Skip to content

UserAPI.md

Latest commit

 

History

History
746 lines (578 loc) · 31.6 KB

UserAPI.md

File metadata and controls

746 lines (578 loc) · 31.6 KB
Raw

Cavil User API

Authentication

All user API endpoints use bearer tokens you can generate with the "API Keys" menu entry after logging into Cavil. These bearer tokens are passed with every request via the Authorization header.

GET /api/v1/whoami
Authorization: Bearer generated_api_key_here
Accept: application/json

Authentication failures will result in a 403 response.

HTTP/1.1 403 Forbidden
Content-Length: 123
Content-Type: application/json
{
  "error": "It appears you have insufficient permissions for accessing this resource"
}

You can use any HTTP user-agent to access API endpoints, curl for example is great for testing purposes:

$ curl -H 'Authorization: Bearer generated_api_key_here' https://legaldb.suse.de/api/v1/whoami
...

MCP API

The Model Context Protocol (MCP) is a standard that allows Large Language Models (LLMs) to interact with web services. MCP is supported natively by Cavil. An MCP endpoint is available with API key authentication under the path /mcp.

Many features have access restrictions, and which are available to you will depend on the type of API key being used (read-only or read-write), and which roles your user account has assigned.

Important: Embargoed package updates cannot be processed with AI and are completely hidden from MCP tools. That means you have to manually review them in the UI.

Most MCP clients today support Bearer token authentication, so that is what Cavil relies on as well. More authentication mechanisms will be added as the technology evolves.

This example configuration in the mcp.json format, which is commonly used by MCP clients, shows how to include a Cavil API key by setting the Authorization HTTP header:

{
  "mcpServers": {
    "cavil": {
      "url": "https://legaldb.suse.de/mcp",
      "headers": {
        "Authorization": "Bearer generated_api_key_here"
      }
    }
  }
}

MCP tools

These tools are currently available:

  • cavil_get_open_reviews - Get a paginated list of highest priority open reviews

    • Required Roles: user (read-only)
    • search: Filter results by package name, checksum, or external link. (string, optional)
    • limit: Maximum number of reviews to return. Defaults to 20, maximum 100. (number, optional)
    • offset: Number of reviews to skip for pagination. Defaults to 0. (number, optional)
    • min_priority: Minimum package priority to include. Defaults to 1, maximum 10. (number, optional)

  • cavil_search_packages - Search all packages (any review state) by name or by a vendored component they ship

    • Required Roles: user (read-only)
    • name: Exact package name. (string, optional)
    • component: Case-insensitive substring matched against a vendored component's name and its purl, e.g. lodash or pkg:npm/lodash@4.17.20. Matching components are attached to each result. (string, optional)
    • limit: Maximum number of packages to return. Defaults to 25, maximum 100. (number, optional)
    • offset: Number of packages to skip for pagination. Defaults to 0. (number, optional)

  • cavil_get_report - Get legal report for a specific package. Unresolved snippets are summarised as a top-by-impact rollup; use cavil_search_snippets for the full list and per-snippet detail

    • Required Roles: user (read-only)
    • package_id: ID of package to get report for. (number, required)
    • url_limit: Maximum number of URLs to include (occurrence-ordered). Defaults to 10, 0 omits the section. (number, optional)
    • email_limit: Maximum number of email addresses to include (occurrence-ordered). Defaults to 10, 0 omits the section. (number, optional)

  • cavil_search_snippets - Query the unresolved-snippet backlog: filter by resolution / package / license / full-text, aggregate identical snippets by impact, or list individual occurrences with per-snippet detail

    • Required Roles: user (read-only)
    • resolution: One of unresolved (default), fold, clear, overlap, covered, any. (string, optional)
    • group: text (default, impact-ranked distinct snippets) or none (individual occurrences with overlaps/keywords/covered-by detail). (string, optional)
    • order: For group=text, one of occurrences (default), packages, risk, recent. (string, optional)
    • package_id: Scope to one package; omit for fleet-wide. (number, optional)
    • license: Filter by the snippet's closest license name. (string, optional)
    • search: Full-text search over snippet bodies. (string, optional)
    • limit: Maximum number of rows to return. Defaults to 20, maximum 100. (number, optional)
    • offset: Number of rows to skip for pagination. Defaults to 0. (number, optional)

