the container image. - `real_path` string: Actual path of the file accessed when a dependency is called at runtime in the container image. - `rust_dependency_kind` 'DEPENDENCY_KIND_UNSPECIFIED' | 'DEPENDENCY_KIND_NORMAL' | 'DEPENDENCY_KIND_DEVELOPMENT' | 'DEPENDENCY_KIND_BUILD': - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. - `source_repository_http_clone_url` string: The HTTP clone URL of the dependency if found. This field might not be set. - `source_repository_ref` string: The ref of the source repsotiory. This can be a tag or a commit SHA. This field might not be set. - `swift_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[]: The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - `exclude` boolean, required: Set to true if a dependency is excluded from the target. - `name` string, required: Target name. Example: linux, dotnet, x86_64. - `type` 'TARGET_TYPE_UNSPECIFIED' | 'TARGET_TYPE_LANGUAGE' | 'TARGET_TYPE_FRAMEWORK' | 'TARGET_TYPE_OS' | 'TARGET_TYPE_CPU_ARCH', required: - TARGET_TYPE_LANGUAGE: Language target, for example: Go 1.7 or Java 8. - TARGET_TYPE_FRAMEWORK: Framework target, for example: spring boot 2.0 or dotnet 4.6.2. - TARGET_TYPE_OS: OS target, for example: linux, windows, macos. - TARGET_TYPE_CPU_ARCH: CPU architecture target, for example: amd64, arm64, arm. - `version` string: Target version, for example, 6.0.0 for the dotnet framework version 6.0.0. If there is no version specified for a target then that means that a dependency is applicable for all versions of that target. This field is optional because few targets, such as CPU_ARCH, do not have a version. - `user_app_dep` boolean: For container BOMs, set to true if this is a user application (i.e. the user associated it with an SCA scan). - `vendored` boolean: Whether this is dependency comes from vendored code or not. - `tenant_meta` object: SBOM are associated with a tenant and the tenant information must be provided. - `uuid` string: The UUID of the SBOM. ## Response `200` A successful response. - V1OSSDependencyRequest: Represents a request to create OSS dependencies in the system. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1OSSDependencyRequestSpec, required - `dependencies` BomDependency[]: The list of dependencies to be created as OSS dependencies. - `abstract` boolean: Whether this is an abstract dependency, such as a secondary BOM file. - `cocoapod_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `composition_metadata` V1ContainerCompositionMetadata: ContainerCompositionMetadata is the metadata of the composition of a container image. - `package_type` 'CONTAINER_PACKAGE_TYPE_UNSPECIFIED' | 'CONTAINER_PACKAGE_TYPE_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY': ContainerPackageType is the type of container package. - CONTAINER_PACKAGE_TYPE_UNSPECIFIED: Unspecified container package type. - CONTAINER_PACKAGE_TYPE_LIBRARY: Library container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION: Application container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY: Application and Library container package type. - CONTAINER_PACKAGE_TYPE_OS_LIBRARY: OS Library container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION: OS Application container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY: OS Application and Library container package type. - `conan_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `container_layers` V1ContainerDependencyLayer[]: A list of layers where a dependency is introduced in final the container image. It is an optional field. Each entry contains the layer ID (the SHA256 digest of the layer) and the file locations within the layer that indicate the presence of the dependency in the container. - `digest` string, required: The SHA256 digest of the layer, where a dependency is found to be present in the container. - `file_locations` string[]: The locations of the files in the container, through which the dependency is evident to be present in the container. - `dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `eol_timestamp` string, date-time: End of life timestamp of the dependency if known. - `file_location_remote_paths` object: Maps each entry in file_locations (the local, scanned-workspace path) to the matched path in the dependency's own upstream source, when known. Only populated for IMPORTED_TYPE_SEGMENT_MATCH dependencies. - `file_locations` string[]: An optional field for BOM dependencies that are either vendored or discovered in containers and identify the list of file locations that this dependency is seen at. - `gem_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT': Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. - `github_action_kind` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST': The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. - `golang_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' - `hugging_face_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `import_path` string: The path the source imports this dependency by, set only when it differs from the path inside name. Empty whenever the two agree, which is every ordinary dependency. A Golang "replace" that redirects one module path to another leaves the source importing the original path, so name carries the module that supplied the code and this carries the path the compiler sees. - `imported_type` 'IMPORTED_TYPE_UNSPECIFIED' | 