--- title: "CreatePackageLicenseQuery" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/queries/package-license-queries" tags: ["PackageLicenseQueryService"] --- # CreatePackageLicenseQuery `POST /v1/namespaces/{tenant_meta.namespace}/queries/package-license-queries` Creates a query to fetch merged license data (PackageLicense + PackageLicenseOverride) for a package version from all the namespaces in the namespace chain. This is the primary API for the Edit Dependency UI page. The response combines: - Original licenses/copyrights/notices from PackageLicense (fetched from OSS namespace). - Any overrides from PackageLicenseOverride (fetched from user namespace). - Selection states for each item (defaults to selected if not in selection map). ## Path parameters - `tenant_meta.namespace` string, required ## Request body - PackageLicenseQueryServiceCreatePackageLicenseQueryBody — PackageLicenseQuery represents the merged result of PackageLicense + PackageLicenseOverride. This response combines original license data from PackageLicense with any overrides and selection states from PackageLicenseOverride across all namespaces in the namespace chain, providing a complete view for the UI. - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageLicenseQuerySpec - `applied_overrides` PackageLicenseQueryAppliedOverride[] - `namespace` string — Namespace where the contributing override resides. - `override_uuid` string — UUID of the contributing PackageLicenseOverride in that namespace. - `copyrights` PackageLicenseQueryMergedCopyrightEntry[] — Merged copyright entries (combines original + overrides). Each entry includes the copyright text, selection state, and edit status. - `copyright_text` string — The copyright text (from override if edited, otherwise from original). This is the actual copyright text that will be used. - `file_locations` V1LicenseFileLocation[] — File locations where the copyright was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier/key for this copyright (file path from PackageLicense.spec.copyrights map or generated UUID for new copyrights). This identifier is used as the key in copyright_overrides and deselected_copyrights maps. For copyrights from PackageLicense: uses the file path key from PackageLicense.spec.copyrights map. For new copyrights added by user: uses generated UUID prefixed with "new-". To determine if a copyright is new: check if identifier starts with "new-" or does not exist in original PackageLicense. - `is_edited` boolean — Whether this copyright has been edited/overridden. true = copyright text has been modified from original, false = using original copyright text. Can be derived by checking if identifier exists in copyright_overrides map. - `resolved_namespace` string — Origin of the effective value for this entry. - `resolved_override_uuid` string - `selected` boolean — Whether this copyright is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_copyrights map. - `licenses` PackageLicenseQueryMergedLicenseEntry[] — Merged license entries (combines original + overrides). Each entry includes the license data, selection state, and edit status. - `file_locations` V1LicenseFileLocation[] — File locations where the license was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier for this license (hash calculated from normalized license text). This identifier is used as the key in license_overrides and deselected_licenses maps. For licenses from PackageLicense: uses PackageLicenseInfo.hash. For new licenses added by user: hash is calculated from license_text using SHA256(MakeLicenseKey(normalized_text)). To determine if a license is new: check if identifier does not exist in original PackageLicense. - `is_edited` boolean — Whether this license has been edited/overridden. true = license text has been modified from original, false = using original license text. Can be derived by checking if identifier exists in license_overrides map. - `license_text` string — Effective license text resolved after applying propagation across the namespace chain. - `resolved_namespace` string — Origin of the effective value for this entry. If no override is applied, resolved_namespace will typically be "oss" and resolved_override_uuid will be empty. - `resolved_override_uuid` string - `selected` boolean — Whether this license is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_licenses map. - `source` string — Source of the original license (e.g., "code", "package_manager", "declared"). Helps identify which category the license belongs to. - `spdx_expr` string — SPDX expression for the license. - `notices` PackageLicenseQueryMergedNoticeEntry[] — Merged notice entries (combines original + overrides). Each entry includes the notice text, selection state, and edit status. - `file_locations` V1LicenseFileLocation[] — File locations where the notice was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier for this notice (hash calculated from normalized notice text, or generated UUID for new notices). This identifier is used as the key in notice_overrides and deselected_notices maps. For notices from PackageLicense: uses hash or composite identifier from original. For new notices added by user: hash is calculated from notices_text using SHA256(MakeLicenseKey(normalized_text)). To determine if a notice is new: check if identifier does not exist in original PackageLicense. - `is_edited` boolean — Whether this notice has been edited/overridden. true = notice text has been modified from original, false = using original notice text. Can be derived by checking if identifier exists in notice_overrides map. - `notices_text` string — The notice text (from override if edited, otherwise from original). This is the actual notice text that will be used. - `resolved_namespace` string — Origin of the effective value for this entry. - `resolved_override_uuid` string - `selected` boolean — Whether this notice is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_notices map. - `package_license_name` string — Name of the base PackageLicense to use. If not given, then we use package_version_uuid. - `package_version_uuid` string, required — UUID of the package version