> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
## Submitting Feedback
If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback:
POST https://docs.endorlabs.com/feedback
```json
{
"path": "/api-reference/packagelicenseservice/listpackagelicenses",
"feedback": "Description of the issue"
}
```
Only submit feedback when you have something specific and actionable to report.
# ListPackageLicenses
> Lists all the package licenses in a given namespace.
## OpenAPI
````yaml /api-reference/openapi.v3.json get /v1/namespaces/{tenant_meta.namespace}/package-licenses
openapi: 3.0.3
info:
description: Integrate your application with Endor Labs using the REST API.
title: Endor Labs REST API Reference
version: '1.0'
servers:
- url: https://api.endorlabs.com/
security: []
tags:
- name: AISastCustomerContextService
- name: APIKeyService
- name: APIKeyValidatorService
- name: ArtifactSignatureService
- name: AuditLogService
- name: AuthenticationLogService
- name: AuthenticationService
- name: AuthorizationPolicyService
- name: BatchFileSegmentsService
- name: BatchNotificationService
- name: CallGraphDataService
- name: CodeOwnersService
- name: DependencyMetadataService
- name: EndorIgnoreEntryService
- name: ExporterService
- name: FindingLogService
- name: FindingService
- name: HuggingFaceModelService
- name: HuggingFaceOrganizationService
- name: IPAddressPolicyService
- name: IdentityProviderService
- name: InstallationService
- name: InvitationService
- name: LicenseDependencyService
- name: LicenseNoticesReportService
- name: LicenseSummaryService
- name: LinterResultService
- name: MalwareService
- name: MetricService
- name: NamespaceService
- name: NotificationService
- name: NotificationTargetService
- name: OnPremSchedulerService
- name: PRCommentConfigService
- name: PackageFirewallLogService
- name: PackageLicenseOverrideService
- name: PackageLicenseQueryService
- name: PackageLicenseService
- name: PackageManagerService
- name: PackageVersionService
- name: PluginBinaryService
- name: PolicyService
- name: PolicyTemplateService
- name: ProjectService
- name: ProvisioningResultService
- name: QueryMalwareService
- name: QueryService
- name: QuerySimilarPackagesService
- name: QueryVulnerabilityService
- name: RegistryIngestionCheckpointService
- name: RepositoryService
- name: RepositoryVersionService
- name: RuleSetImportService
- name: SBOMExportService
- name: SBOMImportService
- name: SCMCredentialService
- name: SavedQueryService
- name: ScanLogRequestService
- name: ScanProfileService
- name: ScanResultService
- name: ScanWorkflowResultService
- name: ScanWorkflowService
- name: SecretRuleService
- name: SemgrepRuleService
- name: SystemConfigService
- name: TenantService
- name: VEXExportService
- name: VectorStoreService
- name: VersionUpgradeService
- name: VulnerabilityService
paths:
/v1/namespaces/{tenant_meta.namespace}/package-licenses:
get:
tags:
- PackageLicenseService
summary: ListPackageLicenses
description: Lists all the package licenses in a given namespace.
operationId: PackageLicenseService_ListPackageLicenses
parameters:
- description: >-
Namespaces are a way to organize organizational units into virtual
groupings of resources. Namespaces must be a fully qualified name,
for example, the child namespace of namespace "endor.prod" called
"app"
is called "endor.prod.app".
in: path
name: tenant_meta.namespace
required: true
schema:
type: string
x-endor-name: Namespace
- description: >-
String of conditions to filter resources by.
Filters may include any attribute along with the following
operators:
"==", "!=", ">", ">=", "<", "<=", "Contains", "In", "Matches", and
"Exists". The logical operators "And" and "Or" are also supported.
Expressions may be combined and grouped with parentheses.
Examples:
"spec.value == 5",
"spec.value in ["a", "b", "c"]",
"(meta.name == "xyz" and "spec.value in ["a","b"]) or (spec.value ==
"c")".
in: query
name: list_parameters.filter
schema:
type: string
- description: |-
Set the page token to start from.
Use page tokens to page through list results or list specific pages.
in: query
name: list_parameters.page_token
schema:
format: int32
type: integer
- description: |-
Set the page size to limit the number of results returned.
