--- title: "Creates a package version metadata query." method: POST path: "/v1/namespaces/{tenant_meta.namespace}/queries/package-versions-metadata" tags: ["PackageVersionMetadataQueryService"] --- # Creates a package version metadata query. `POST /v1/namespaces/{tenant_meta.namespace}/queries/package-versions-metadata` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/queries/package-versions-metadata` - Auth: none declared When sending the request, you can choose to give a version for the package. The result of the request will be different based on this though. While not giving the version, only the version and release time of the package versions found will be returned. While giving the version, all attributes of the version metadata will be returned. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - PackageVersionMetadataQueryServiceCreatePackageVersionMetadataQueryBody: PackageVersionMetadataQuery identifies the origin and metadata of a package or package version from the OSS ecosystems. The query accepts as input the name of the package with an optional version and identifies whether the package can be found in the open source ecosystem, the associated versions and release dates and source code references. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1PackageVersionMetadataQuerySpec, required - `requests` V1PackageVersionMetadataQueryRequest[], required: Caller can issue multiple requests (up to 32). - `found` boolean: Indicates that details for this package version were found. - `package_name` string, required: The package name must be always provided. - `version` string: If a version is provided, the query returns the details of the specific version (including source code reference and release date). If the version is not provided, the query will return a list of all versions known. - `version_metadata` Endorv1VersionMetadata[]: The version metadata output. - `checksums` V1Checksum[]: A list of checksum types. - `algorithm` 'HASH_ALGORITHM_UNSPECIFIED' | 'HASH_ALGORITHM_MD5' | 'HASH_ALGORITHM_SHA1' | 'HASH_ALGORITHM_SHA224' | 'HASH_ALGORITHM_SHA256' | 'HASH_ALGORITHM_SHA384' | 'HASH_ALGORITHM_SHA512', required: An enum with the possible hash functions used to create checksum value. - HASH_ALGORITHM_MD5: HASH_ALGORITHM_MD5 for MD5 hash function. - HASH_ALGORITHM_SHA1: HASH_ALGORITHM_SHA1 for SHA1 hash function. - HASH_ALGORITHM_SHA224: HASH_ALGORITHM_SHA224 for SHA224 hash function. - HASH_ALGORITHM_SHA256: HASH_ALGORITHM_SHA256 for SHA256 hash function. - HASH_ALGORITHM_SHA384: HASH_ALGORITHM_SHA384 for SHA384 hash function. - HASH_ALGORITHM_SHA512: HASH_ALGORITHM_SHA512 for SHA512 hash function. - `value` string, required: A string representation (base64 encoded) of the SHA/MD5 checksum of the package. - `consumed` boolean: Set to true once the corresponding source metadata has been created. - `contributor_details` V1ContributorDetails: The people and organizations that a package version names, grouped by the role the registry gives each one. - `authors` V1ContributorContact[]: People or teams named as authors. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `maintainers` V1ContributorContact[]: People or teams named as maintainers. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `suppliers` V1ContributorContact[]: People or organizations the source declares as the supplier of this version. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `eol_timestamp` string, date-time: End of life timestamp the package version if known. - `last_package_info_attempt` string, date-time: The last time a per-version PackageInfo enrichment call succeeded for this version. Distinct from last_updated (field 8), which only records that the registry's bulk version listing returned this version. A non-nil value means PackageInfo ran and we hold the best enrichment data the registry will give us, even if that data is empty (for example tarball-only releases with no declared license or source code URL). Consumers use this to decide whether a per-version enrichment call is still needed. - `last_updated` string, date-time: The last time that this particular version was re-synced with the source. - `license` string[], required: Raw license information as returned by the package manager. - `license_info` V1LicenseInfo[]: Detailed license information populated by Endor. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `lts` boolean: Set to true if a version is a long-term support (LTS) version. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE': Type of source control platform a resource was discovered on. - `release_time` string, date-time, required - `source_code_ref` string: The source code reference if known. Optional. This can be a tag or a commit SHA. - `source_code_url` string: Source code URL of the package if known. - `version` string, required - `tenant_meta` object: Queries are supported only in the open source ecosystem. - `uuid` string: The UUID of the query and makes the object compatible with the system. ## Response `200` A successful response. - V1PackageVersionMetadataQuery: PackageVersionMetadataQuery identifies the origin and metadata of a package or package version from the OSS ecosystems. The query accepts as input the name of the package with an optional version and identifies whether the package can be found in the open source ecosystem, the associated versions and release dates and source code references. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1PackageVersionMetadataQuerySpec, required - `requests` V1PackageVersionMetadataQueryRequest[], required: Caller can issue multiple requests (up to 32). - `found` boolean: Indicates that details for this package version were found. - `package_name` string, required: The package name must be always provided. - `version` string: If a version is provided, the query returns the details of the specific version (including source code reference and release date). If the version is not provided, the query will return a list of all versions known. - `version_metadata` Endorv1VersionMetadata[]: The version metadata output. - `checksums` V1Checksum[]: A list of checksum types. - `algorithm` 'HASH_ALGORITHM_UNSPECIFIED' | 'HASH_ALGORITHM_MD5' | 'HASH_ALGORITHM_SHA1' | 'HASH_ALGORITHM_SHA224' | 'HASH_ALGORITHM_SHA256' | 'HASH_ALGORITHM_SHA384' | 'HASH_ALGORITHM_SHA512', required: An enum with the possible hash functions used to create checksum value. - HASH_ALGORITHM_MD5: HASH_ALGORITHM_MD5 for MD5 hash function. - HASH_ALGORITHM_SHA1: HASH_ALGORITHM_SHA1 for SHA1 hash function. - HASH_ALGORITHM_SHA224: HASH_ALGORITHM_SHA224 for SHA224 hash function. - HASH_ALGORITHM_SHA256: HASH_ALGORITHM_SHA256 for SHA256 hash function. - HASH_ALGORITHM_SHA384: HASH_ALGORITHM_SHA384 for SHA384 hash function. - HASH_ALGORITHM_SHA512: HASH_ALGORITHM_SHA512 for SHA512 hash function. - `value` string, required: A string representation (base64 encoded) of the SHA/MD5 checksum of the package. - `consumed` boolean: Set to true once the corresponding source metadata has been created. - `contributor_details` V1ContributorDetails: The people and organizations that a package version names, grouped by the role the registry gives each one. - `authors` V1ContributorContact[]: People or teams named as authors. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `maintainers` V1ContributorContact[]: People or teams named as maintainers. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `suppliers` V1ContributorContact[]: People or organizations the source declares as the supplier of this version. - `email` string: The email address the manifest declares for this person or organization, for example from PyPI author_email. - `name` string: The name as the manifest declares it, for example "NumPy Developers". - `eol_timestamp` string, date-time: End of life timestamp the package version if known. - `last_package_info_attempt` string, date-time: The last time a per-version PackageInfo enrichment call succeeded for this version. Distinct from last_updated (field 8), which only records that the registry's bulk version listing returned this version. A non-nil value means PackageInfo ran and we hold the best enrichment data the registry will give us, even if that data is empty (for example tarball-only releases with no declared license or source code URL). Consumers use this to decide whether a per-version enrichment call is still needed. - `last_updated` string, date-time: The last time that this particular version was re-synced with the source. - `license` string[], required: Raw license information as returned by the package manager. - `license_info` V1LicenseInfo[]: Detailed license information populated by Endor. - `file` string: The name of the file where the license was found. - `file_location` integer: The line in the file where the license text begins. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED': LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `matched_text` string: The license text that was matched. - `name` string, required: Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `spdxid` string: Normalized SPDX id if known. - `type` string: License classification (based on licenseclassifier by Google). - `url` string: The URL that points to the license description. - `lts` boolean: Set to true if a version is a long-term support (LTS) version. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE': Type of source control platform a resource was discovered on. - `release_time` string, date-time, required - `source_code_ref` string: The source code reference if known. Optional. This can be a tag or a commit SHA. - `source_code_url` string: Source code URL of the package if known. - `version` string, required - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the query and makes the object compatible with the system. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/queries/package-versions-metadata/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)