this data is for. - `tenant_meta` object - `uuid` string — The uuid of the resource. ## Response `200` A successful response. - V1PackageLicenseQuery — PackageLicenseQuery represents the merged result of PackageLicense + PackageLicenseOverride. This response combines original license data from PackageLicense with any overrides and selection states from PackageLicenseOverride across all namespaces in the namespace chain, providing a complete view for the UI. - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageLicenseQuerySpec - `applied_overrides` PackageLicenseQueryAppliedOverride[] - `namespace` string — Namespace where the contributing override resides. - `override_uuid` string — UUID of the contributing PackageLicenseOverride in that namespace. - `copyrights` PackageLicenseQueryMergedCopyrightEntry[] — Merged copyright entries (combines original + overrides). Each entry includes the copyright text, selection state, and edit status. - `copyright_text` string — The copyright text (from override if edited, otherwise from original). This is the actual copyright text that will be used. - `file_locations` V1LicenseFileLocation[] — File locations where the copyright was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier/key for this copyright (file path from PackageLicense.spec.copyrights map or generated UUID for new copyrights). This identifier is used as the key in copyright_overrides and deselected_copyrights maps. For copyrights from PackageLicense: uses the file path key from PackageLicense.spec.copyrights map. For new copyrights added by user: uses generated UUID prefixed with "new-". To determine if a copyright is new: check if identifier starts with "new-" or does not exist in original PackageLicense. - `is_edited` boolean — Whether this copyright has been edited/overridden. true = copyright text has been modified from original, false = using original copyright text. Can be derived by checking if identifier exists in copyright_overrides map. - `resolved_namespace` string — Origin of the effective value for this entry. - `resolved_override_uuid` string - `selected` boolean — Whether this copyright is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_copyrights map. - `licenses` PackageLicenseQueryMergedLicenseEntry[] — Merged license entries (combines original + overrides). Each entry includes the license data, selection state, and edit status. - `file_locations` V1LicenseFileLocation[] — File locations where the license was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier for this license (hash calculated from normalized license text). This identifier is used as the key in license_overrides and deselected_licenses maps. For licenses from PackageLicense: uses PackageLicenseInfo.hash. For new licenses added by user: hash is calculated from license_text using SHA256(MakeLicenseKey(normalized_text)). To determine if a license is new: check if identifier does not exist in original PackageLicense. - `is_edited` boolean — Whether this license has been edited/overridden. true = license text has been modified from original, false = using original license text. Can be derived by checking if identifier exists in license_overrides map. - `license_text` string — Effective license text resolved after applying propagation across the namespace chain. - `resolved_namespace` string — Origin of the effective value for this entry. If no override is applied, resolved_namespace will typically be "oss" and resolved_override_uuid will be empty. - `resolved_override_uuid` string - `selected` boolean — Whether this license is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_licenses map. - `source` string — Source of the original license (e.g., "code", "package_manager", "declared"). Helps identify which category the license belongs to. - `spdx_expr` string — SPDX expression for the license. - `notices` PackageLicenseQueryMergedNoticeEntry[] — Merged notice entries (combines original + overrides). Each entry includes the notice text, selection state, and edit status. - `file_locations` V1LicenseFileLocation[] — File locations where the notice was found (from override if edited, otherwise from original). - `end_byte` integer — The end byte of the license/copyright/notice in the file. - `end_line` integer — The end line of the license/copyright/notice in the file. - `relative_path` string — The relative path to the file where the license/copyright/notice was found. - `start_byte` integer — The start byte of the license/copyright/notice in the file. - `start_line` integer — The start line of the license/copyright/notice in the file. - `identifier` string — Stable identifier for this notice (hash calculated from normalized notice text, or generated UUID for new notices). This identifier is used as the key in notice_overrides and deselected_notices maps. For notices from PackageLicense: uses hash or composite identifier from original. For new notices added by user: hash is calculated from notices_text using SHA256(MakeLicenseKey(normalized_text)). To determine if a notice is new: check if identifier does not exist in original PackageLicense. - `is_edited` boolean — Whether this notice has been edited/overridden. true = notice text has been modified from original, false = using original notice text. Can be derived by checking if identifier exists in notice_overrides map. - `notices_text` string — The notice text (from override if edited, otherwise from original). This is the actual notice text that will be used. - `resolved_namespace` string — Origin of the effective value for this entry. - `resolved_override_uuid` string - `selected` boolean — Whether this notice is selected for inclusion in notice file. true = selected (will be included), false = deselected (will be excluded). Defaults to true if not present in deselected_notices map. - `package_license_name` string — Name of the base PackageLicense to use. If not given, then we use package_version_uuid. - `package_version_uuid` string, required — UUID of the package version this data is for. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The uuid of the resource. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)