Default: 100. Max: 500.
in: query
name: list_parameters.page_size
schema:
format: int32
type: integer
- description: >-
Action to be executed with a request. Not supported for all
endpoints.
in: query
name: list_parameters.action
schema:
type: string
- description: List of fields to return (all fields are returned by default).
in: query
name: list_parameters.mask
schema:
type: string
- description: Get data from any child namespaces as well.
in: query
name: list_parameters.traverse
schema:
type: boolean
- description: Field to sort objects by, for example, meta.name.
in: query
name: list_parameters.sort.path
schema:
type: string
- description: 'Sort order. Default: ASC.'
in: query
name: list_parameters.sort.order
schema:
default: SORT_ENTRY_ORDER_UNSPECIFIED
enum:
- SORT_ENTRY_ORDER_UNSPECIFIED
- SORT_ENTRY_ORDER_ASC
- SORT_ENTRY_ORDER_DESC
type: string
- description: |-
Return the number of objects matching the given list parameters.
If count is set to true, the response is a CountResponse.
Can be used together with filter and traverse.
in: query
name: list_parameters.count
schema:
type: boolean
- description: |-
Group the objects based on this field.
If there are multiple fields then the objects are grouped
based on the uniqueness of all fields.
Supports composite paths.
Supports arrays and maps.
in: query
name: list_parameters.group.aggregation_paths
schema:
type: string
- description: |-
Return the UUID of each object in each group as specified by
aggregation_paths.
in: query
name: list_parameters.group.show_aggregation_uuids
schema:
type: boolean
- description: |-
List of fields for which we want the unique count.
Supports arrays and maps.
in: query
name: list_parameters.group.unique_count_paths
schema:
type: string
- description: |-
List of fields for which we want the unique values.
Supports arrays and maps.
in: query
name: list_parameters.group.unique_value_paths
schema:
type: string
- description: Only return objects from PR scans that match this context id.
in: query
name: list_parameters.ci_run_uuid
schema:
type: string
- description: Page ID to retrieve.
in: query
name: list_parameters.page_id
schema:
type: string
- description: |-
Group the objects based on this time field,
for example, meta.create_time.
in: query
name: list_parameters.group_by_time.aggregation_paths
schema:
type: string
- description: Return the UUIDs of the objects in each group.
in: query
name: list_parameters.group_by_time.show_aggregation_uuids
schema:
type: boolean
- description: Interval unit by which the objects should be grouped.
in: query
name: list_parameters.group_by_time.interval
schema:
default: GROUP_BY_TIME_INTERVAL_UNSPECIFIED
enum:
- GROUP_BY_TIME_INTERVAL_UNSPECIFIED
- GROUP_BY_TIME_INTERVAL_YEAR
- GROUP_BY_TIME_INTERVAL_QUARTER
- GROUP_BY_TIME_INTERVAL_MONTH
- GROUP_BY_TIME_INTERVAL_WEEK
- GROUP_BY_TIME_INTERVAL_DAY
- GROUP_BY_TIME_INTERVAL_HOUR
- GROUP_BY_TIME_INTERVAL_MINUTE
- GROUP_BY_TIME_INTERVAL_SECOND
type: string
- description: |-
Size of the time interval to group the objects by,
for example, to group objects by 2-week intervals, set interval
to GROUP_BY_TIME_INTERVAL_WEEK and group_size to 2.
in: query
name: list_parameters.group_by_time.group_size
schema:
format: int32
type: integer
- description: |-
Beginning of the time period to group objects.
Defaults to the beginning of time.
in: query
name: list_parameters.group_by_time.start_time
schema:
format: date-time
type: string
- description: |-
End of the time period to group objects.
Defaults to the current time.
in: query
name: list_parameters.group_by_time.end_time
schema:
format: date-time
type: string
- description: >-
The mode determines how the matching objects are counted
in the produced time-series. Values allowed are:
count (default) : is the number of items matching in every interval.
sum: is the total number of items matching since the beginning of
the
aggregation time.
in: query
name: list_parameters.group_by_time.mode
schema:
type: string
- description: >-
The aggregation_field is a field on the matched objects that we want
to
perform some operation in each interval (example : min, max, avg)
in: query
name: list_parameters.group_by_time.aggregation_value_field
schema:
type: string
- description: |-
The aggreation_operator is the operator that we should use for the
aggregation. Allowed values are: min, max, sum, avg
in: query
name: list_parameters.group_by_time.aggregation_operator
schema:
type: string
- description: |-
If true, the results will not be paginated and
only the first page will be returned. The order
of the results is not guaranteed.
in: query
name: list_parameters.disable_pagination
schema:
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/v1ListPackageLicenseResponse'
description: A successful response.
default:
content:
application/json:
schema:
$ref: '#/components/schemas/googlerpcStatus'
description: An unexpected error response.
components:
schemas:
v1ListPackageLicenseResponse:
description: Response to list all the package licenses.
properties:
count_response:
$ref: '#/components/schemas/v1CountResponse'
group_response:
$ref: '#/components/schemas/v1GroupResponse'
list:
$ref: '#/components/schemas/v1ListPackageLicenseResponseList'
type: object
googlerpcStatus:
description: >-
The `Status` type defines a logical error model that is suitable for
different programming environments, including REST APIs and RPC APIs. It
is
used by [gRPC](https://github.com/grpc). Each `Status` message contains
three pieces of data: error code, error message, and error details.
