--- title: "POST /v1/namespaces/{tenant_meta.namespace}/queries/package-version-licenses" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/queries/package-version-licenses" tags: ["PackageVersionLicenseQueryService"] --- # POST /v1/namespaces/{tenant_meta.namespace}/queries/package-version-licenses `POST /v1/namespaces/{tenant_meta.namespace}/queries/package-version-licenses` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/queries/package-version-licenses` - Auth: none declared ## Path parameters - `tenant_meta.namespace` string, required ## Request body - PackageVersionLicenseQueryServiceCreatePackageVersionLicenseQueryBody - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1PackageVersionLicenseQuerySpec, required - `requests` V1PackageVersionLicenseQueryRequest[], required: Caller can issue multiple requests (up to 32). - `license_data` V1LicenseData: Contains a summary of license information for a project or package. This will be included as the payload of a metric object. - `all_licenses` V1LicenseInfo[]: All the licenses found by Endor Labs. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `code_licenses` V1LicenseInfo[]: The licenses found in the source code. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `copyrights` string[]: The list of copyright notices found in source files. - `package_manager_licenses` V1LicenseInfo[]: The licenses from the package manager. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `repository_license` V1LicenseInfo: LicenseInfo contains information for a license. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `license_source` 'LICENSE_SOURCE_UNSPECIFIED' | 'LICENSE_SOURCE_PKG_MGR_ONLY' | 'LICENSE_SOURCE_PKG_MGR_AND_CODE' | 'LICENSE_SOURCE_CODE_ONLY' | 'LICENSE_SOURCE_NOT_FOUND': Enum to describe the source of license information. - LICENSE_SOURCE_UNSPECIFIED: Licesne Source unspecified - LICENSE_SOURCE_PKG_MGR_ONLY: License was found only in the package manager metadata, but not in the source code. This may happen if source code is unavailable or scanning failed. In this case, spec.license_data contains only package manager license(s). - LICENSE_SOURCE_PKG_MGR_AND_CODE: License was found in both the code and the package manager. spec.license_data contains all licenses, and the Metric includes the package manager license. - LICENSE_SOURCE_CODE_ONLY: License was found only in the code , not in the package manager. spec.license_data will not include any package manager license. - LICENSE_SOURCE_NOT_FOUND: No license data found anywhere - `package_version_name` string, required: The fully qualified package name must be always provided. - `tenant_meta` object: Package version license is associated with a tenant. - `uuid` string: The UUID of the query and makes the object compatible with the system. ## Response `200` A successful response. - V1PackageVersionLicenseQuery - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1PackageVersionLicenseQuerySpec, required - `requests` V1PackageVersionLicenseQueryRequest[], required: Caller can issue multiple requests (up to 32). - `license_data` V1LicenseData: Contains a summary of license information for a project or package. This will be included as the payload of a metric object. - `all_licenses` V1LicenseInfo[]: All the licenses found by Endor Labs. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `code_licenses` V1LicenseInfo[]: The licenses found in the source code. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `copyrights` string[]: The list of copyright notices found in source files. - `package_manager_licenses` V1LicenseInfo[]: The licenses from the package manager. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `repository_license` V1LicenseInfo: LicenseInfo contains information for a license. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `license_source` 'LICENSE_SOURCE_UNSPECIFIED' | 'LICENSE_SOURCE_PKG_MGR_ONLY' | 'LICENSE_SOURCE_PKG_MGR_AND_CODE' | 'LICENSE_SOURCE_CODE_ONLY' | 'LICENSE_SOURCE_NOT_FOUND': Enum to describe the source of license information. - LICENSE_SOURCE_UNSPECIFIED: Licesne Source unspecified - LICENSE_SOURCE_PKG_MGR_ONLY: License was found only in the package manager metadata, but not in the source code. This may happen if source code is unavailable or scanning failed. In this case, spec.license_data contains only package manager license(s). - LICENSE_SOURCE_PKG_MGR_AND_CODE: License was found in both the code and the package manager. spec.license_data contains all licenses, and the Metric includes the package manager license. - LICENSE_SOURCE_CODE_ONLY: License was found only in the code , not in the package manager. spec.license_data will not include any package manager license. - LICENSE_SOURCE_NOT_FOUND: No license data found anywhere - `package_version_name` string, required: The fully qualified package name must be always provided. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the query and makes the object compatible with the system. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/queries/package-version-licenses/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)