--- title: "UpdatePackageLicense" method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/package-licenses" tags: ["PackageLicenseService"] --- # UpdatePackageLicense `PATCH /v1/namespaces/{object.tenant_meta.namespace}/package-licenses` Updates the package license. ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - PackageLicenseServiceUpdatePackageLicenseBody — Request to update a package license. - `object` object - `context` V1Context — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageLicenseSpec - `all_licenses` V1PackageLicenseInfo[] — All the licenses found by Endor Labs. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `code_licenses` V1PackageLicenseInfo[] — The discovered licenses found in the source code. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `copyrights` object — The map of copyright notices per file name found in source files. The key is the file name and the value is the copyright notice texts combined together into a single string. - `declared_code_licenses` V1PackageLicenseInfo[] — The declared licenses found in the source code. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `license_text` object — Map of sha256 to license text. - `package_manager_licenses` V1PackageLicenseInfo[] — The licenses from the package manager. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `project_uuid` string — UUID of the project that the package license relates to. - `version` V1Version - `metadata` object — Version metadata. - `ref` string, required — Resolved ref of the source control version. Can be a tag, a branch or a SHA. - `sha` string — SHA of the source control version. Because the SHA might not be possible to resolved this field is optional. - `tenant_meta` object — The tenant metadata of the package license. - `uuid` string — The UUID of the package license. - `request` V1UpdateRequest — Message used for all update requests. - `force` boolean — Force will force the update of the resource if any checks fail. - `update_mask` string — Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1PackageLicense - `context` V1Context, required — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageLicenseSpec, required - `all_licenses` V1PackageLicenseInfo[] — All the licenses found by Endor Labs. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `code_licenses` V1PackageLicenseInfo[] — The discovered licenses found in the source code. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `copyrights` object — The map of copyright notices per file name found in source files. The key is the file name and the value is the copyright notice texts combined together into a single string. - `declared_code_licenses` V1PackageLicenseInfo[] — The declared licenses found in the source code. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `license_text` object — Map of sha256 to license text. - `package_manager_licenses` V1PackageLicenseInfo[] — The licenses from the package manager. - `additional_files` object — Other files that contain the same license, mapped to line number. - `confidence` number, float — The confidence in the license match. - `copyrights` string[] — Copyrights within the license text. - `file_location` integer — The line in the file where the license text begins. - `file_name` string — The name of the file where the license was found. - `hash` string — Hash should only be set if matched_text is empty. - `license_description` string, required — Raw license description as found, for example in package managers. It is free form text that may not contain a valid SPDX ID. - `llm` string — The LLM used to identify the license, if applicable. If no LLM was used, then this will be empty. - `mapping_info` PackageLicenseInfoLicenseInfoMapping — Additional context about the raw license description. - `confidence` number, float — Confidence level of the mapping. - `mapping_info` 'LICENSE_MAPPING_INFO_UNSPECIFIED' | 'LICENSE_MAPPING_INFO_NOT_OSS' | 'LICENSE_MAPPING_INFO_IN_CODE' | 'LICENSE_MAPPING_INFO_UNKNOWN' | 'LICENSE_MAPPING_INFO_NOT_INCOMPLETE' | 'LICENSE_MAPPING_INFO_PRIVATE' | 'LICENSE_MAPPING_INFO_EXACT' | 'LICENSE_MAPPING_INFO_UNLICENSED' — LicenseMappingInfo contains additional information that we determine when we attempt to match a license string to a known SPDX id. - LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license. - LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code. - LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license. - LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough. - LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package. - LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id. - LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license. - `notes` string — Additional notes about the mapping. - `source` string — Source of the license mapping information. - `matched_text` string — The license text that was matched. - `notices_file` boolean — True if it is a notices file identified by name. - `spdx_expr` string — SPDX expression for the license. - `spdx_id` string — Normalized SPDX id if known. - `type` string — License classification (based on licenseclassifier by Google). - `url` string — The URL that points to the license description. - `project_uuid` string — UUID of the project that the package license relates to. - `version` V1Version - `metadata` object — Version metadata. - `ref` string, required — Resolved ref of the source control version. Can be a tag, a branch or a SHA. - `sha` string — SHA of the source control version. Because the SHA might not be possible to resolved this field is optional. - `tenant_meta` V1TenantMeta, required — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package license. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)