You can find out more about this error model and how to work with it in
the
[API Design Guide](https://cloud.google.com/apis/design/errors).
properties:
code:
description: |-
The status code, which should be an enum value of
[google.rpc.Code][google.rpc.Code].
format: int32
type: integer
details:
description: >-
A list of messages that carry the error details. There is a common
set of
message types for APIs to use.
items:
$ref: '#/components/schemas/googleprotobufAny'
type: array
message:
description: >-
A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
[google.rpc.Status.details][google.rpc.Status.details] field, or
localized
by the client.
type: string
type: object
v1CountResponse:
description: Response to a list count request.
properties:
count:
description: Number of objects matching the given list parameters.
format: int32
type: integer
type: object
v1GroupResponse:
description: Response to a list group request.
properties:
groups:
additionalProperties:
$ref: '#/components/schemas/GroupResponseGroupData'
description: |-
Map indexed by values of the fields specified in aggregation_paths,
for example, {"[{"key":"meta.kind","value":"Project"}]": {
"aggregation_count": { "count": 1649 } } }.
type: object
type: object
v1ListPackageLicenseResponseList:
properties:
objects:
items:
$ref: '#/components/schemas/v1PackageLicense'
type: array
response:
$ref: '#/components/schemas/v1ListResponse'
type: object
googleprotobufAny:
additionalProperties: {}
description: >-
`Any` contains an arbitrary serialized protocol buffer message along
with a
URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form
of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}
Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}
Example 3: Pack and unpack a message in Python.
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...
Example 4: Pack and unpack a message in Go
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}
The pack methods provided by protobuf library will by default use
'type.googleapis.com/full.type.name' as the type URL and the unpack
methods only use the fully qualified type name after the last '/'
in the type URL, for example "foo.bar.com/x/y.z" will yield type
name "y.z".
JSON
====
The JSON representation of an `Any` value uses the regular
representation of the deserialized, embedded message, with an
additional field `@type` which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}
{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": ,
"lastName":
}
If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
`value` which holds the custom JSON in addition to the `@type`
field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}
properties:
'@type':
description: >-
A URL/resource name that uniquely identifies the type of the
serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical
form
(e.g., leading "." is not accepted).
In practice, teams usually precompile into the binary all types that
they
expect it to use in the context of Any. However, for URLs which use
the
scheme `http`, `https`, or no scheme, one can optionally set up a
type
server that maps type URLs to message definitions as follows:
* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
URL, or have them precompiled into a binary to avoid any
lookup. Therefore, binary compatibility needs to be preserved
on changes to types. (Use versioned type names to manage
breaking changes.)
Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com. As of May 2023, there are no widely used type
server
implementations and no plans to implement one.
Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.
type: string
type: object
GroupResponseGroupData:
description: Information about objects matching the given key.
properties:
aggregation_count:
$ref: '#/components/schemas/v1CountResponse'
aggregation_uuids:
description: |-
List of UUIDs of the objects in the group.
Only populated if show_aggregation_uuids is set.
items:
type: string
type: array
aggregation_value:
$ref: '#/components/schemas/v1GroupAggregationValueResponse'
unique_counts:
additionalProperties:
$ref: '#/components/schemas/v1CountResponse'
description: |-
Map of counts for the given unique_count_paths fields.
Only populated if unique_count_paths is set.
type: object
unique_values:
additionalProperties:
items:
type: object
type: array
description: |-
Map of values for the given unique_value_paths fields.
Only populated if unique_value_paths is set.
type: object
type: object
v1PackageLicense:
properties:
context:
$ref: '#/components/schemas/v1Context'
meta:
$ref: '#/components/schemas/v1Meta'
spec:
$ref: '#/components/schemas/v1PackageLicenseSpec'
tenant_meta:
$ref: '#/components/schemas/v1TenantMeta'
uuid:
description: The UUID of the package license.
readOnly: true
type: string
required:
- tenant_meta
- meta
- spec
- context
type: object
v1ListResponse:
description: Response to a list request.
properties:
next_page_id:
description: The UUID of last message retrieved.
type: string
next_page_token:
description: >-
Pagination token that can be used to retrieve the next page of
results.
format: int32
type: integer
type: object
v1GroupAggregationValueResponse:
description: |-
GroupAggregationValueResponse returns the value of the aggregation if
requested.
properties:
value:
format: float
type: number
type: object
v1Context:
description: Contexts keep objects from different scans separated.
properties:
id:
description: The context ID, such as a pull request ID or branch reference.
type: string
tags:
description: |-
A list of tags applied to a context. Used primarily for CI and SBOM
contexts.
items:
type: string
type: array
type:
$ref: '#/components/schemas/ContextContextType'
will_be_deleted_at:
description: |-
Time that all objects in this context will be deleted.
