> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enrich & Dependencies

> Refresh vulnerability, license, cryptography, and geoprovenance layers on an existing inventory, and extract or query dependencies.

## Enrich

`enrich` decorates an inventory or SBOM you already have with purl-keyed layers through the SCANOSS API, no source tree, no fingerprinting, no re-scan. Because it's keyed purely by PURL, it's **re-runnable**: point it at the same file weekly, say, to refresh the layers against whatever the API knows now.

```bash theme={null}
# Refresh vulns/licenses/crypto on a raw inventory (raw in, raw out)
scanoss-cli enrich inv.json --include vulns,licenses,crypto --api-key "$SCANOSS_API_KEY" > enriched.json

# Enrich an SPDX document (spdx in, spdx out)
scanoss-cli enrich sbom.spdx.json --include licenses --api-key "$SCANOSS_API_KEY" > enriched.spdx.json

# Enrich a CycloneDX document and convert to SPDX in one pass
scanoss-cli enrich sbom.cdx.json --include licenses --format spdx --api-key "$SCANOSS_API_KEY" > enriched.spdx.json
```

**Recognised inputs:** a SCANOSS raw inventory (the `scan` raw output), CycloneDX, or SPDX (JSON), auto-detected from the file content, same as [`sbom`](output-formats-and-sbom).

**Layers (`--include`):** the purl-keyed layers Vulnerabilities, Licenses, Cryptography, Geoprovenance.

<Note>
  Dependencies is **not** an enrich layer. Dependency analysis needs a
  manifest or source tree and can't be derived from a components list
  alone, so `--include deps` errors on `enrich`. Use
  [`dependencies`](#dependencies) instead.
</Note>

The output format **defaults to the input's** (raw→raw, cyclonedx→cyclonedx, spdx→spdx); pass `-f, --format` to convert in the same pass. A layer the output format can't represent is skipped up front with a notice, the same capability rules as `scan`, see [What Each Format Can Represent](output-formats-and-sbom#what-each-format-can-represent).

<Note>
  Enrichment is **non-fatal**: a failed service is logged and skipped, and
  a partial result is still written rather than the whole run failing.
</Note>

## Dependencies

`dependencies` works in two modes.

### Local Mode

Parse manifest files under a path and query the API for what they resolve to:

```bash theme={null}
scanoss-cli dependencies ./my-project --extract-local --output deps.json
```

### API Mode

Query a specific component's dependencies directly, without a project on disk. `--requirement` (the version or range) is optional:

```bash theme={null}
# Direct dependencies
scanoss-cli dependencies --purl 'pkg:github/scanoss/engine' --requirement '5.4.7' \
  --api-key "$SCANOSS_API_KEY"

# Transitive dependencies, custom depth/limit
scanoss-cli dependencies --purl 'pkg:github/scanoss/engine' --requirement '5.4.7' --transient \
  --depth 5 --limit 20 --api-key "$SCANOSS_API_KEY"
```

`--transient` switches from direct to transitive dependencies; `--depth` (default `10`) bounds how many levels deep the traversal goes, and `--limit` (default `10`) bounds the result count.

<Note>
  Direct dependency queries hit `POST /v3/dependencies/dependencies`;
  transitive queries hit `POST /v3/dependencies/transitive`.
</Note>

For the complete flag list on both commands, see [Commands & Arguments](commands-and-arguments).