---
title: "List dependencies"
method: POST
path: "/api/sca/deployments/{deploymentId}/dependencies"
tags: ["SupplyChain2Service"]
---

# List dependencies

`POST /api/sca/deployments/{deploymentId}/dependencies`

Returns all (or filtered) dependencies for a deployment using pagination

## Path parameters

- `deploymentId` string, int64, required — Deployment ID (numeric). Example: `123`. Can be found at `/deployments`, or in your Settings in the web UI.

## Request body

- ProtosScaV1ListDependenciesRequest
  - `deploymentId` string, int64 — Deployment ID (numeric). Example: `123`. Can be found at `/deployments`, or in your Settings in the web UI.
  - `dependencyFilter` ProtosScaV1DependencyFilter — Object to provide dependency details to filter by.
    - `name` string — Deprecated - use package_filters instead. Filter by dependency name (e.g. lodash).
    - `version` string — Deprecated - use package_filters instead. Filter by dependency version (e.g. 1.0.1).
    - `repositoryId` integer[] — Repository IDs (numeric) to filter by. Omit if the endpoint has Repository ID as a path parameter. Use Projects endpoints to retrieve Repository IDs.
    - `transitivity` string[] — Filter by transitivity. | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
    - `ecosystem` string[] — Filter by ecosystem (e.g. npm, pypi, etc). | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
    - `lockfilePath` string — Filter by path to the lockfile (e.g. `foo/bar/package-lock.json`).
    - `licensePolicySettings` string[] — Filter by license policy setting outcome. | value | description | |-------|---------------| | LICENSE_POLICY_SETTING_ALLOW | | | LICENSE_POLICY_SETTING_COMMENT | | | LICENSE_POLICY_SETTING_BLOCK | |
    - `license` string[] — Filter by license (e.g. MIT).
    - `packageFilters` ProtosScaV1PackageFilter[] — Multiple package filters with exact name matching and version bounds.
      - `name` string — Exact package name (e.g. lodash).
      - `versionLowerBound` string — Lower bound version constraint (e.g. ">=1.0.0"). Ignored if exact_version is set.
      - `versionUpperBound` string — Upper bound version constraint (e.g. "<2.0.0"). Ignored if exact_version is set.
      - `exactVersion` string — Exact version match (e.g. "1.0.0"). Takes precedence over version bounds if set.
      - `exactNameMatch` boolean — When true, name must match exactly. When false (default), name is fuzzy-matched (contains).
  - `cursor` string, int64 — Cursor to paginate through the dependencies. Provide a cursor value from the response to retrieve the next page.
  - `pageSize` integer — Number of dependencies per page.

## Response `200`

OK

- ProtosScaV1ListDependenciesResponse
  - `dependencies` ProtosScaV1FoundDependency[], required — List of dependencies.
    - `repositoryId` string — ID of repository dependency is found in.
    - `definedAt` ProtosScaV1CodeLocation — Specific location in a file.
      - `path` string — Path to a file.
      - `startLine` string — Starting line number (1 indexed).
      - `startCol` string — Starting column number (1 indexed).
      - `endLine` string — Ending line number (1 indexed).
      - `endCol` string — Ending column number (1 indexed).
      - `url` string — URL to code location if available, otherwise empty.
      - `committedAt` string, date-time — Timestamp when code file was last modified, if available.
    - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — Whether dependency is direct or transitive. | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
    - `package` ProtosScaV1Dependency — A specific dependency.
      - `name` string — String identifier of dependency
      - `versionSpecifier` string — Version specifier of dependency.
    - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — The ecosystem the dependency is in (e.g. pypi, npm, etc). | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
    - `licenses` string[] — Licenses the dependency is using.
    - `manifestDefinition` ProtosScaV1CodeLocation — Specific location in a file.
      - `path` string — Path to a file.
      - `startLine` string — Starting line number (1 indexed).
      - `startCol` string — Starting column number (1 indexed).
      - `endLine` string — Ending line number (1 indexed).
      - `endCol` string — Ending column number (1 indexed).
      - `url` string — URL to code location if available, otherwise empty.
      - `committedAt` string, date-time — Timestamp when code file was last modified, if available.
    - `resolvedUrl` string — The resolved URL of the dependency. Could point to a compressed source code directory (e.g. tarball), source code repository, or a package manager cache directory. May be empty if the package manager doesn't supply a URL.
  - `hasMore` boolean — True if there are more dependencies to get.
  - `cursor` string, int64 — Pass to next request to get next page of results.

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/revisions/6483eeecd582/schema)