Enrich
enrich decorates an inventory or SBOM you already have with purl-keyed layers through the SCANOSS API, no source tree, no fingerprinting, no re-scan. Because it’s keyed purely by PURL, it’s re-runnable: point it at the same file weekly, say, to refresh the layers against whatever the API knows now.
scan raw output), CycloneDX, or SPDX (JSON), auto-detected from the file content, same as sbom.
Layers (--include): the purl-keyed layers Vulnerabilities, Licenses, Cryptography, Geoprovenance.
Dependencies is not an enrich layer. Dependency analysis needs a
manifest or source tree and can’t be derived from a components list
alone, so
--include deps errors on enrich. Use
dependencies instead.-f, --format to convert in the same pass. A layer the output format can’t represent is skipped up front with a notice, the same capability rules as scan, see What Each Format Can Represent.
Enrichment is non-fatal: a failed service is logged and skipped, and
a partial result is still written rather than the whole run failing.
Dependencies
dependencies works in two modes.
Local Mode
Parse manifest files under a path and query the API for what they resolve to:API Mode
Query a specific component’s dependencies directly, without a project on disk.--requirement (the version or range) is optional:
--transient switches from direct to transitive dependencies; --depth (default 10) bounds how many levels deep the traversal goes, and --limit (default 10) bounds the result count.
Direct dependency queries hit
POST /v3/dependencies/dependencies;
transitive queries hit POST /v3/dependencies/transitive.