  • cavil_get_file - Get content of a specific file in the package

    • Required Roles: user (read-only)
    • package_id: ID of package to read file from. (number, required)
    • file_path: Path to file inside the package checkout. (string, required)
    • start_line: First line to read. Defaults to 1. (number, optional)
    • end_line: Last line to read. Defaults to 100 and maximum range is 1000 lines. (number, optional)

  • cavil_list_files - List files in the package

    • Required Roles: user (read-only)
    • package_id: ID of package to list files from. (number, required)
    • file_glob: Optional glob pattern used to filter listed files. Defaults to * (all files). (string, optional)

  • cavil_create_note - Create a public note for a specific package, marked as AI-assisted

    • Required Roles: user (read-write)
    • package_id: ID of package to add a note to. (number, required)
    • body: Note body in Markdown format. (string, required)
    • tags: Array of tag strings, at most 32 characters each and 16 per note. (array of strings, optional)
    • skip_if_existing_tag: Skip the write if a note with this tag already applies to the report, making the call idempotent. (string, optional)

  • cavil_get_notes - Get a paginated list of notes for a specific package, optionally filtered by tags. Notes a reviewer has pinned are marked [pinned], sort first, and are always returned regardless of relevant_only

    • Required Roles: user (read-only)
    • package_id: ID of package to list notes for. (number, required)
    • tags: Return only notes carrying all of the given tags. (array of strings, optional)
    • relevant_only: When true, return only notes that apply to this report. Defaults to false. (boolean, optional)
    • limit: Maximum number of notes to return. Defaults to 20, maximum 100. (number, optional)
    • offset: Number of notes to skip for pagination. Defaults to 0. (number, optional)

  • cavil_accept_review - Accept a legal review for a specific package

    • Required Roles: manager, lawyer or admin (read-write)
    • Also requires: the API key was created with the "Allow accept/reject of reviews" option enabled.
    • package_id: ID of package to accept. (number, required)
    • reason: Reason for package acceptance. (string, optional)

  • cavil_reject_review - Reject a legal review for a specific package

    • Required Roles: lawyer or admin (read-write)
    • Also requires: the API key was created with the "Allow accept/reject of reviews" option enabled.
    • package_id: ID of package to reject. (number, required)
    • reason: Reason for package rejection. (string, required)

  • cavil_propose_ignore_snippet - Propose to ignore a specific snippet in the legal review

    • Required Roles: contributor, lawyer or admin (read-write)
    • package_id: ID of package to ignore snippet for. (number, required)
    • snippet_id: ID of snippet to ignore. (number, required)
    • reason: Reason for snippet to be ignored. (string, required)

  • cavil_propose_license_pattern - Propose a new license pattern to be added

    • Required Roles: contributor, lawyer or admin (read-write)
    • package_id: ID of package to ignore snippet for. (number, required)
    • snippet_id: ID of snippet to ignore. (number, required)
    • pattern: License pattern to be added. (string, required)
    • license: License expression. (string, required)
    • reason: Reason for snippet to be ignored. (string, required)

  • cavil_propose_ignore_glob - Propose a file path glob to exclude whole files from scanning system-wide

    • Required Roles: contributor, lawyer or admin (read-write)
    • package_id: ID of package the glob is proposed from; rejected unless it matches a reported file. (number, required)
    • glob: File path glob, e.g. pkgname-*/testdata/*.log. (string, required)
    • reason: Reason the matched files should be ignored. (string, required)

  • cavil_report_missing_license - Report a snippet as genuine license text that cannot be confidently patterned, so a lawyer can author the real pattern (it lands on the Missing Licenses review queue)

    • Required Roles: contributor, lawyer or admin (read-write)
    • package_id: ID of package the snippet belongs to. (number, required)
    • snippet_id: ID of snippet to report as a missing license. (number, required)
    • reason: Reason the snippet needs human review. (string, required)

Agent Skills

An Agent Skill is a short, pre-written instruction sheet that tells an AI agent exactly how to perform a recurring legal-review task in Cavil. Think of it like a checklist a colleague would follow: when you ask the agent to "review report 472890" with a skill enabled, it knows which Cavil tools to use, what to look at, what recommendation styles are acceptable, and what not to do (like never accept or reject a review on your behalf).

You don't need to write or edit the skill files yourself. They ship inside this repository under examples/skills/, ready to be downloaded and dropped into a folder on your laptop. After that, running one is as simple as typing a short command at the agent prompt.

