> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Release notes / changelog for a component > With no `requirement`, lists every version that has release notes, newest-first and paginated. With a `requirement` (an exact version or a semver range, interpreted the same way as the other component endpoints), returns the notes of the matching version(s). When the requirement matches version(s) that have no notes row, the response is `200` with an empty `releases` list and `component.info_code = RELEASE_NOTES_UNAVAILABLE`. ## OpenAPI ````yaml /api-reference/developer-tools/v3-openapi.yaml get /v3/components/releases openapi: 3.0.3 info: title: SCANOSS Services API version: 0.28.1 description: | Consolidated HTTP API for the SCANOSS knowledge base. Exposes the following domains under a single `/v3/*` prefix: * **licenses** — attribution files + per-file license evidence * **copyright** — copyright evidence + holders (stubbed pending data) * **components** — free-form search, versions and lifecycle status * **crypto** — algorithms, hints and version ranges per purl, plus ruleset tarball downloads * **crypto reachability** — stitched cryptographic findings, call chains, entry points, supporting and forward calls per component or frozen dependency tree * **dependencies** — declared dependencies (with composite-license resolution) and bounded transitive walks * **geo** — contributor declared/curated locations and timezone-based origin distribution * **vulnerabilities** (path `/vuln/*`) — CVE detection by merging the local NVD KB with osv.dev, enriched with EPSS * **scan** — direct SCANOSS engine scans (WFP upload, MD5 / urlhash / snippet lookups) * **contents** — raw notice / source-code content from the mz store Every batch endpoint encodes per-item failures as `info_code` / `info_message` so the call as a whole returns 200 with a `status.status` ∈ {SUCCESS, PARTIAL_SUCCESS, ERROR}. Single-purl GETs derive the same status from the item's `info_code`. servers: - url: https://api.scanoss.com description: Production security: [] tags: - name: licenses description: License attribution files and per-file license evidence - name: copyright description: Copyright evidence and holders (stubbed pending KB data) - name: components description: Component search, versions and lifecycle status - name: cryptography description: Cryptographic algorithms, hints, version ranges and ruleset downloads - name: cryptography-reachability description: > Crypto reachability over mining results: stitched findings, call chains, crypto entry points, supporting calls and bounded forward calls, for one component (with its mined dependency closure) or a caller-supplied frozen dependency tree. Registered only when reachability_db.dsn is configured. - name: dependencies description: Declared dependencies (per component) and transitive walks - name: geoprovenance description: Contributor locations (declared + curated) and origin distribution - name: vulnerabilities description: CVE detection (local KB + OSV) and CPE lookup - name: scan description: > Direct SCANOSS engine scans (passthrough), plus MD5 / urlhash / snippet lookups, and the dual-mode batch endpoint (synchronous single-shot WFP and chunked-async upload over the batchScanner pipeline). Registered only when scan.engine_path is configured. - name: contents description: Raw notice / source-code content from the mz store paths: /v3/components/releases: get: tags: - components summary: Release notes / changelog for a component description: >- With no `requirement`, lists every version that has release notes, newest-first and paginated. With a `requirement` (an exact version or a semver range, interpreted the same way as the other component endpoints), returns the notes of the matching version(s). When the requirement matches version(s) that have no notes row, the response is `200` with an empty `releases` list and `component.info_code = RELEASE_NOTES_UNAVAILABLE`. operationId: getComponentReleases parameters: - $ref: '#/components/parameters/PurlQuery' - $ref: '#/components/parameters/RequirementQuery' - $ref: '#/components/parameters/SearchShowRelated' - $ref: '#/components/parameters/SearchEncoded' - in: query name: limit required: false schema: type: integer default: 50 minimum: 1 - in: query name: offset required: false schema: type: integer default: 0 minimum: 0 responses: '200': description: >- Component block plus its matching releases (newest-first). When the purl has no notes and `show_related_results` is set, the releases may come from the component's linked source purl, flagged with `component.info_code = WARNING`. content: application/json: schema: $ref: '#/components/schemas/ReleasesResponse' '400': $ref: '#/components/responses/BadRequest' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' '504': $ref: '#/components/responses/Timeout' components: parameters: PurlQuery: in: query name: purl required: true schema: type: string description: Package URL (e.g. `pkg:github/scanoss/engine`) example: pkg:github/scanoss/engine RequirementQuery: in: query name: requirement required: false schema: type: string description: Optional version requirement (e.g. `v5.4.5`) example: v5.4.5 SearchShowRelated: in: query name: show_related_results required: false schema: type: boolean default: false description: Enable the source-purl fallback lookup. SearchEncoded: in: query name: encoded required: false schema: type: string default: none enum: - none - url_encoded - base64_encoded description: >- Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded. schemas: ReleasesResponse: type: object required: - component - releases - status properties: component: $ref: '#/components/schemas/ReleaseComponent' releases: type: array items: $ref: '#/components/schemas/Release' status: $ref: '#/components/schemas/BatchStatus' ReleaseComponent: type: object description: The {purl, requirement, version} block echoed on the releases responses. properties: purl: type: string example: pkg:github/1210395/salahmobile requirement: type: string example: ^1.0.0 version: type: string example: v1.2.9 info_code: $ref: '#/components/schemas/InfoCode' info_message: type: string Release: type: object description: One version's changelog entry (raw notes text + all_urls metadata). properties: version: type: string example: v1.2.9 date: type: string example: '2024-05-01' url: type: string example: https://github.com/.../releases/download/v1.2.9/... release_notes: type: string example: 'Fixed: Subscription endpoint now public...' BatchStatus: type: object required: - status - message properties: status: type: string enum: - SUCCESS - PARTIAL_SUCCESS - ERROR message: type: string ErrorBody: type: object required: - status - error - timestamp properties: status: type: string enum: - error error: type: object required: - code - message properties: code: type: string description: | Stable machine-readable error identifier. Possible values: - INVALID_BODY, INVALID_QUERY, INVALID_FILE_HASH, INVALID_RANGE - EMPTY_BATCH - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED - TIMEOUT, INTERNAL_ERROR message: type: string timestamp: type: string format: date-time InfoCode: type: string description: | Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational (a nearest-version was substituted); the others mark failures. enum: - REQUIREMENT_NOT_MET - INVALID_PURL - COMPONENT_NOT_FOUND - VERSION_NOT_FOUND - RESOLVE_FAILED - RELEASE_NOTES_UNAVAILABLE - WARNING responses: BadRequest: description: Invalid request parameters or body content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INVALID_QUERY message: purl query parameter is required timestamp: '2026-05-19T11:39:56Z' NotFound: description: Component or version not found content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: COMPONENT_NOT_FOUND message: component not found timestamp: '2026-05-19T11:39:56Z' InternalError: description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INTERNAL_ERROR message: ... timestamp: '2026-05-19T11:39:56Z' Timeout: description: Request exceeded the server-side deadline content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: TIMEOUT message: request timed out timestamp: '2026-05-19T11:39:56Z' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.