'IMPORTED_TYPE_IN_SOURCE' | 'IMPORTED_TYPE_NOT_IN_SOURCE' | 'IMPORTED_TYPE_PHANTOM' | 'IMPORTED_TYPE_SEGMENT_MATCH' | 'IMPORTED_TYPE_INSTALLED_IN_USE': ImportedType is the state of import. - IMPORTED_TYPE_UNSPECIFIED: UNSPECIFIED is the default state. This state denotes that imported dependency analysis has not been run yet for this dependency. - IMPORTED_TYPE_IN_SOURCE: IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is imported in source. - IMPORTED_TYPE_NOT_IN_SOURCE: NOT_IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is not imported in source. - IMPORTED_TYPE_PHANTOM: PHANTOM means the imported dependency analysis succeeded and found that the dependency is imported only in the source (a phantom dependency). - IMPORTED_TYPE_SEGMENT_MATCH: Dependency was discovered through code segment match. - IMPORTED_TYPE_INSTALLED_IN_USE: Dependency was discovered through installed dependencies and it is in use. - `js_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_DEPENDENCY' | 'SCOPE_DEV_DEPENDENCY' | 'SCOPE_OPTIONAL_DEPENDENCY' | 'SCOPE_PEER_DEPENDENCY': The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. - `locked` boolean: Set to true if the dependency is fixed to a specific version by a lock file at install time (outcome). If a dependency is locked, but not pinned, it could drift if the lock file is regenerated (for example, by 'npm update'). - `maven_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_COMPILE' | 'SCOPE_PROVIDED' | 'SCOPE_RUNTIME' | 'SCOPE_TEST' | 'SCOPE_SYSTEM' | 'SCOPE_CUSTOM' | 'SCOPE_VENDORED_CODE' | 'SCOPE_IMPORT': - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. - `name` string, required - `nuget_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `packagist_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT': Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. - `patched` boolean: patched indicates whether the dependency version was patched or not. - `pinned` boolean: Set to true of the dependency is fixed to a specific version by a manifest file (intent). For example, in package.json, "lodash": "4.17.21" is pinned while "lodash": "^4.0.0" is not (it's a range, "any 4.x"). - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE': Type of source control platform a resource was discovered on. - `public` boolean: A boolean to know if the dependency is public or not. This field might not be set. - `purl` string: purl is the package URL notation of the dependency. Populated only for containers and OS packages. - `pypi_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_OPTIONAL': Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. - `release_date` string, date-time: The date that the dependency was released, if known. - `runtime_files` V1ContainerRuntimeDependencyFile[]: A list of files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when a dependency is found to be used at runtime in the container image. - `digests` V1Digest[]: Digest of the file. - `algorithm` 'DIGEST_TYPE_UNSPECIFIED' | 'DIGEST_TYPE_SHA1' | 'DIGEST_TYPE_SHA256' | 'DIGEST_TYPE_SHA512' | 'DIGEST_TYPE_MD5', required - `value` string, required: Digest value of the file. - `file_type` 'FILE_TYPE_UNSPECIFIED' | 'FILE_TYPE_FILE' | 'FILE_TYPE_SYMLINK' - `path` string: Path of the dependency file as seen in the container image. - `real_path` string: Actual path of the file accessed when a dependency is called at runtime in the container image. - `rust_dependency_kind` 'DEPENDENCY_KIND_UNSPECIFIED' | 'DEPENDENCY_KIND_NORMAL' | 'DEPENDENCY_KIND_DEVELOPMENT' | 'DEPENDENCY_KIND_BUILD': - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. - `source_repository_http_clone_url` string: The HTTP clone URL of the dependency if found. This field might not be set. - `source_repository_ref` string: The ref of the source repsotiory. This can be a tag or a commit SHA. This field might not be set. - `swift_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL': - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[]: The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - `exclude` boolean, required: Set to true if a dependency is excluded from the target. - `name` string, required: Target name. Example: linux, dotnet, x86_64. - `type` 'TARGET_TYPE_UNSPECIFIED' | 'TARGET_TYPE_LANGUAGE' | 'TARGET_TYPE_FRAMEWORK' | 'TARGET_TYPE_OS' | 'TARGET_TYPE_CPU_ARCH', required: - TARGET_TYPE_LANGUAGE: Language target, for example: Go 1.7 or Java 8. - TARGET_TYPE_FRAMEWORK: Framework target, for example: spring boot 2.0 or dotnet 4.6.2. - TARGET_TYPE_OS: OS target, for example: linux, windows, macos. - TARGET_TYPE_CPU_ARCH: CPU architecture target, for example: amd64, arm64, arm. - `version` string: Target version, for example, 6.0.0 for the dotnet framework version 6.0.0. If there is no version specified for a target then that means that a dependency is applicable for all versions of that target. This field is optional because few targets, such as CPU_ARCH, do not have a version. - `user_app_dep` boolean: For container BOMs, set to true if this is a user application (i.e. the user associated it with an SCA scan). - `vendored` boolean: Whether this is dependency comes from vendored code or not. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the SBOM. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/oss-dependency-requests/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)