GitHub API (unofficial showcase)
POST/repos/{owner}/{repo}/dependency-graph/snapshots

Create a dependency snapshot for a repository

Creates a dependency snapshot for a repository, recording the dependencies detected at a specific commit and ref. Supply the required detector, version, ref, sha, job, and scanned fields; ref must begin with refs/, and sha must be 40–64 characters. Add manifests and up to eight scalar-valued metadata entries when you need to include dependency details or domain-specific information.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

2 parameters · 8 body fields
ownerstringrequired
The account that owns the repository. The name is not case-sensitive.
repostringrequired
The repository name without the `.git` extension. The name is not case-sensitive.

Dependency snapshot submission details. Include detector, version, ref, sha, job, and scanned.

versionintegerrequired
The version of the repository snapshot submission.
jobobjectrequired
Information about the job that produced the snapshot, including its external `id` and a `correlator` for grouping related snapshots over time; optionally include an `html_url`.
shastringrequired
The commit SHA associated with this dependency snapshot. Maximum length: 64 characters.
refstringrequired
The repository branch that triggered this snapshot.
detectorobjectrequired
A description of the detector used.
metadataobjectoptional
User-defined metadata to store domain-specific information limited to 8 keys with scalar values.
manifestsobjectoptional
A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.
scannedstringrequired
The time at which the snapshot was scanned.

1 status code
201Returns the created snapshot submission result, including its ID, creation time, result (`SUCCESS`, `ACCEPTED`, or `INVALID`), and a message with further details.
idintegerrequired
ID of the created snapshot.
created_atstringrequired
The time at which the snapshot was created.
resultstringrequired
Either "SUCCESS", "ACCEPTED", or "INVALID". "SUCCESS" indicates that the snapshot was successfully created and the repository's dependencies were updated. "ACCEPTED" indicates that the snapshot was successfully created, but the repository's dependencies were not updated. "INVALID" indicates that the snapshot was malformed.
messagestringrequired
A message providing further details about the result, such as why the dependencies were not updated.

Error handling

detector, version, ref, sha, job, and scanned are required; job must include id and correlator, and detector must include name, version, and url. sha must be 40–64 characters, ref must begin with refs/, and scanned must be an ISO 8601 date-time; metadata supports at most eight scalar-valued keys.