This field is deprecated and will be removed in the future.
Please use the meta.will_be_deleted_at field instead.
format: date-time
readOnly: true
type: string
required:
- type
- id
type: object
v1Meta:
description: Common fields for all Endor Labs resources.
properties:
annotations:
additionalProperties:
type: string
description: >-
Annotations can be used to attach metadata to a resource message.
Annotation values can be small or large, structured or unstructured,
and may include characters not permitted by labels.
The keys may contain alphanumerics, underscores (_), dots (.) and
dashes
(-). The values of an annotation must be 16384 bytes or smaller.
type: object
create_time:
description: |-
Time the resource was created.
Format: 2017-01-15T01:30:15.01Z
RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
format: date-time
readOnly: true
type: string
created_by:
description: |-
Name and authentication source of the user who created the object,
for example, ewok@endor.ai@google@api-key.
readOnly: true
type: string
description:
description: Resource description. Must be less than 1024 bytes.
type: string
index_data:
$ref: '#/components/schemas/v1IndexData'
kind:
description: >-
Resource kind, for example, HelloResponse.
Auto-generated using the protobuf message
proto.MessageName().Name().
readOnly: true
type: string
name:
description: Resource name. Must be 63 characters or less.
type: string
parent_kind:
description: Parent object resource kind, for example, Project.
type: string
parent_uuid:
description: Parent object UUID.
type: string
references:
additionalProperties:
$ref: '#/components/schemas/googleprotobufAny'
description: Map of objects referenced in a query API.
readOnly: true
type: object
tags:
description: >-
List of tags attached to the resource.
Tags can be used to select objects and to find collections of
objects that
satisfy certain conditions. A tag must be 255 characters or less.
items:
type: string
type: array
update_time:
description: |-
Time the resource was last updated.
Note: Updated on all create/patch/delete operations.
Format: 2017-01-15T01:30:15.01Z
RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
format: date-time
readOnly: true
type: string
updated_by:
description: >-
Name and authentication source of the last user who updated the
object,
for example, vulnerabilityingestor@endor.ai@x509.
readOnly: true
type: string
upsert_time:
description: |-
Time the resource was last upserted.
Note:
create_time is only set the first time the resource is created.
upsert_time is set every time the resource is upseted.
Format: 2017-01-15T01:30:15.01Z
RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
format: date-time
readOnly: true
type: string
version:
description: Message version.
readOnly: true
type: string
required:
- name
type: object
v1PackageLicenseSpec:
properties:
all_licenses:
description: All the licenses found by Endor Labs.
items:
$ref: '#/components/schemas/v1PackageLicenseInfo'
type: array
code_licenses:
description: The discovered licenses found in the source code.
items:
$ref: '#/components/schemas/v1PackageLicenseInfo'
type: array
copyrights:
additionalProperties:
type: string
description: >-
The map of copyright notices per file name found in source files.
The key is the file name and the value is the copyright notice texts
combined together into a single string.
type: object
declared_code_licenses:
description: The declared licenses found in the source code.
items:
$ref: '#/components/schemas/v1PackageLicenseInfo'
type: array
license_text:
additionalProperties:
type: string
description: Map of sha256 to license text.
type: object
package_manager_licenses:
description: The licenses from the package manager.
items:
$ref: '#/components/schemas/v1PackageLicenseInfo'
type: array
project_uuid:
description: UUID of the project that the package license relates to.
type: string
version:
$ref: '#/components/schemas/v1Version'
type: object
v1TenantMeta:
description: Tenant related data for the tenant containing the resource.
properties:
namespace:
description: >-
Namespaces are a way to organize organizational units into virtual
groupings of resources. Namespaces must be a fully qualified name,
for example, the child namespace of namespace "endor.prod" called
"app"
is called "endor.prod.app".
type: string
required:
- namespace
type: object
ContextContextType:
default: CONTEXT_TYPE_UNSPECIFIED
description: |2-
- CONTEXT_TYPE_MAIN: Objects from a scan of the default branch.