What each bundled skill does

  • cavil-review-note — produces a short advisory note on a package review and posts it to the Notes tab, tagged review. The note tells you the AI's recommendation (ACCEPT / REJECT / NEEDS HUMAN REVIEW), a few specific things to look at, and how confident the AI is. The skill never accepts or rejects the review itself — that decision stays with you. Run it interactively on packages you're about to read, or kick it off against the whole backlog each morning so you arrive at your desk with a curated reading list. Most reviewers will want to learn this skill first.

  • cavil-review — walks you through a full review of one package end to end, and (only if you confirm) actually accepts or rejects it. Use this when you're sitting at your desk working on a single package interactively, not for unattended backlog runs.

  • cavil-refine — complex skill that is not recommended to be used with models less capable than Claude Opus 4.8. Helps clean up the license database by proposing new license patterns, marking irrelevant snippets to be ignored, or proposing globs to exclude whole fixture/data files, so future reviews of similar packages have fewer false positives. The proposals still need a human to approve them in the admin UI.

  • cavil-license-research — researches a single license that Cavil does not recognise yet — a license name, an unfamiliar SPDX identifier, or the license text behind an unresolved snippet — and writes an advisory assessment that recommends where it belongs on Cavil's risk scale, which flags it should carry, and what a lawyer should still check, all backed by cited sources. Use it before teaching Cavil a new license, for example when a Missing Licenses report names an identifier you don't know. The skill never writes anything to Cavil — you still author the pattern and set the risk yourself. Because it only reads, this is the one bundled skill that works with a read-only API key.

Setting up a skill on your own laptop

You can do this end to end yourself. Three one-time steps:

  1. Create a Cavil API key. Log into the Cavil web UI, open your user menu, click API Keys, and create a read-write key — three of the bundled skills write something back (notes, decisions, or pattern proposals), and a read-write key also works for the read-only cavil-license-research, so one key covers them all. Copy the generated key somewhere safe and treat it like a password. Anything the AI does with this key shows up under your name in Cavil, so don't share it.

  2. Install an AI agent that supports MCP. Pick one from the 3rd Party MCP Clients section below. Claude Code is the easiest starting point for most reviewers — its install page at https://code.claude.com/docs/en/quickstart walks you through it. After installing, follow the matching sub-section in this document to tell the agent how to talk to Cavil with your API key (a single claude mcp add ... command for Claude Code, similar one-liners for Gemini CLI, opencode, and goose).

  3. Download the skill folders and put them in the right place. From the Cavil GitHub repository you need the four folders under examples/skills/: cavil-review-note, cavil-review, cavil-refine, and cavil-license-research. The easiest way to grab them is to download the repository as a ZIP (the green "Code" button on GitHub → "Download ZIP"), unzip it, and then move each folder into your agent's skills directory:

    • Claude Code: copy each folder into ~/.claude/skills/ (on Windows: %USERPROFILE%\.claude\skills\). Create that folder first if it doesn't exist yet. The final paths should look like ~/.claude/skills/cavil-review-note/.
    • Gemini CLI: same idea, but the folder is ~/.gemini/skills/.
    • opencode / goose: see those clients' own documentation for the skills-directory location — they evolve faster than this doc; the rest of the workflow is identical.

After those three steps, restart the agent. Every time you launch it from then on it picks the skill up automatically. You invoke it by typing /cavil-review-note (or /cavil-review, /cavil-refine, /cavil-license-research) followed by what you'd like reviewed.

Troubleshooting. If /cavil-review-note doesn't appear in the agent's auto-complete, the most common causes are (a) the folder name is wrong (it must match exactly, including the dash), (b) the folder is in the wrong place (~/.claude/skills/cavil-review-note/SKILL.md must exist), or (c) the agent was already running when you copied the files — restart it. If the skill runs but the agent says it can't see Cavil, the MCP setup from step 2 isn't active; re-run the mcp add command and double-check the API key was pasted correctly.

Example uses for cavil-review-note

Take a look at one specific package. When a maintainer pings you about a particular update and you want a quick second opinion before opening the report:

/cavil-review-note 472890

You can also pass the package name if you can't remember the id:

/cavil-review-note perl-Mojo-JWT

The agent looks the package up, checks whether it has already left a review note (and skips it if so, to avoid duplicates), otherwise reads the report and posts a short note for you. You then open the report in your browser, read the note in the Notes tab, and make the call.

