Sample - GitHub REST API
POST/repos/{owner}/{repo}/dependency-graph/snapshots

Create a repository dependency snapshot

Creates a dependency snapshot for a repository. Supply repository identity through owner and repo, and include detector, job, commit, reference, and scan-time details in the request body. The created snapshot reports whether the repository dependencies were updated or accepted without an update.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

2 parameters · 8 body fields
ownerstringrequired
The account owner of the repository; the name is not case sensitive.
repostringrequired
The repository name without the `.git` extension; the name is not case sensitive.

Dependency snapshot submission. detector, version, ref, sha, job, and scanned are required.

versionintegerrequired
The version of the repository snapshot submission.
jobobjectrequired
The external job details for the snapshot; `id` and `correlator` identify and group submissions.
shastringrequired
The commit SHA associated with this dependency snapshot. Maximum length: 64 characters.
refstringrequired
The repository branch that triggered this snapshot.
detectorobjectrequired
A description of the detector used.
metadataobjectoptional
User-defined metadata to store domain-specific information limited to 8 keys with scalar values.
manifestsobjectoptional
A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.
scannedstringrequired
The time at which the snapshot was scanned.

1 status code
201Returns the created snapshot result with its identifier, creation time, result status, and a message with further details. The result status is `SUCCESS`, `ACCEPTED`, or `INVALID`.
idintegerrequired
ID of the created snapshot.
created_atstringrequired
The time at which the snapshot was created.
resultstringrequired
Either "SUCCESS", "ACCEPTED", or "INVALID". "SUCCESS" indicates that the snapshot was successfully created and the repository's dependencies were updated. "ACCEPTED" indicates that the snapshot was successfully created, but the repository's dependencies were not updated. "INVALID" indicates that the snapshot was malformed.
messagestringrequired
A message providing further details about the result, such as why the dependencies were not updated.

Error handling

detector, version, ref, sha, job, and scanned are required in the request body. sha must contain 40 to 64 characters, ref must begin with refs/, and scanned must be an ISO 8601 date-time. job requires id and correlator, while metadata supports at most 8 keys and each manifest requires name.