All objects in the oss namespace are in the main context.
The context id is always "default".
- CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in
another project. Used for same-tenant dependencies. In source code
reference this is equivalent to "vendor" folders. Package versions in
the external context are only scanned for call graphs. No other
operations are performed on them.
- CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID.
Objects in this context are deleted after 30 days.
- CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or
some other unique identifier.
- CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch
reference name.
enum:
- CONTEXT_TYPE_UNSPECIFIED
- CONTEXT_TYPE_MAIN
- CONTEXT_TYPE_EXTERNAL
- CONTEXT_TYPE_CI_RUN
- CONTEXT_TYPE_SBOM
- CONTEXT_TYPE_REF
type: string
v1IndexData:
description: |-
IndexData is used to index the resource for search. It's an internal
object.
properties:
data:
items:
type: string
readOnly: true
type: array
search_score:
description: >-
search_score is the score of the resource for search. Internal use
only.
format: float
readOnly: true
type: number
tenant:
readOnly: true
type: string
will_be_deleted_at:
description: Time that the resource will be deleted.
format: date-time
readOnly: true
type: string
type: object
v1PackageLicenseInfo:
properties:
additional_files:
additionalProperties:
format: int32
type: integer
description: Other files that contain the same license, mapped to line number.
type: object
confidence:
description: The confidence in the license match.
format: float
type: number
copyrights:
description: Copyrights within the license text.
items:
type: string
type: array
file_location:
description: The line in the file where the license text begins.
format: int32
type: integer
file_name:
description: The name of the file where the license was found.
type: string
hash:
description: Hash should only be set if matched_text is empty.
type: string
license_description:
description: |-
Raw license description as found, for example in package managers.
It is free form text that may not contain a valid SPDX ID.
type: string
llm:
description: |-
The LLM used to identify the license, if applicable.
If no LLM was used, then this will be empty.
type: string
mapping_info:
$ref: '#/components/schemas/PackageLicenseInfoLicenseInfoMapping'
matched_text:
description: The license text that was matched.
type: string
notices_file:
description: True if it is a notices file identified by name.
type: boolean
spdx_expr:
description: SPDX expression for the license.
type: string
spdx_id:
description: Normalized SPDX id if known.
type: string
type:
description: License classification (based on licenseclassifier by Google).
type: string
url:
description: The URL that points to the license description.
type: string
required:
- license_description
type: object
v1Version:
properties:
metadata:
additionalProperties:
type: string
description: Version metadata.
type: object
ref:
description: |-
Resolved ref of the source control version.
Can be a tag, a branch or a SHA.
type: string
sha:
description: >-
SHA of the source control version.
Because the SHA might not be possible to resolved this field is
optional.
type: string
required:
- ref
type: object
PackageLicenseInfoLicenseInfoMapping:
description: Additional context about the raw license description.
properties:
confidence:
description: Confidence level of the mapping.
format: float
type: number
mapping_info:
$ref: '#/components/schemas/v1LicenseMappingInfo'
notes:
description: Additional notes about the mapping.
type: string
source:
description: Source of the license mapping information.
type: string
type: object
v1LicenseMappingInfo:
default: LICENSE_MAPPING_INFO_UNSPECIFIED
description: |-
LicenseMappingInfo contains additional information
that we determine when we attempt to match a license string
to a known SPDX id.
- LICENSE_MAPPING_INFO_NOT_OSS: This does not look to like an OSS license.
- LICENSE_MAPPING_INFO_IN_CODE: License information is to be found in the code.
- LICENSE_MAPPING_INFO_UNKNOWN: Cannot determine anything about the license.
- LICENSE_MAPPING_INFO_NOT_INCOMPLETE: There is some license information, but is not detailed enough.
- LICENSE_MAPPING_INFO_PRIVATE: Appears to be a private package.
- LICENSE_MAPPING_INFO_EXACT: An exact match to a SPDX id.
- LICENSE_MAPPING_INFO_UNLICENSED: Seems to be explicitly without license.
enum:
- LICENSE_MAPPING_INFO_UNSPECIFIED
- LICENSE_MAPPING_INFO_NOT_OSS
- LICENSE_MAPPING_INFO_IN_CODE
- LICENSE_MAPPING_INFO_UNKNOWN
- LICENSE_MAPPING_INFO_NOT_INCOMPLETE
- LICENSE_MAPPING_INFO_PRIVATE
- LICENSE_MAPPING_INFO_EXACT
- LICENSE_MAPPING_INFO_UNLICENSED
type: string
````