---
title: "Get package detail"
method: GET
path: "/akrites/packages/detail"
tags: ["Packages"]
---

# Get package detail

`GET /akrites/packages/detail`

Returns the full detail view for a single package identified by its PURL, including risk signals, security advisories, repository provenance, and current stewardship state.

## Query parameters

- `purl` string, required

## Response `200`

Package detail.

- PackageDetail
  - `purl` string, required
  - `name` string, required
  - `ecosystem` string, required
  - `latestVersion` string, nullable
  - `general` object, required
    - `healthScore` integer, nullable — OpenSSF Scorecard score scaled to 0–100 (scorecardScore × 10, rounded).
    - `healthBand` 'healthy' | 'fair' | 'concerning' | 'critical' — Derived from `scorecardScore`: `null or < 3.0` → critical · `< 5.0` → concerning · `< 7.0` → fair · `≥ 7.0` → healthy
    - `impact` object
      - `impactScore` integer, nullable — Criticality score scaled to 0–100.
      - `downloadsLastMonth` string, nullable — Raw download count string from the registry.
      - `dependentPackages` integer, nullable
      - `dependentRepos` integer, nullable
      - `transitiveReach` integer, nullable
    - `riskSignals` object
      - `lifecycle` string, nullable
      - `maintainerBusFactor` integer, nullable
      - `lastRelease` string, date-time, nullable
      - `hasSecurityFile` boolean, nullable
      - `hasSecurityPolicy` boolean, nullable — repos.security_policy_enabled
      - `branchProtectionEnabled` boolean, nullable — repos.branch_protection_enabled
      - `openSSFScorecard` number, float, nullable
  - `assessment` unknown, required
  - `security` object, required
    - `securityContacts` SecurityContact[], nullable — null when the linked repo has not yet been swept by the security-contacts pipeline; empty array when swept with no contacts found. Provenance and internal scoring metadata are never included.
      - `channel` 'email' | 'github-pvr' | 'url' | 'github-handle' | 'web-form', required
      - `value` string, required
      - `role` 'security-team' | 'maintainer' | 'admin' | 'committer' | 'org-owner', required
      - `confidence` 'PRIMARY' | 'SECONDARY' | 'FALLBACK' | 'NONE', required
      - `score` number, float, required
    - `packageConfidence` 'PRIMARY' | 'SECONDARY' | 'FALLBACK' | 'NONE'
    - `securityPolicies` object
      - `securityPolicyUrl` string, nullable
      - `vulnerabilityReportingUrl` string, nullable
      - `bugBountyUrl` string, nullable
      - `pvrEnabled` boolean, nullable
    - `advisories` Advisory[]
      - `osvId` string, required
      - `severity` 'critical' | 'high' | 'moderate' | 'low', nullable, required
      - `resolution` 'open' | 'patched', nullable, required
      - `isCritical` boolean, required — True when CVSS score >= 7.0.
    - `cvd` object
      - `isPvrEnabled` boolean, nullable
      - `tier0Steward` string, nullable
      - `criticalVulnerabilityFlag` boolean, nullable
  - `provenance` object, required
    - `repositoryMapping` object
      - `declaredRepo` string, nullable
      - `mappingConfidence` number, float, nullable
      - `mappingLabel` 'High' | 'Medium' | 'Low', nullable
      - `lastCommitAt` string, date-time, nullable
    - `supplyChainIntegrity` object
      - `buildProvenance` string, nullable — Not yet ingested.
      - `signedReleases` string, nullable — Not yet ingested.
  - `stewardship` object, required
    - `id` string, nullable
    - `status` 'unassigned' | 'open' | 'assessing' | 'active' | 'needs_attention' | 'escalated' | 'blocked' | 'inactive'
    - `origin` string, nullable
    - `version` integer, nullable
    - `openedAt` string, date-time, nullable
    - `lastStatusAt` string, date-time, nullable
    - `resolutionPath` 'right_of_first_refusal' | 'replace_the_dependency' | 'find_vendor_for_lts' | 'consortium_adopts_maintainership' | 'compensating_controls_monitor' | 'namespace_takeover'
    - `statusNote` string, nullable
    - `stewards` StewardEntry[], nullable
      - `id` string, required
      - `stewardshipId` string, required
      - `userId` string, required
      - `name` string, nullable
      - `role` 'lead' | 'co_steward', required
      - `assignedAt` string, date-time, required
      - `assignedBy` string, nullable
    - `lastActivityAt` string, date-time, nullable
  - `history` unknown, required

## Other responses

- `400` — Validation error (malformed purl).
- `401` — Missing or invalid bearer token.
- `404` — Package not found.

## Changes

- **2026-07-17** (v1) `17bbb3d320c3` — 1 breaking, 7 info
  - the `security/securityContacts/items/` response's property type/format changed from `string`/`` to `object`/`` for status `200`
  - added the optional property `security/packageConfidence` to the response with the `200` status
  - added the optional property `security/securityPolicies` to the response with the `200` status
  - added the required property `security/securityContacts/items/channel` to the response with the `200` status
  - …4 more
- **2026-06-24** (v1) `648aefbdca56` — 3 warning, 2 info
  - added the new `moderate` enum value to the `security/advisories/items/severity` response property for the response status `200`
  - added the new `open` enum value to the `security/advisories/items/resolution` response property for the response status `200`
  - added the new `patched` enum value to the `security/advisories/items/resolution` response property for the response status `200`
  - removed the `medium` enum value from the `security/advisories/items/severity` response property for the response status `200`
  - …1 more
- …earlier changes not shown

[Full history](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-akrites/changes/akrites/packages/detail/get.md)

---

[API](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-akrites.md) · [All operations](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-akrites/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/linuxfoundation/cdp-public-api-akrites/revisions/17bbb3d320c3/schema)