---
title: "Get full package detail"
method: GET
path: "/packages/detail"
tags: ["Packages"]
---

# Get full package detail

`GET /packages/detail`

Returns data for the drawer's Overview, Security, and Provenance tabs. Pass the canonical purl as a query parameter — no URL-encoding needed. Example: `?purl=pkg:npm/lodash@4.17.21`.

## Query parameters

- `purl` string, required

## Response `200`

Package found.

- PackageDetail
  - `purl` string, required
  - `name` string, required
  - `ecosystem` string, required
  - `general` object, required
    - `healthScore` integer, nullable — Composite health score (0–100). Tinybird-enriched when available, null otherwise.
    - `healthScoreDetails` object, nullable — Breakdown of the composite health score. Null until Tinybird enrichment runs.
      - `total` integer, nullable
      - `label` string, nullable
      - `maintainerHealth` integer, nullable
      - `securitySupplyChain` integer, nullable
      - `developmentActivity` integer, nullable
    - `healthBand` 'excellent' | 'healthy' | 'fair' | 'concerning' | 'critical' | 'null', nullable — Derived from Tinybird health score when available, OpenSSF Scorecard otherwise.
    - `impact` object, nullable
      - `impactScore` integer, nullable
      - `downloadsLastMonth` integer, nullable — Null for Maven (Sonatype data not yet ingested).
      - `dependentPackages` integer, nullable
      - `dependentRepos` integer, nullable
      - `transitiveReach` string, nullable
    - `riskSignals` object, nullable
      - `lifecycle` 'active' | 'stable' | 'declining' | 'abandoned' | 'archived' | 'null', nullable
      - `maintainerBusFactor` integer, nullable
      - `lastRelease` string, date-time, nullable
      - `hasSecurityFile` boolean, nullable
      - `openSSFScorecard` number, float, nullable
  - `assessment` object, required — Stewardship assessment data. Empty in v1 — assessment flow deferred to v2.
  - `security` object, required
    - `securityContacts` SecurityContact[], nullable
      - `name` string, nullable, required
      - `email` string, email, nullable
    - `advisories` Advisory[]
      - `osvId` string, required — GHSA or CVE identifier.
      - `severity` 'critical' | 'high' | 'medium' | 'low', required
      - `resolution` string, nullable — Resolution status. TBD.
    - `cvd` object — Coordinated Vulnerability Disclosure readiness signals.
      - `isPvrEnabled` boolean, nullable — Private Vulnerability Reporting enabled. Null in v1.
      - `hasSecurityPolicyEnabled` boolean, nullable — SECURITY.md present in repo. Null until enricher captures this.
      - `tier0Steward` string, nullable — Name of the Tier 0 steward if assigned. Null in v1.
      - `criticalVulnerabilityFlag` boolean, nullable — True if any open advisory has cvss >= 7.0.
  - `provenance` object, required
    - `repositoryMapping` object, nullable
      - `declaredRepo` string, uri, nullable
      - `mappingConfidence` number, float, nullable
      - `lastCommitAt` string, date-time, nullable
    - `supplyChainIntegrity` object — All fields null in v1 — separate ingestion workstream required.
      - `buildProvenance` string, nullable
      - `signedReleases` string, nullable
  - `stewardship` object — Stewardship state.
    - `id` string, nullable — Stewardship ID. Required to call mutation endpoints (assign/escalate/status).
    - `status` 'unassigned' | 'open' | 'assessing' | 'active' | 'needs_attention' | 'escalated' | 'blocked' | 'inactive'
    - `stewards` Steward[], nullable — Assigned stewards or null.
      - `userId` string, required — Auth0 sub of the assigned steward.
      - `username` string, nullable — Username of the steward. Null if not available.
      - `displayName` string, nullable — Display name of the steward. Null if not available.
      - `role` 'lead' | 'co_steward', required
      - `assignedAt` string, date-time, required
    - `lastActivityAt` string, date-time, nullable
    - `resolutionPath` string, nullable — Set on `escalated` status. Null for all other statuses.
    - `statusNote` string, nullable — Free-text note for the current status.
  - `history` object, required — Package history data. Empty in v1.
  - `signalCoverageHealth` object, nullable — Signal coverage health data enriched by Tinybird. Null until enriched.

## Other responses

- `401` — Missing or invalid bearer token.
- `403` — Insufficient scopes.
- `404` — Package not found.

## Changes

- **2026-07-17** (v1) `36d7585ff64c` — 2 warning
  - added the new `archived` enum value to the `general/riskSignals/lifecycle` response property for the response status `200`
  - added the new `excellent` enum value to the `general/healthBand` response property for the response status `200`
- **2026-06-24** (v1) `b1ac806083ee` — 1 breaking, 4 warning, 3 info
  - the `general/healthScore` response's property type/format changed from `object, null`/`` to `integer, null`/`` for status `200`
  - removed the optional property `general/healthScore/developmentActivity` from the response with the `200` status
  - removed the optional property `general/healthScore/maintainerHealth` from the response with the `200` status
  - removed the optional property `general/healthScore/securitySupplyChain` from the response with the `200` status
  - …4 more
- **2026-06-23** (v1) `3272cbfaa72b` — 1 warning, 2 info
  - removed the optional property `stewardship/stewards/oneOf[subschema #1]/items/name` from the response with the `200` status
  - added the optional property `stewardship/stewards/oneOf[subschema #1]/items/displayName` to the response with the `200` status
  - added the optional property `stewardship/stewards/oneOf[subschema #1]/items/username` to the response with the `200` status
- …earlier changes not shown

[Full history](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-packages-stewardship/changes/packages/detail/get.md)

---

[API](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-packages-stewardship.md) · [All operations](https://skmtc.dev/linuxfoundation/apis/cdp-public-api-packages-stewardship/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/linuxfoundation/cdp-public-api-packages-stewardship/revisions/36d7585ff64c/schema)