> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Per-file license evidence for one or many components > For each component, returns the license evidence detected in its files, grouped per file. Each detection carries the detector, a line range, a URL to the backing fragment and the evidence `source`. Per-item failures use `info_code` / `info_message`. Evidence whose backing content the deployment does not host is omitted: source-code evidence (`source` = `header_declared` / `spdx_tag`) is dropped when `sources_kb` is not configured, and metadata evidence (`metadata_declared`) when `metadata_kb` is not. Notice evidence (`notice_declared`) is always present. A component left with no files after this filtering returns `info_code: NO_INFO`. ## OpenAPI ````yaml /api-reference/developer-tools/v3-openapi.yaml post /v3/license/evidence openapi: 3.0.3 info: title: SCANOSS Services API version: 0.28.1 description: | Consolidated HTTP API for the SCANOSS knowledge base. Exposes the following domains under a single `/v3/*` prefix: * **licenses** — attribution files + per-file license evidence * **copyright** — copyright evidence + holders (stubbed pending data) * **components** — free-form search, versions and lifecycle status * **crypto** — algorithms, hints and version ranges per purl, plus ruleset tarball downloads * **crypto reachability** — stitched cryptographic findings, call chains, entry points, supporting and forward calls per component or frozen dependency tree * **dependencies** — declared dependencies (with composite-license resolution) and bounded transitive walks * **geo** — contributor declared/curated locations and timezone-based origin distribution * **vulnerabilities** (path `/vuln/*`) — CVE detection by merging the local NVD KB with osv.dev, enriched with EPSS * **scan** — direct SCANOSS engine scans (WFP upload, MD5 / urlhash / snippet lookups) * **contents** — raw notice / source-code content from the mz store Every batch endpoint encodes per-item failures as `info_code` / `info_message` so the call as a whole returns 200 with a `status.status` ∈ {SUCCESS, PARTIAL_SUCCESS, ERROR}. Single-purl GETs derive the same status from the item's `info_code`. servers: - url: https://api.scanoss.com description: Production security: [] tags: - name: licenses description: License attribution files and per-file license evidence - name: copyright description: Copyright evidence and holders (stubbed pending KB data) - name: components description: Component search, versions and lifecycle status - name: cryptography description: Cryptographic algorithms, hints, version ranges and ruleset downloads - name: cryptography-reachability description: > Crypto reachability over mining results: stitched findings, call chains, crypto entry points, supporting calls and bounded forward calls, for one component (with its mined dependency closure) or a caller-supplied frozen dependency tree. Registered only when reachability_db.dsn is configured. - name: dependencies description: Declared dependencies (per component) and transitive walks - name: geoprovenance description: Contributor locations (declared + curated) and origin distribution - name: vulnerabilities description: CVE detection (local KB + OSV) and CPE lookup - name: scan description: > Direct SCANOSS engine scans (passthrough), plus MD5 / urlhash / snippet lookups, and the dual-mode batch endpoint (synchronous single-shot WFP and chunked-async upload over the batchScanner pipeline). Registered only when scan.engine_path is configured. - name: contents description: Raw notice / source-code content from the mz store paths: /v3/license/evidence: post: tags: - licenses summary: Per-file license evidence for one or many components description: | For each component, returns the license evidence detected in its files, grouped per file. Each detection carries the detector, a line range, a URL to the backing fragment and the evidence `source`. Per-item failures use `info_code` / `info_message`. Evidence whose backing content the deployment does not host is omitted: source-code evidence (`source` = `header_declared` / `spdx_tag`) is dropped when `sources_kb` is not configured, and metadata evidence (`metadata_declared`) when `metadata_kb` is not. Notice evidence (`notice_declared`) is always present. A component left with no files after this filtering returns `info_code: NO_INFO`. operationId: postLicenseEvidence requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/BatchRequest' example: components: - purl: pkg:github/scanoss/engine requirement: v5.4.5 responses: '200': description: License evidence resolved per component. content: application/json: schema: $ref: '#/components/schemas/LicenseEvidenceResponse' example: components: - purl: pkg:github/scanoss/engine version: 5.4.5 requirement: v5.4.5 files: - file: LICENSE file_id: e6a600fd5e1d9cbde2d983680233ad02 detections: - license_id: GPL-2.0-only detector: licenseclassifier confidence: 1 source: notice_declared evidence: start: 1 end: 25 evidence_url: >- https://api.scanoss.com/v3/notice-contents/e6a600fd5e1d9cbde2d983680233ad02?start=1&end=25 - file: src/main.c file_id: 874550fd5e1d9cbde2d9836802332357 detections: - license_id: GPL-2.0-only detector: licenseclassifier confidence: 1 source: header_declared evidence: start: 1 end: 2 evidence_url: >- https://api.scanoss.com/v3/file-contents/874550fd5e1d9cbde2d9836802332357?start=1&end=2 status: status: SUCCESS message: Resolved 1 of 1 purls '400': $ref: '#/components/responses/BadRequest' '500': $ref: '#/components/responses/InternalError' '504': $ref: '#/components/responses/Timeout' components: schemas: BatchRequest: type: object required: - components properties: components: type: array minItems: 1 items: $ref: '#/components/schemas/Request' search: $ref: '#/components/schemas/SearchCriteria' LicenseEvidenceResponse: type: object required: - components - status properties: components: type: array items: $ref: '#/components/schemas/LicenseEvidenceItem' status: $ref: '#/components/schemas/BatchStatus' Request: type: object required: - purl properties: purl: type: string description: Package URL example: pkg:github/scanoss/engine requirement: type: string description: Optional version requirement example: v5.4.5 SearchCriteria: type: object description: | Optional request-level search configuration applied to every component in the batch (for GET endpoints the same knobs are query params). All fields are optional; the defaults disable every fallback (strict version matching, no related results). Honored by endpoints that support search criteria — currently `/v3/license/evidence`. properties: max_results_per_purl: type: integer minimum: 0 description: Caps the per-purl result array in the output. 