---
title: "Register a dependency set to re-check later (one credit to create)."
method: POST
path: "/v1/watch"
---

# Register a dependency set to re-check later (one credit to create).

`POST /v1/watch`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/watch`
- Auth: API key in header `X-API-Key`

Requires an X-API-Key. Creating a watch spends one credit, taken only after the baseline is recorded, so a feed outage costs nothing. Send a lockfile (raw or as {"lockfile":"<contents>"}) or {"packages":[{"name","version"}]}: exactly pinned versions only, at most 2000. We store package identities and what we knew at that moment, never lockfile contents or code. Returns a `watch_id` and a `watch_token` shown once. A watch is re-checked when you read it with GET /v1/watch/{id}: nothing runs on a schedule and nothing is pushed to you, so poll it.

## Request body

- object
  - `lockfile` string
  - `packages` object[]
    - `name` string
    - `version` string
  - `webhook_url` string: Optional https URL. Accepted and stored, but no deliveries are sent yet, so do not rely on it for alerts.

## Response `201`

The watch, its one-time token, and the baseline taken at registration.

## Other responses

- `400`: No exactly-pinned versions, too many packages, or a webhook_url that is not https.
- `401`: Invalid API key.
- `402`: No key, or no credits left. Body carries `ways_to_pay`.
- `404`: Watches are not enabled on this deployment.
- `429`: Rate limited.
- `503`: The baseline could not be taken, or the watch could not be saved. No watch was created; `detail` says whether a spent credit was returned.

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)