Clear the top of the backlog before standup. Same idea, but you let the agent walk the backlog and write notes for the highest-priority reviews so you arrive at your desk with a curated reading list:

/cavil-review-note process the top 20 open reviews with priority 5 or higher

Each new package gets its own advisory note. Packages that already have a review note from a previous run are skipped, so you can re-issue this command every morning without the agent re-doing work.

Re-check a package after something changed. Maybe the package was re-indexed against a freshly added license pattern, or you got a smarter model since the last note was written, and you want the AI to take another look:

/cavil-review-note re-review perl-Mojolicious even if a review note already exists

This is the explicit "redo" override. Without that phrase the agent assumes the existing note still applies and skips.

What you'll see in the Notes tab. Every note left by this skill is tagged review (the small grey chip in the note header) and marked AI assisted (the blue badge). Click any note for the full body. Notes are advisory only — nothing changes the package state until a human reviewer accepts or rejects it in the normal UI.

If a note turns out to matter beyond the review it was written on — a standing decision about the package, a caveat for whoever picks up the next version — lawyers and admins can pin it with the thumbtack in the note header. Pinned notes are lifted out of the chronological list into a block at the top, stay there while you scroll, and keep full contrast on every review of that package name instead of receding behind "Not relevant to this report". Ten pins per package is the limit, so the block stays worth reading; unpin one to make room. Pins are visible to everyone the note itself is visible to, including in the plain text report and to AI assistants.

Example uses for the other three skills

cavil-review (interactive single-package review). When you have decided to actually finish a review at your desk:

/cavil-review perl-Mojo-JWT

The agent walks you through what it found, recommends ACCEPT or REJECT, and asks for your go-ahead before calling the accept/reject action. You stay in the driver's seat for every state change.

cavil-refine (clean-up proposals). When a report has lots of repeated false-positive matches and you want the AI to propose pattern fixes that an admin can later approve:

/cavil-refine perl-Mojolicious

The proposals show up in the Cavil admin UI for review, just as if a contributor had submitted them.

cavil-license-research (assess an unfamiliar license). When you hit a license Cavil doesn't know yet — say a Missing Licenses report names an SPDX identifier you're not sure how to rate — and you want a researched recommendation before you author the pattern:

/cavil-license-research what risk level should SSPL-1.0 get?

You can also point it at the unresolved snippet that raised the question:

/cavil-license-research identify and assess the license in the missing-license report for package 472890

The agent researches the license on the web, reads its actual text, and writes back an assessment with a recommended risk level and flags, the reasoning, and its sources. Nothing is written to Cavil — you take the recommendation into the pattern editor and set the risk yourself.

Finding a package id

Skill examples often want a numeric package id. The id is the number in the report URL — for example, in https://legaldb.suse.de/reviews/details/472890 the id is 472890. If you don't have a URL handy, you can also just pass the package name and the agent will use cavil_get_open_reviews to look it up; if more than one match comes back, it'll ask you to pick.

3rd Party MCP Clients

While most MCP clients will work with Cavil, we recommend the use of models specifically designed for legal professionals.

gemini-cli

Once you have installed and set up gemini-cli, you can use the gemini mcp command to add Cavil:

$ gemini mcp add cavil https://legaldb.suse.de/mcp -H 'Authorization: Bearer generated_api_key_here' -t http

After restarting gemini-cli, it will automatically discover available Cavil tools and make use of them on its own:

> You are a legal reviewer for SUSE Linux Enterprise. Take a look at
   report 472890 and make a recommendation if that package update
   should be accepted for distribution to customers. Don't be too
   critical of legal risks classified as low by the license scanner.

✦ I will retrieve the legal report for package ID 472890 to evaluate
  its distribution suitability.

╭────────────────────────────────────────────────────────────────────╮
│ ✓  cavil_get_report (cavil MCP Server) {"package_id":472890}     │
│                                                                  │
│    ...                                                           │
╰────────────────────────────────────────────────────────────────────╯
✦ The legal report for perl-Mojo-JWT (ID 472890) indicates that all
  identified risks are classified as "Low". The primary license is
  Artistic-1.0-Perl OR GPL-1.0-or-later, which is standard and
  acceptable for Perl modules within SUSE distributions. Since there
  are no significant changes from previous versions and no high-risk
  concerns, I recommend accepting this package update.


