--- title: "ListDependencyMetadata" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/dependency-metadata" tags: ["DependencyMetadataService"] --- # ListDependencyMetadata `GET /v1/namespaces/{tenant_meta.namespace}/dependency-metadata` List dependency metadata objects based on the specified list parameters. ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListDependencyMetadataResponse — Response returned for requests to list dependency metadata objects. - `count_response` V1CountResponse — Response to a list count request. - `count` integer — Number of objects matching the given list parameters. - `group_response` V1GroupResponse — Response to a list group request. - `groups` object — Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListDependencyMetadataResponseList - `objects` V1DependencyMetadata[] - `context` V1Context, required — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1DependencyMetadataSpec, required — DependencyMetadata specific data. - `dependency_data` DependencyMetadataDependencyData — Information about the dependency. - `abstract` boolean — True if the dependency is an abstract dependency, such as a secondary Pom file. - `approximation` boolean — True if this is an approximate dependency based on unresolved package dependencies. - `callgraph_available` boolean — True if the call graph is available. - `container_data` V1ContainerDependencyMetadata - `first_reachable_time` string, date-time — First time this dependency was determined to be reachable in an application image. - `last_reachable_time` string, date-time — Most recent time this dependency was determined to be reachable in an application image. - `layers` V1ContainerLayerMetadata[] — Layers of the container image where a dependency is found. This is an optional field. It is only set when target dependency is found via container image scan. - … - `reachable_count` string, uint64 — Number of times this dependency was determined to be reachable in an application image. This number is used for trending and it's not meant for exact usage tracking. - `runtime_files` string[] — Files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when the dependency is found to be used at runtime in the container image. - `user_application_dependency` boolean — Set to true if this is a user application dependency. - `declared_licenses` V1LicenseDependencyMetadata[] — Declared license information for the dependency. - `category` string — License category (e.g. "Restricted"). - `spdx_id` string — SPDX license identifier (e.g. "Apache-2.0"). - `type` string — License classification (based on licenseclassifier by Google). - `direct` boolean, required — True if this is a direct dependency. - `discovered_licenses` V1LicenseDependencyMetadata[] — Discovered license information for the dependency. - `category` string — License category (e.g. "Restricted"). - `spdx_id` string — SPDX license identifier (e.g. "Apache-2.0"). - `type` string — License classification (based on licenseclassifier by Google). - `discovery_type` 'DISCOVERY_TYPE_UNSPECIFIED' | 'DISCOVERY_TYPE_MANIFEST' | 'DISCOVERY_TYPE_PHANTOM' | 'DISCOVERY_TYPE_SEGMENT_MATCH' — - DISCOVERY_TYPE_MANIFEST: Dependency was discovered through a manifest file. - DISCOVERY_TYPE_PHANTOM: Dependency was discovered through phantom dependency / imported dependency analysis. - DISCOVERY_TYPE_SEGMENT_MATCH: Dependency was discovered via code segment match. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE' — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `eol` boolean — Indicates whether the dependency is end of life. - `eol_timestamp` string, date-time — End of life timestamp for the dependency package version. - `internal` boolean — True if the dependency is in the same namespace or, if the namespace is oss, in the same project as the importer. - `last_commit` string, date-time — Date that the dependency was last modified. - `missing` boolean — True if the package version is missing for this dependency. - `namespace` string — Namespace to which the dependency package version object belongs. - `orphan` boolean — Deprecated. - `package_name` string — Qualified dependency package name. Does not include the version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_uuid` string — the UUID of the dependency package version object. - `parent_count` integer — Total number of direct parents in dependency graph. - `parent_version_name` string — Fully qualified name of the direct parent of the dependency. For example, go://package@v1.2.3. - `patched` boolean — Indicates whether the dependency version was patched or not. - `pinned` boolean — True if the dependency is pinned. - `project_paths` V1DependencyMetadataPath[] — List of all project paths to this dependency from the root package version (importer). - `nodes` string[] — List of nodes in a dependency path. - `project_uuid` string — The UUID of the project to which the dependency belongs. - `public` boolean — True if the dependency is public. - `purl` string — The purl for the dependency package version. - `reachable` 'REACHABILITY_TYPE_UNSPECIFIED' | 'REACHABILITY_TYPE_REACHABLE' | 'REACHABILITY_TYPE_UNREACHABLE' | 'REACHABILITY_TYPE_UNKNOWN' — - REACHABILITY_TYPE_REACHABLE: Call graph analysis determined that the dependency is likely reachable. - REACHABILITY_TYPE_UNREACHABLE: Call graph analysis determined that the dependency is likely not reachable. - REACHABILITY_TYPE_UNKNOWN: Not enough information to perform reachability analysis. - `repo_name` string — Name of the repository to which the dependency belongs. - `resolved_version` string — Resolved dependency package version. For example, "v2.0.0". - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `unresolved_version` string — Unresolved dependency package version string. For example, "v2.0.0". - `utilization` number, float — Percent of the dependency used based on the call graph. Implementation pending. - `vendored` boolean — True if the dependency is a vendored dependency. - `importer_data` DependencyMetadataImporterData — Information about the root package version (importer), that imports the dependency in one or more versions, either directly or indirectly. - `callgraph_available` boolean, required — True if the call graph is available for the root package version. - `container_base_image` V1ContainerBaseImage — The base image of a container Image. - `chain_id` string — Chain ID for the base image's layers. - `digest` string — The SHA256 digest of the base image. - `name` string — The name of the base image. For example, "debian:bookworm-slim". - `package_version_uuid` string — The UUID of the base image's own PackageVersion, if it has been scanned. Populated by the scanner from the in-memory base image lookup at scan time; consumers that need this after the fact and find it unset may fall back to a digest-based PackageVersion lookup. - `update_options` V1ContainerImageUpdateOptions — ContainerImageUpdateOptions groups possible base image update candidates. - … - `package_name` string, required — Qualified package name of the root package version. For example, for go://package@v1.2.3 this is set to "go://package". - `package_version_name` string, required — Fully qualified name of the root package version. For example, go://package@v1.2.3. - `package_version_ref` string, required — Resolved ref of the source control version for the root package version. Can be a tag, a branch or a SHA. - `package_version_sha` string — SHA of the source control version for the root package version. Because the SHA might not be possible to resolved, this field is optional. - `package_version_uuid` string, required — The UUID of the importer package version object. This is the same as the parent UUID of this object (meta.parent_uuid). - `project_uuid` string, required — The UUID of the project to which the root package belongs. - `version_name` string — Version number of the root package version. For example, for go://package@v1.2.3 this is set to "v1.2.3". - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the object. - `response` V1ListResponse — Response to a list request. - `next_page_id` string — The UUID of last message retrieved. - `next_page_token` integer — Pagination token that can be used to retrieve the next page of results. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)