Endpoints da API REST para conformidade com licenças

Use a API REST para verificar os pacotes em relação à política de conformidade de licença de um repositório.

Get the license compliance policy for an enterprise

Gets the license compliance policy for an enterprise.

Currently, only the policy with the ID default is supported.

The authenticated user must be an enterprise owner, or have the "View enterprise license policy" or "Edit enterprise license policy" fine-grained permission on the enterprise.

Tokens de acesso granulares para "Get the license compliance policy for an enterprise"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

  • "Enterprise license policy" enterprise permissions (read)

Parâmetros para "Get the license compliance policy for an enterprise"

Cabeçalhos
accept string

Setting to application/vnd.github+json is recommended.

Parâmetros de caminho
enterprise string Obrigatório

The slug version of the enterprise name.

policy_id string Obrigatório

The unique identifier of the policy within the enterprise. Currently, only default is supported.

Códigos de status de resposta HTTP para "Get the license compliance policy for an enterprise"

Código de statusDescrição
200

OK

404

Resource not found

503

Service unavailable

Exemplos de código para "Get the license compliance policy for an enterprise"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

get/enterprises/{enterprise}/license-compliance/policies/{policy_id}
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/license-compliance/policies/POLICY_ID

Response

Status: 200
{ "created_at": "2026-09-22T12:00:00Z", "licenses": { "allowed": [ { "spdx_id": "MIT", "added_at": "2026-09-22T12:00:00Z" } ] }, "packages": [ { "package_manager": "npm", "name": "example-package", "action": "allowed", "reason": "Approved exception.", "extra_allowed_spdx_ids": [ "MIT" ], "added_at": "2026-09-22T12:00:00Z" } ] }

Set the license compliance policy for an enterprise

Sets the license compliance policy for an enterprise.

Currently, only the policy with the ID default is supported.

The authenticated user must be an enterprise owner, or have the "Edit enterprise license policy" fine-grained permission on the enterprise.

Tokens de acesso granulares para "Set the license compliance policy for an enterprise"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

  • "Enterprise license policy" enterprise permissions (write)

Parâmetros para "Set the license compliance policy for an enterprise"

Cabeçalhos
accept string

Setting to application/vnd.github+json is recommended.

Parâmetros de caminho
enterprise string Obrigatório

The slug version of the enterprise name.

policy_id string Obrigatório

The unique identifier of the policy within the enterprise. Currently, only default is supported.

Parâmetros do corpo
licenses object Obrigatório
allowed array of objects Obrigatório

The licenses allowed by this policy.

spdx_id string Obrigatório

The SPDX identifier of the license.

added_at string or null Obrigatório

The time the license was added to the policy.

packages array of objects Obrigatório

The package-level exceptions in this policy.

package_manager string Obrigatório

The package manager the package belongs to.

Pode ser um dos: unknown, rubygems, npm, pip, maven, nuget, composer, gomod, rust, actions, pub, swift

name string Obrigatório

The name of the package.

action string Obrigatório

How the package is treated by the policy.

Pode ser um dos: unknown, allowed, private

reason string Obrigatório

The reason the exception was added.

extra_allowed_spdx_ids array of strings Obrigatório

Additional SPDX identifiers allowed for this package.

added_at string or null Obrigatório

The time the exception was added to the policy.

Códigos de status de resposta HTTP para "Set the license compliance policy for an enterprise"

Código de statusDescrição
204

A header with no content is returned.

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

503

Service unavailable

Exemplos de código para "Set the license compliance policy for an enterprise"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

put/enterprises/{enterprise}/license-compliance/policies/{policy_id}
curl -L \ -X PUT \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/license-compliance/policies/POLICY_ID \ -d '{"licenses":{"allowed":[{"spdx_id":"MIT","added_at":"2026-09-22T12:00:00Z"}]},"packages":[{"package_manager":"npm","name":"example-package","action":"allowed","reason":"Approved exception.","extra_allowed_spdx_ids":["MIT"],"added_at":"2026-09-22T12:00:00Z"}]}'

A header with no content is returned.

Status: 204

Check license compliance for packages

Checks whether packages identified by the supplied package URLs (PURLs) are allowed by the repository's license compliance policy.

For requests made on behalf of a user, that user must have write access to the repository or the "View repository license policy" permission. OAuth apps and classic personal access tokens require the repo scope.

Tokens de acesso granulares para "Check license compliance for packages"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

  • "Repository license policy" repository permissions (read)

Parâmetros para "Check license compliance for packages"

Cabeçalhos
accept string

Setting to application/vnd.github+json is recommended.

Parâmetros de caminho
owner string Obrigatório

The account owner of the repository. The name is not case sensitive.

repo string Obrigatório

The name of the repository without the .git extension. The name is not case sensitive.

Parâmetros do corpo
purls array of strings Obrigatório

Up to 40 package URLs to check against the license compliance policy. Duplicate package URLs count toward the limit but are checked once.

Códigos de status de resposta HTTP para "Check license compliance for packages"

Código de statusDescrição
200

Package license compliance results.

403

Forbidden

404

License compliance policy not found.

422

Validation failed, or the endpoint has been spammed.

503

Service unavailable

Exemplos de código para "Check license compliance for packages"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplos de solicitação

post/repos/{owner}/{repo}/license-compliance/package-checks
curl -L \ -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/license-compliance/package-checks \ -d '{"purls":["pkg:npm/lodash@4.17.21"]}'

Package license compliance results.

Status: 200
{ "purls": { "pkg:npm/lodash@4.17.21": { "status": "allowed", "license": "MIT", "reason": "allowed_license" } } }