╭────────────────────────────────────────────────────────────────────╮
│ ✓  cavil_accept_review (cavil MCP Server) {"reason":"Standard P… │
│                                                                  │
│    ...                                                           │
╰────────────────────────────────────────────────────────────────────╯
✦ I have reviewed report 472890 for the perl-Mojo-JWT package. The
  licenses found (Artistic-1.0-Perl OR GPL-1.0-or-later) are standard
  for Perl modules and all identified risks were classified as low.
  Finding no significant issues or deviations from previous versions,
  I have accepted the review for distribution.

claude

Once you have installed and set up Claude Code, you can use the clause mcp command to add Cavil:

claude mcp add --transport http cavil https://legaldb.suse.de/mcp --header "Authorization: Bearer generated_api_key_here"

After restarting claude, it will automatically discover available Cavil tools and make use of them on its own.

opencode

Once you have installed and set up opencode for use with your preferred model, you can add Cavil to the "mcp" section of the opencode.json config file:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cavil": {
      "type": "remote",
      "url": "https://legaldb.suse.de/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer generated_api_key_here"
      }
    }
  }
}

After restarting opencode, it will automatically discover available Cavil tools and make use of them on its own:

> You are a legal reviewer for SUSE Linux Enterprise. Take a look at report 476346 and make a recommendation
> if that package update should be accepted for distribution to customers. Don't be too critical of legal
> risks classified as low by the license scanner. Only give a short summary with the reason for your decision.

* cavil_get_report [package_id=476346]

Recommendation: Accept the update for distribution.

Reason: The legal report for perl-Mojolicious (report 476346) shows all detected license risks as low. The main
license findings are standard open source licenses (MIT, Artistic-2.0, BSD-3-Clause, CC-BY-SA-4.0, OFL-1.1),
which are compatible with SUSE's distribution policies. There is one unmatched keyword related to mixed license
statements, but it references recognized open source and documentation licenses only. No significant legal or
compliance barriers are present.

goose

Once you have installed and set up goose for use with your preferred model, you can add Cavil with the goose configure command:

$ goose configure

This will update your existing config files
  if you prefer, you can edit them directly at /home/user/.config/goose

┌   goose-configure
│
◇  What would you like to configure?
│  Add Extension
│
◇  What type of extension would you like to add?
│  Remote Extension (Streamable HTTP)
│
◇  What would you like to call this extension?
│  cavil
│
◇  What is the Streaming HTTP endpoint URI?
│  https://legaldb.suse.de/mcp
│
◇  Please set the timeout for this tool (in secs):
│  300
│
◇  Enter a description for this extension:
│  Cavil
│
◇  Would you like to add custom headers?
│  Yes
│
◇  Header name:
│  Authorization
│
◇  Header value:
│  Bearer generated_api_key_here
│
◇  Add another header?
│  No
│
└  Added cavil extension
└  Configuration saved successfully to /home/user/.config/goose/config.yaml

Additionally, we strongly recommend running goose in "Approve Mode", so you can carefully review all MCP tool calls before they are performed.

┌   goose-configure
│
◇  What would you like to configure?
│  goose settings
│
◇  What setting would you like to configure?
│  goose mode
│
◇  Which goose mode would you like to configure?
│  Approve Mode
│
└  Set to Approve Mode - all tools and modifications require approval

After restarting goose, it will automatically discover available Cavil tools and make use of them on its own:

( O)> You are a legal reviewer for SUSE Linux Enterprise. Take a look at report 476346 and make a
recommendation if that package update should be accepted for distribution to customers. Don't be too
critical of legal risks classified as low by the license scanner. Only give a short summary with the
reason for your decision.

─── cavil_get_report | cavil ──────────────────────────
package_id: 476346

### Recommendation: Accept for Distribution

**Summary:**
The legal report for the update to `perl-Mojolicious` (version 9.420.0) indicates only low risks according
to the license scanner. All detected licenses (Artistic-2.0, BSD-3-Clause, MIT, OFL-1.1, and CC-BY-SA-4.0)
are compatible with SUSE’s distribution policies. Unmatched license keyword snippets also reference
well-known open-source licenses without red flags. There are no significant unresolved legal issues.

**Reason:**
All risk findings are classified as low or minor. No action is required beyond the routine, and the update
should be approved for release to customers.

REST API

Compression

All responses larger than 860 bytes will be automatically gzip compressed for user-agents that include an Accept-Encoding: gzip header with their requests.

