Endpoints to access Dependency Graph features.
5 endpoints tagged dependency-graph, each listing its
parameters and possible responses. Search or scroll the index below to
jump to a specific endpoint.
No endpoints match your search.
GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}
Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
basehead | path | yes | The base and head Git revisions to compare. The Git revisions will be resolved to commit SHAs. Named revisions will be resolved to their corresponding HEAD commits, and an appropriate merge base will be determined. This parameter expects the format {base}...{head}. |
name | query | no | The full path, relative to the repository root, of the dependency manifest file. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 404 | Resource not found | yes |
| 403 | Response for a private repository when GitHub Advanced Security is not enabled, or if used against a fork | yes |
| 400 | Bad Request | yes |
| 500 | Internal Error | yes |
| 503 | Service unavailable | yes |
GET /repos/{owner}/{repo}/dependency-graph/sbom
Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 404 | Resource not found | yes |
| 403 | Forbidden | yes |
GET /repos/{owner}/{repo}/dependency-graph/sbom/fetch-report/{sbom_uuid}
Fetches a previously generated software bill of materials (SBOM) for a repository.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
sbom_uuid | path | yes | The unique identifier of the SBOM export. |
| Status | Description | Has JSON body |
|---|---|---|
| 302 | Redirects to a temporary download URL for the completed SBOM. | no |
| 202 | SBOM is still being processed, no content is returned. | no |
| 404 | Resource not found | yes |
| 403 | Forbidden | yes |
GET /repos/{owner}/{repo}/dependency-graph/sbom/generate-report
Triggers a job to generate a software bill of materials (SBOM) for a repository in SPDX JSON format.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 201 | Response | yes |
| 404 | Resource not found | yes |
| 403 | Forbidden | yes |
POST /repos/{owner}/{repo}/dependency-graph/snapshots
Create a new snapshot of a repository's dependencies.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 201 | Response | yes |