---
title: "Free: the exact package versions a lockfile change adds."
method: POST
path: "/v1/lockfile/diff"
---

# Free: the exact package versions a lockfile change adds.

`POST /v1/lockfile/diff`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/lockfile/diff`
- Auth: none declared

No auth, IP rate-limited. Body {"base": <lockfile>, "head": <lockfile>}, each the raw contents of a package-lock.json, yarn.lock or pnpm-lock.yaml. Returns `added` (the name@version pairs present in head and absent from base, which is the list to scan), `upgraded`, `removed`, an `unchanged` count, and per-side `checked` and `truncated`. A truncated side makes the diff partial, and `note` says so. This compares identities only and checks nothing for malware: send `added` to POST /v1/scan/batch for that.

## Response `200`

What the head lockfile adds, upgrades and removes relative to base.

## Other responses

- `400`: A side is missing, or could not be read as a lockfile. An unreadable lockfile is not a statement that nothing changed.
- `429`: Rate limited.

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)