---
title: "Show details of a set of packages."
method: POST
path: "/v1/packages/lookup"
tags: ["Packages"]
---

# Show details of a set of packages.

`POST /v1/packages/lookup`

Show details of a set of packages

## Request body

- union
  - object
    - `packages` Package[], required — The packages being looked up
      - `platform` string, required
      - `name` string, required
  - object
    - `purls` string[], required — Array of properly formatted PURLs

## Response `200`

Details of packages found from the search and any package names that had no results.

- object
  - `packages` PackageDetail[], required
    - `platform` string, required — The package manager platform, all lowercase.
    - `name` string, required — The canonical name of the package (may be adjusted for casing or hyphen vs underscore for example)
    - `purl` string, required — An identifier for the package following the [package URL (purl) specification](https://github.com/package-url/purl-spec)
    - `description` string, nullable, required — Package description taken from the upstream package manager data
    - `tidelift_recommendation` 'recommended' | 'not_recommended' | 'caution_advised' | 'neutral' | 'not_assessed', nullable, required
    - `tidelift_recommendation_reasons` string[]
    - `alternative_packages` object[], required — List of alternative packages that could be used in place of this package
      - `name` string, required — Name of the other package
      - `type` 'rename' | 'alternative', required — How the alternative package relates to the original package
    - `last_changed_on` string, date, nullable, required — When the package record last was updated by new information
    - `security_policy_url` string, nullable, required — If available, a url for the package's upstream security reporting policy
    - `versioning_scheme` 'maven' | 'pep440' | 'osgi' | 'semver' | 'calver' | 'other', required — The version numbering rules that the package intends to use; Tidelift may add new possible values for this field over time
    - `contributors_count` integer, nullable, required — Number of contributors to the upstream source repository, if available
    - `package_manager_url` string, nullable — Link to this package on the package manager website
    - `sdlc_policy` string, nullable, required — If available, a URL where the project explains its software development lifecycle policy (for example, which release streams are still receiving security updates)
    - `sdlc_evidence` string, nullable, required — If available, a URL that may help figure out the project's software development lifecycle policies
    - `repository` object, required — The source code repository where the package is maintained
      - `url` string, nullable, required
      - `source` 'human_verified' | 'package_manager', required
    - `repository_statistics` object, nullable, required — Statistics about the package's source code repository that can be used to assess upstream activity and maintenance
      - `last_52_weeks_contributors` integer, nullable, required — Number of distinct contributors in the past year
      - `last_commit_at` string, date, nullable, required — Date of the last commit
      - `one_year_closed_pull_requests` integer, nullable, required — How many pull requests have been closed in the past year
      - `one_year_total_pull_requests` integer, nullable, required — How many pull requests were opened in the last year
      - `one_year_closed_issues` integer, nullable, required — How many issues have been closed in the last year
      - `one_year_total_issues` integer, nullable, required — How many issues were opened in the last year
      - `status` 'Active' | 'Unmaintained' | 'Removed', required — Source repositories may be active, archived (Unmaintained), or deleted (Removed); Tidelift may add other statuses in the future
    - `license` object, required
      - `expression` string, nullable, required — An [SPDX expression](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/)
      - `source` 'corrected_by_tidelift' | 'researched_by_tidelift' | 'valid_spdx' | 'tidelift_researching' | 'overridden_by_organization' | 'verified_by_maintainer' | 'unknown', nullable, required — The source of the license information, if the license is known.
    - `latest_release` object, required — The latest release of the package according to version number sort (NOT according to time, for example a security update for an old release stream cannot be the latest even if it was the most recently published)
      - `version` string, nullable, required
      - `published_at` string, date-time, nullable, required
    - `latest_stable_release` object, required — The latest release of the package according to version number sort, which is not a prerelease version (excludes betas, release candidates, etc.)
      - `version` string, nullable, required
      - `published_at` string, date-time, nullable, required
    - `latest_recommended_release` object, required — The latest release of the package ignoring releases with known problems
      - `version` string, nullable, required
      - `published_at` string, date-time, nullable, required
    - `is_lifted` boolean, required — Whether Tidelift partners with the maintainers of this package
    - `releases` object[], required — An array of all known public releases of the package
      - `version` string, required — The release's name
      - `published_at` string, date-time, nullable, required — Time that the release was published to the package manager
      - `tidelift_recommendation` 'recommended' | 'not_recommended' | 'not_assessed', nullable, required
    - `openssf_scorecard` object, nullable, required — The latest [OpenSSF Scorecard](https://github.com/ossf/scorecard) for the package, if available
      - `last_checked_at` string, date-time, required — When the scorecard was last refreshed
      - `overall` object, required
        - `score` number, float, required — Overall score for the latest scorecard
      - `checks` object[], required — Individual OpenSSF scorecard checks. See [OpenSSF Scorecard documentation](https://github.com/ossf/scorecard?tab=readme-ov-file#scorecard-checks) for details
        - `check_name` string, required — Name of the individual check
        - `score` number, float, required — Score for the individual cehck
        - `reason` string, required — Supporting information for the individual check score
    - `quality_checks` object, required — Quality checks are boolean indicators of package quality (but the boolean can be `noassertion` or `pending` if we don't have the data yet). A `pending` check is in the process of being recomputed. A `noassertion` check may be missing needed data and require manual research. (Tidelift can often help fill in `noassertion` checks, let us know what you need.)
      - `no_known_vulnerabilities_on_latest_release` object, required — A latest release should be available that clears all valid, confirmed, known vulnerabilities
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `no_known_issues_in_dependencies_for_latest_release` object, required — The transitive dependencies of the latest release should pass Tidelift's standards
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `discoverable_security_policy` object, required — The project should have a policy and process for reporting security vulnerabilities
