---
title: "Read a domain or parse a lockfile without saving anything."
method: POST
path: "/surveillance/analyze"
tags: ["surveillance"]
---

# Read a domain or parse a lockfile without saving anything.

`POST /surveillance/analyze`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/surveillance/analyze`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

30 analyses per hour per organisation.

## Request body

- union: `POST /surveillance/analyze`, discriminated on `kind`.
  - object
    - `domain` string, required
    - `kind` 'DOMAIN', required
  - object
    - `content` string, required
    - `format` 'PackageLock' | 'ComposerLock' | 'Requirements' | 'GemfileLock' | 'CargoLock' | 'CycloneDx': `WatchSource.lockfileFormat`.
    - `kind` 'LOCKFILE', required

## Response `200`

OK

- AnalyzeResponse
  - `detected` DetectedComponent[], required
    - `cpe` string, nullable
    - `cpeProduct` string, nullable
    - `cpeVendor` string, nullable
    - `dependencyScope` 'Direct' | 'Transitive' | 'Dev' | 'NotApplicable': `WatchComponent.dependencyScope`.
    - `ecosystem` string, nullable
    - `evidence` string, nullable
    - `identityKey` string, required
    - `monitored` boolean, nullable
    - `name` string, required
    - `packageName` string, nullable
    - `purl` string, nullable
    - `reason` string, nullable: Why it is not monitored by default (`managed_service`, `dev_dependency`).
    - `suggestedMonitored` boolean, required
    - `version` string, nullable
    - `versionBranch` string, nullable
    - `versionSource` 'Header' | 'MetaTag' | 'ScriptPath' | 'PortBanner' | 'Lockfile' | 'Sbom' | 'Manual' | 'LegacyCpe' | 'None', required: `WatchComponent.versionSource` — where the version was read.
    - `versionVerified` boolean, required
  - `format` 'PackageLock' | 'ComposerLock' | 'Requirements' | 'GemfileLock' | 'CargoLock' | 'CycloneDx': `WatchSource.lockfileFormat`.
  - `readAt` string, date-time, required
  - `readStatus` 'Ok' | 'Partial' | 'Unreachable' | 'Refused' | 'ParseError', required: `WatchSource.lastReadStatus`.
  - `totals` LockfileTotals, required
    - `dev` integer, required
    - `direct` integer, required
    - `transitive` integer, required
  - `warnings` string[], required

## Other responses

- `400`: Invalid request
- `401`: Unauthorized
- `429`: 30 analyses per hour per organisation
- `503`: The limiter is unavailable

## Changes

- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/surveillance/analyze/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)