Endpoints

Repositories, dependencies, and checking a package against the allowlist.

Every endpoint is a GET under /api/public/v1/ and needs an API key. Allowlist results read allowed, denied, not_listed (no decision applies) or not_audited (the ecosystem's policy is Off). See Allowlist and policy.

Repositories

List repositories

GET /repositories — the repositories added to Depos, with their scan state. Takes page, pageSize and search.

{
  "data": [
    {
      "id": "01JB2X0Z8Q4V8M6N3K7R1T5Y9W",
      "fullName": "acme/api",
      "defaultBranch": "main",
      "private": true,
      "archived": false,
      "scan": { "status": "done", "lastScannedAt": "2026-10-19T08:12:00.000Z", "error": null },
      "dependencyCount": 142,
      "violationCount": 3
    }
  ],
  "total": 1, "page": 1, "pageSize": 25
}

scan.status is one of never, pending, running, done, partial, paused, failed.

Get a repository

GET /repositories/{id} — the same fields, plus the commit the last scan read, the files it skipped, and the packages in violation there.

{
  "id": "01JB2X0Z8Q4V8M6N3K7R1T5Y9W",
  "fullName": "acme/api",
  "lastScannedCommit": "9f2c1e0…",
  "warnings": [{ "path": "vendor/package.json", "reason": "too large" }],
  "violations": [
    { "ecosystem": "npm", "name": "left-pad", "result": "not_listed", "manifestPaths": ["package.json"] }
  ]
}

List a repository's dependencies

GET /repositories/{id}/dependencies — every dependency declaration the last scan found. Takes page, pageSize, search and ecosystem.

{
  "data": [
    { "ecosystem": "npm", "name": "express", "key": "express", "scope": "dependencies", "manifestPath": "package.json" }
  ],
  "total": 142, "page": 1, "pageSize": 25
}

key is the normalized name: with the ecosystem, it identifies the package.

Dependencies

List dependencies

GET /dependencies — every package your added repositories use, once per package, with where it is used and its allowlist result there.

Parameter
`page`, `pageSize`, `search`	See pagination.
`ecosystem`	Only this ecosystem, e.g. `npm`, `python`.
`repository`	Only packages this repository uses (its id).
`violations`	`true`: only packages Denied or Not listed in at least one repository.
`unlisted`	`true`: only packages Not listed in at least one repository.

{
  "data": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "key": "lodash",
      "usages": [
        {
          "repository": { "id": "01JB2X0Z8Q4V8M6N3K7R1T5Y9W", "fullName": "acme/api" },
          "manifestPaths": ["package.json"],
          "scopes": ["dependencies"],
          "result": "allowed"
        }
      ],
      "hasNote": true,
      "allowlist": { "allowed": 1, "denied": 0, "notListed": 0 }
    }
  ],
  "total": 318, "page": 1, "pageSize": 25
}

allowlist counts repositories per result; it is null when the ecosystem is not audited.

Get a dependency

GET /dependencies/{ecosystem}/{name} — one package: its note, where it is used, and its allowlist entries. Scoped names keep their slash: /dependencies/npm/@acme/ui.

{
  "ecosystem": "npm",
  "name": "lodash",
  "key": "lodash",
  "audited": true,
  "note": {
    "text": "Use native array methods in new code.",
    "fields": [{ "key": "status", "value": "deprecated" }],
    "repositories": null,
    "updatedAt": "2026-10-02T10:00:00.000Z"
  },
  "usages": [],
  "allowlistEntries": [
    { "id": "01JB…", "decision": "allow", "reason": "Baseline", "repositories": null, "expiresAt": null, "expired": false }
  ]
}

repositories: null means every repository; otherwise the list of repositories it covers.

Check a package

GET /dependencies/check?ecosystem={ecosystem}&name={name}[&repository={id}] — may this package be used? The package does not need to be in use yet, so a CI step can ask before a pull request adds it.

With repository, the answer is for that repository: an entry for selected repositories counts there.
Without it, the answer is organization-wide.

{
  "ecosystem": "npm",
  "name": "left-pad",
  "key": "left-pad",
  "repository": null,
  "result": "denied",
  "violation": true,
  "mode": "enforce",
  "decidedBy": {
    "id": "01JB…",
    "decision": "deny",
    "scope": "organization",
    "reason": "Unmaintained; use String.prototype.padStart.",
    "expiresAt": null
  }
}

violation is true when the result is denied or not_listed in an audited ecosystem: what the pull request check would flag.
mode is the ecosystem's policy: off, audit or enforce.
decidedBy is the entry that decided the result, or null.

For example, a CI step that fails when a package is not allowed:

result=$(curl -sf -H "X-API-Key: $DEPOS_API_KEY" \
  "https://<your-depos-host>/api/public/v1/dependencies/check?ecosystem=npm&name=left-pad")
echo "$result" | jq -e '.violation == false' > /dev/null || {
  echo "left-pad is not allowed: $(echo "$result" | jq -r '.decidedBy.reason // .result')"
  exit 1
}

Overview