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `two_factor_authentication_at_source_repository` object, required — The project should use two-factor authentication for everyone with access to the source code
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `two_factor_authentication_for_package_manager` object, required — The project should use two-factor authentication to publish releases
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `release_managers_are_reviewed` object, required — A Tidelift-partnered maintainer should confirm the list of people allowed to publish releases
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `package_is_not_deprecated` object, required — The package should not be deprecated
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `package_appears_maintained` PackageAppearsMaintainedQualityCheck, required — The project lacks auto-detectable evidence of recent activity
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` union, required
          - PackageAppearsMaintainedAdditionalDataMaintenanceAppearance
            - `reason` 'package_appears_maintained' | 'package_appears_unmaintained', required — Tidelift checks upstream source repository and release activity to determine maintenace activity for the package. If the source repository has been marked archived or unmaintained, it fails this check. Otherwise, Tidelift considers a package to appear unmaintained if all of the following are `false`: `contributors_in_past_year` `frequent_package_activity`, `recent_commits`, and `recent_latest_release`.
            - `contributors_in_past_year` boolean, nullable, required — Whether there has been any contributors to the package's source repository in the past year.
            - `contributors_in_past_year_count` number, nullable, required — How many contributors there were to the package's source repository in the past year.
            - `frequent_package_activity` boolean, nullable, required — Whether at least 1/3 of issues and pull requests must have been closed in the past year.
            - `frequent_package_activity_one_year_closed_issues_count` boolean, nullable, required — Number of closed issues on the package's source repository in the past year.
            - `frequent_package_activity_one_year_total_issues_count` boolean, nullable, required — Total number of issues on the package's source repository in the past year.
            - `frequent_package_activity_one_year_closed_pull_requests_count` boolean, nullable, required — Number of closed pull requests on the package's source repository in the past year.
            - `frequent_package_activity_one_year_total_pull_requests_count` boolean, nullable, required — Total number of pull requests on the package's source repository in the past year.
            - `recent_commits` boolean, nullable, required — Whether there has been a commit to the package's source repository in the past year.
            - `recent_commits_date` string, date, nullable, required — When the package's source repository had its most recent commit.
            - `recent_latest_release` boolean, nullable, required — Whether there has been a release of the package in the past 6 months.
            - `recent_latest_release_date` string, date-time, nullable, required — When the package's most recent release was published.
            - `repository_not_marked_unmaintained` boolean, nullable, required — Whether the package's source repository been archived or otherwise marked unmaintained.
            - `repository_not_marked_unmaintained_status` string, nullable, required — The package's source repository's current maintenance status.
          - PackageAppearsMaintainedAdditionalDataMaintenanceAssessment
            - `reason` 'package_is_maintained_assessed_true' | 'package_is_maintained_assessed_false', required — Tidelift has manually assessed this package's maintenance status.
            - `is_maintained` boolean, required — The manual assessment of the package's maintenance status.
            - `is_maintained_updated_at` string, date-time, required — The time at which the package's maintenance status was manually assessed.
          - PackageAppearsMaintainedAdditionalDataIsLifted
            - `reason` 'package_is_lifted', required — Tidelift is partnering with the maintainer of this package to ensure its continued maintenance.
          - object, nullable
      - `package_has_a_stable_release_greater_than_two_years_old` object, required — The project should be "seasoned" with at least two years of stable releases
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
      - `package_has_multiple_active_maintainers` PackageHasMultipleActiveMaintainersQualityCheck, required — The package has multiple active maintainers
        - `status` 'passed' | 'not_passed', required
        - `recommendation_status` 'success' | 'warning', required
        - `additional_data` object, nullable
          - `one_maintainer` boolean, required — If the project has less than two maintainers.
          - `unmaintained` boolean, required — If the package appears unmaintained.
          - `not_enough_contributors` boolean, required — If the project has had less than two contributors in the last 52 weeks or less than five contributors overall.
          - `last_52_weeks_contributors` integer, required — The count of contributors in the last 52 weeks.
          - `contributor_count` integer, required — The total count of contributors.
      - `package_is_not_eol` PackageIsNotEOLQualityCheck, required — The project does not have an active end-of-life notification.
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, required
          - `reason` 'package_repository_is_unmaintained' | 'package_is_renamed' | 'package_has_future_end_of_life' | 'package_has_no_known_end_of_life' | 'package_is_unknown', required — The reason Tidelift has decided the package's end-of-life status.
          - `eol_reference_found` boolean, required — If Tidelift has a known end-of-life effective date from a published source.
          - `effective_on` string, date, nullable, required — The ISO 8601 formatted date at which the package will be considered end-of-life.
          - `reference_url` string, nullable, required — The URL which indicates that the package will be end-of-life.
          - `package_renamed_to` object[], required — The packages that this package was renamed to.
            - `platform` string
            - `name` string
          - `no_planned_maintenance` boolean, required — If the package's deprecation status and repository activity indicates no further updates should be expected.
      - `releases_are_discoverable_upstream` object, required — The project should have releases that are still available for download
        - `status` 'passed' | 'not_passed' | 'noassertion' | 'pending', required
        - `recommendation_status` 'success' | 'warning' | 'issue' | 'unknown', required
        - `additional_data` object, nullable, required
  - `missing_results` PackageWithHint[], required
    - `platform` string, required
    - `name` string, required
    - `hint` string

## Other responses

- `400` — Request body format incorrect or more than 1000 packages requested.
- `401` — Unauthorized
- `403` — 403 Forbidden

---

[API](https://skmtc.net/tidelift/apis/tidelift-external-api.md) · [All operations](https://skmtc.net/tidelift/apis/tidelift-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tidelift/tidelift-external-api/revisions/5f36bed372bb/schema)