0 = no limit. show_related_results: type: boolean default: false description: Enable the source-purl fallback lookup. show_url: type: boolean default: false description: Include a `url` in each result (placeholder — data source TBD). on_version_not_found: type: string default: strict enum: - strict - show_latest - show_closest_lt - show_closest_gt - show_any description: | Version fallback when the requested version has no data: `strict` (no fallback), `show_latest`, `show_closest_lt`, `show_closest_gt`, `show_any`. Not applied to range endpoints. encoded: type: string default: none enum: - none - url_encoded - base64_encoded description: | Output encoding for content string values of the response (`none` default, `url_encoded`, `base64_encoded`). Control fields (`info_code`, `info_message`, `status`, `message`, `requirement`) and object keys are never encoded. LicenseEvidenceItem: type: object required: - purl properties: purl: type: string version: type: string description: Concrete version resolved from `requirement`. requirement: type: string files: type: array items: $ref: '#/components/schemas/LicenseEvidenceFile' url: type: string description: >- Present only when `search.show_url` is set (placeholder — not yet populated). info_code: $ref: '#/components/schemas/InfoCode' info_message: type: string BatchStatus: type: object required: - status - message properties: status: type: string enum: - SUCCESS - PARTIAL_SUCCESS - ERROR message: type: string ErrorBody: type: object required: - status - error - timestamp properties: status: type: string enum: - error error: type: object required: - code - message properties: code: type: string description: | Stable machine-readable error identifier. Possible values: - INVALID_BODY, INVALID_QUERY, INVALID_FILE_HASH, INVALID_RANGE - EMPTY_BATCH - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED - TIMEOUT, INTERNAL_ERROR message: type: string timestamp: type: string format: date-time LicenseEvidenceFile: type: object required: - file - file_id - detections properties: file: type: string example: LICENSE file_id: type: string pattern: ^[a-f0-9]{32}$ description: MD5 of the file content (used as the content endpoint id). example: e6a600fd5e1d9cbde2d983680233ad02 detections: type: array items: $ref: '#/components/schemas/LicenseDetection' InfoCode: type: string description: | Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational (a nearest-version was substituted); the others mark failures. enum: - REQUIREMENT_NOT_MET - INVALID_PURL - COMPONENT_NOT_FOUND - VERSION_NOT_FOUND - RESOLVE_FAILED - RELEASE_NOTES_UNAVAILABLE - WARNING LicenseDetection: type: object required: - license_id - detector - confidence - evidence - source properties: license_id: type: string example: GPL-2.0-only detector: $ref: '#/components/schemas/DetectorEnum' confidence: type: number format: float minimum: 0 maximum: 1 evidence: $ref: '#/components/schemas/EvidenceRange' source: $ref: '#/components/schemas/SourceEnum' DetectorEnum: type: string description: Name of the detector that produced the evidence. enum: - licenseclassifier - nomos - scancode - spdx - scanoss EvidenceRange: type: object required: - start - end description: | Line range or byte range of the evidence, depending on the server's license-hints backend: 1-based inclusive **line numbers** with the default `postgres` backend, or **byte offsets** with the `ldb` backend. The content endpoints slice `?start=&end=` by the same unit. properties: start: type: integer minimum: 0 description: Inclusive start (line or byte offset); 0 means whole-file evidence end: type: integer minimum: 0 description: Inclusive end (line or byte offset); 0 means whole-file evidence evidence_url: type: string format: uri description: | URL to the fragment backing the detection. The base endpoint is chosen from the detection `source`: * `notice_declared` → /v3/notice-contents/{id} * `header_declared`, `spdx_tag` → /v3/file-contents/{id} * `metadata_declared` → /v3/metadata-contents/{id} The `start`/`end` query string is omitted when both are 0. SourceEnum: type: string description: | Origin/category of the evidence. Today only `header_declared`, `notice_declared` and `metadata_declared` are emitted (derived from the file path); `spdx_tag` and `project_declared` are reserved for a richer signal. enum: - header_declared - spdx_tag - notice_declared - project_declared - metadata_declared responses: BadRequest: description: Invalid request parameters or body content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INVALID_QUERY message: purl query parameter is required timestamp: '2026-05-19T11:39:56Z' InternalError: description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INTERNAL_ERROR message: ... timestamp: '2026-05-19T11:39:56Z' Timeout: description: Request exceeded the server-side deadline content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: TIMEOUT message: request timed out timestamp: '2026-05-19T11:39:56Z' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.