License API

ComponentLicenses

Get license information for a software component identified by Package URL.

HTTP Request Example

curl -X GET 'https://api.scanoss.com/v2/licenses/component?purl=pkg:github/scanoss/engine@5.0.0' \
  -H "X-Api-Key: $SC_API_KEY" | jq

Response Format

Returns license data for a component in two forms:

Licenses list: All detected licenses in the component
SPDX expression: Combined license expression when determinable

Key fields:

purl: Component identifier
licenses: List of detected licenses
- id: SPDX ID or license reference
- full_name: License name
- is_spdx_approved: SPDX approval status
- url: License reference URL
statement: SPDX expression (when available)
version: Resolved component version
url: Component source URL
requirement: Version constraint from request
info_code: Processing result code
info_message: Human-readable status message

Info Codes

The info_code field reports the outcome of processing each component. Possible values:

Code	Meaning
`SUCCESS`	Request processed successfully
`INVALID_PURL`	Invalid Package URL
`COMPONENT_NOT_FOUND`	Component not found
`NO_INFO`	No license data available
`INVALID_SEMVER`	Invalid version format
`VERSION_NOT_FOUND`	Version not found

Response Examples

Multiple licenses (no SPDX expression)

Occurs when a component has multiple licenses without a single unified expression.

{
  "component": {
    "purl": "pkg:github/ffmpeg/ffmpeg@n7.0",
    "url": "https://github.com/ffmpeg/ffmpeg",
    "requirement": "",
    "version": "n7.0",
    "statement": "",
    "licenses": [
      {
        "id": "LGPL-2.1-or-later",
        "full_name": "GNU Lesser General Public License v2.1 or later",
        "is_spdx_approved": true,
        "url": "https://spdx.org/licenses/LGPL-2.1-or-later.html"
      },
      {
        "id": "GPL-2.0-or-later",
        "full_name": "GNU General Public License v2.0 or later",
        "is_spdx_approved": true,
        "url": "https://spdx.org/licenses/GPL-2.0-or-later.html"
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Licenses Successfully retrieved"
  }
}

SPDX expression (OR)

Returned when the component specifies a license choice.

{
  "component": {
    "purl": "pkg:maven/ch.qos.logback/logback-classic@1.5.0",
    "url": "https://github.com/qos-ch/logback",
    "requirement": "",
    "version": "1.5.0",
    "statement": "EPL-1.0 OR LGPL-2.1-only",
    "licenses": [
      {
        "id": "EPL-1.0",
        "full_name": "Eclipse Public License 1.0",
        "is_spdx_approved": true,
        "url": "https://spdx.org/licenses/EPL-1.0.html"
      },
      {
        "id": "LGPL-2.1-only",
        "full_name": "GNU Lesser General Public License v2.1 only",
        "is_spdx_approved": true,
        "url": "https://spdx.org/licenses/LGPL-2.1-only.html"
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Licenses Successfully retrieved"
  }
}

SPDX expression (AND)

Returned when multiple licenses must be satisfied together.

{
  "component": {
    "purl": "pkg:github/openssl/openssl@1.1.1n",
    "url": "https://github.com/openssl/openssl",
    "requirement": "",
    "version": "1.1.1n",
    "statement": "OpenSSL AND SSLeay",
    "licenses": [
      {
        "id": "OpenSSL",
        "full_name": "OpenSSL License",
        "is_spdx_approved": false,
        "url": "https://www.openssl.org/source/license-openssl-ssleay.txt"
      },
      {
        "id": "SSLeay",
        "full_name": "Original SSLeay License",
        "is_spdx_approved": false,
        "url": "https://www.openssl.org/source/license-openssl-ssleay.txt"
      }
    ]
  },
  "status": {
    "status": "SUCCESS",
    "message": "Licenses Successfully retrieved"
  }
}

Error Response

{
  "component": {
    "purl": "pkg:github/scanoss/unknown-component",
    "url": "",
    "requirement": "",
    "version": "",
    "statement": "",
    "licenses": [],
    "info_message": "Component version not found",
    "info_code": "VERSION_NOT_FOUND"
  },
  "status": {
    "status": "SUCCESS",
    "message": "Licenses Successfully retrieved"
  }
}

ComponentsLicenses

Get license information for multiple software components in a single request.

HTTP Request Example

curl -X POST 'https://api.scanoss.com/v2/licenses/components' \
  -H 'Content-Type: application/json' \
  -H "X-Api-Key: $SC_API_KEY" \
  -d '{
    "components": [
      {"purl": "pkg:github/scanoss/engine@5.0.0"},
      {"purl": "pkg:github/scanoss/scanoss.py@v1.30.0"}
    ]
  }' | jq

Overview

License Dataset

Encryption Dataset

Security Dataset

Process & Integrations

APIs and Services

Guides

ComponentLicenses

HTTP Request Example

Response Format

Info Codes

Response Examples

Multiple licenses (no SPDX expression)

SPDX expression (OR)

SPDX expression (AND)

Error Response

ComponentsLicenses

HTTP Request Example

​ComponentLicenses

​HTTP Request Example

​Response Format

​Info Codes

​Response Examples

​Multiple licenses (no SPDX expression)

​SPDX expression (OR)

​SPDX expression (AND)

​Error Response

​ComponentsLicenses

​HTTP Request Example

ComponentLicenses

HTTP Request Example

Response Format

Info Codes

Response Examples

Multiple licenses (no SPDX expression)

SPDX expression (OR)

SPDX expression (AND)

Error Response

ComponentsLicenses

HTTP Request Example