---
title: "Cross-repo blast radius for an exact package version"
method: POST
path: "/api/v1/sca/packages/blast-radius"
tags: ["SCA"]
---

# Cross-repo blast radius for an exact package version

`POST /api/v1/sca/packages/blast-radius`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v1/sca/packages/blast-radius`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Given an exact package@version (name, version, ecosystem), return the DISTINCT repos the caller can access that consume it, and the manifests through which they consume it. Org-scoped: usage in repos outside the caller’s organization is never returned.

## Request body

- GetScaPackageBlastRadiusInput
  - `organizationId` string, required
  - `name` string, required: Exact package name
  - `version` string, required: Exact package version
  - `ecosystem` string, required: Package ecosystem (npm, maven, pypi, ...)

## Response `200`

Successful response

- ScaPackageBlastRadiusResponse
  - `repos` ScaPackageBlastRadiusRepo[], required: DISTINCT accessible repos consuming the exact package@version. Honest empty when none — never a fabricated count.
    - `repositoryId` string, required
    - `repositoryName` string, required
    - `manifestPaths` string[], required: Distinct manifests in this repo through which the package is consumed

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api-2.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api-2/revisions/ea6ae4b68cd3?raw)