---
title: "POST /v1/{+parent}/scans:analyzePackages"
method: POST
path: "/v1/{+parent}/scans:analyzePackages"
tags: ["projects"]
---

# POST /v1/{+parent}/scans:analyzePackages

`POST /v1/{+parent}/scans:analyzePackages`

Initiates an analysis of the provided packages.

## Path parameters

- `parent` string, required

## Request body

- AnalyzePackagesRequestV1 — AnalyzePackagesRequest is the request to analyze a list of packages and create Vulnerability Occurrences for it.
  - `includeOsvData` boolean — [DEPRECATED] Whether to include OSV data in the scan. For backwards compatibility reasons, this field can be neither removed nor renamed.
  - `packages` PackageData[] — The packages to analyze.
    - `version` string — The version of the package being analysed
    - `packageType` 'PACKAGE_TYPE_UNSPECIFIED' | 'OS' | 'MAVEN' | 'GO' | 'GO_STDLIB' | 'PYPI' | 'NPM' | 'NUGET' | 'RUBYGEMS' | 'RUST' | 'COMPOSER' | 'SWIFT' — The type of package: os, maven, go, etc.
    - `layerDetails` LayerDetails — Details about the layer a package was found in.
      - `command` string — The layer build command that was used to build the layer. This may not be found in all layers depending on how the container image is built.
      - `diffId` string — The diff ID (sha256 hash) of the layer in the container image.
      - `index` integer — The index of the layer in the container image.
      - `baseImages` BaseImage[] — The base images the layer is found within.
        - `layerCount` integer — The number of layers that the base image is composed of.
        - `name` string — The name of the base image.
        - `repository` string — The repository name in which the base image is from.
        - `registry` string — The registry in which the base image is from.
      - `chainId` string — The layer chain ID (sha256 hash) of the layer in the container image. https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
    - `fileLocation` FileLocation[] — The path to the jar file / go binary file.
      - `layerDetails` LayerDetails — Details about the layer a package was found in.
        - `command` string — The layer build command that was used to build the layer. This may not be found in all layers depending on how the container image is built.
        - `diffId` string — The diff ID (sha256 hash) of the layer in the container image.
        - `index` integer — The index of the layer in the container image.
        - `baseImages` BaseImage[] — The base images the layer is found within.
          - `layerCount` integer — The number of layers that the base image is composed of.
          - `name` string — The name of the base image.
          - `repository` string — The repository name in which the base image is from.
          - `registry` string — The registry in which the base image is from.
        - `chainId` string — The layer chain ID (sha256 hash) of the layer in the container image. https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
      - `lineNumber` integer — Line number in the file where the package is found. Applies only to source repository scanning. Note: this field is marked as `optional` in other corresponding protos, but in edition 2023, the "optional" keyword is redundant.
      - `filePath` string — For jars that are contained inside .war files, this filepath can indicate the path to war file combined with the path to jar file.
    - `os` string — The OS affected by a vulnerability Used to generate the cpe_uri for OS packages
    - `maintainer` Maintainer
      - `kind` string
      - `url` string
      - `name` string
      - `email` string
    - `binarySourceInfo` BinarySourceInfo[] — A bundle containing the binary and source information.
      - `binaryVersion` PackageVersion
        - `version` string
        - `licenses` string[] — The licenses associated with this package. Note that this has to go on the PackageVersion level, because we can have cases with images with the same source having different licences. E.g. in Alpine, musl and musl-utils both have the same origin musl, but have different sets of licenses.
        - `name` string
      - `sourceVersion` PackageVersion
        - `version` string
        - `licenses` string[] — The licenses associated with this package. Note that this has to go on the PackageVersion level, because we can have cases with images with the same source having different licences. E.g. in Alpine, musl and musl-utils both have the same origin musl, but have different sets of licenses.
        - `name` string
    - `licenses` string[] — The list of licenses found that are related to a given package. Note that licenses may also be stored on the BinarySourceInfo. If there is no BinarySourceInfo (because there's no concept of source vs binary), then it will be stored here, while if there are BinarySourceInfos, it will be stored there, as one source can have multiple binaries with different licenses.
    - `cpeUri` string — The cpe_uri in [cpe format] (https://cpe.mitre.org/specification/) in which the vulnerability may manifest. Examples include distro or storage location for vulnerable jar.
    - `ingestionSources` IngestionSource[] — The list of sources that were scanned to find this package. This can be a Docker image, an SBOM attachment, or both, for example.
      - `source` 'SOURCE_UNSPECIFIED' | 'DOCKER_IMAGE' | 'SBOM_ATTACHMENT'
      - `attachmentUri` string — The attachment URI that this package was extracted from.
      - `resourceUrl` string — The resource URL of the resource that was scanned to find this package.
    - `sourceVersion` PackageVersion
      - `version` string
      - `licenses` string[] — The licenses associated with this package. Note that this has to go on the PackageVersion level, because we can have cases with images with the same source having different licences. E.g. in Alpine, musl and musl-utils both have the same origin musl, but have different sets of licenses.
      - `name` string
    - `architecture` string — The architecture of the package.
    - `unused` string
    - `package` string — The package being analysed for vulnerabilities
    - `hashDigest` string — HashDigest stores the SHA512 hash digest of the jar file if the package is of type Maven. This field will be unset for non Maven packages.
    - `dependencyChain` LanguagePackageDependency[] — The dependency chain between this package and the user's artifact. List in order from the customer's package under review first, to the current package last. Inclusive of the original package and the current package.
      - `package` string
      - `version` string
    - `osVersion` string — The version of the OS Used to generate the cpe_uri for OS packages
    - `patchedCve` string[] — CVEs that this package is no longer vulnerable to
    - `binaryVersion` PackageVersion
      - `version` string
      - `licenses` string[] — The licenses associated with this package. Note that this has to go on the PackageVersion level, because we can have cases with images with the same source having different licences. E.g. in Alpine, musl and musl-utils both have the same origin musl, but have different sets of licenses.
      - `name` string
  - `resourceUri` string — Required. The resource URI of the container image being scanned.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/ondemandscanning.md) · [All operations](https://skmtc.net/google/apis/ondemandscanning/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/ondemandscanning/revisions/f02a9365c606/schema)