HTTP/1.1 200 Ok
Content-Length: 123
Content-Type: application/json
Vary: Accept-Encoding
Content-Encoding: gzip
...gzip binary data...

Diagnostics

GET /api/v1/whoami

Get information about the user this API key belongs to in JSON format.

Request:

GET /api/v1/whoami
Host: legaldb.suse.de
Authorization: Bearer generated_api_key_here

Response:

HTTP/1.1 200 OK
Content-Length: 24
Content-Type: application/json

{
  "id": 23,
  "user": "tester"
  "write_access": false
}

Locate Reports

GET /api/v1/reports

Get the package ids for legal reports.

Request parameters:

  • external_link (required): Short string describing the package source. Configured external_link_sources can render values like obs#123, ibs#123, soo#org/package!123 and ssd#org/package!123 as source links with labels.
GET /api/v1/reports?external_link=ibs%23123
Host: legaldb.suse.de
Authorization: Bearer generated_api_key_here
Accept: application/json

Response:

HTTP/1.1 200 OK
Content-Length: 44
Content-Type: application/json

{"reports": [
  {"id": 23},
  ...
]}

Search Packages

GET /api/v1/search

The programmatic equivalent of the web UI's search page: find packages by name, or by a vendored component they ship. The component filter is useful for security and supply-chain triage, for example locating every package that bundles a vulnerable dependency. Embargoed and obsolete packages are always excluded.

Request parameters (all optional; combine to narrow results, or omit all to page through every package):

  • name: Exact package name.
  • component: Case-insensitive substring matched against a vendored component's name and its purl. lodash matches every version, pkg:npm/lodash@4.17.20 pins one, pkg:npm/lodash@4.17 matches a prefix range.
  • limit: Maximum number of packages to return. Defaults to 25, maximum 100.
  • offset: Number of packages to skip, for pagination. Defaults to 0.

When you search by component, each returned package lists the components that matched, so you can see the exact version each one ships.

Request:

GET /api/v1/search?component=pkg:npm/lodash@4.17.19
Host: legaldb.suse.de
Authorization: Bearer generated_api_key_here
Accept: application/json

Response:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "total": 2,
  "start": 1,
  "end": 2,
  "packages": [
    {
      "id": 23,
      "name": "some-product",
      "state": "acceptable",
      "checksum": "AbCdEf",
      "components": [
        {"purl": "pkg:npm/lodash@4.17.19", "name": "lodash", "version": "4.17.19", "type": "npm", "license": "MIT"}
      ]
    }
  ]
}

Retrieve License Reports

GET /api/v1/report/<package_id>.<format>

Get legal report in plain text or JSON format. Additionally to txt and json, the extended report format used for MCP is available with the format identifier mcp. Note that the exact report format is not static and will change from time to time.

Request:

GET /api/v1/report/23.txt
Host: legaldb.suse.de
Authorization: Bearer generated_api_key_here

Response:

HTTP/1.1 200 OK
Content-Length: 1024
Content-Type: text/plain

# Legal Report

Package: perl-Mojolicious
Checkout: c7cfdab0e71b0bebfdf8b2dc3badfecd
Unpacked: 341 files (2.5MiB)


## System Notice

Diff to closest match 12345:

  Found new license MIT (risk 1) not present in old report


## Licenses

### Risk 1 (Low)

* BSD-3-Clause: 30 files
* MIT: 10 files
...

Retrieve SPDX Reports

GET /api/v1/spdx/<package_id>

Get the legal report as an SPDX 3.0.1 SBOM in JSON format, compliant with BSI TR-03183-2. Note that this report may be generated on demand, and in such cases the server will return a 408 error code until the report has been generated.

Request:

GET /api/v1/spdx/23
Host: legaldb.suse.de
Authorization: Bearer generated_api_key_here

Response:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-04-26T00:06:19Z",
      "createdBy": ["http://legaldb.suse.de/spdx/23#creator"],
      "createdUsing": ["http://legaldb.suse.de/spdx/23#tool-cavil"]
    },
    {
      "type": "software_Sbom",
      "spdxId": "http://legaldb.suse.de/spdx/23",
      "creationInfo": "_:creationInfo",
      "software_sbomType": ["source"],
      "rootElement": ["http://legaldb.suse.de/spdx/23#package"]
    },
    {
      "type": "software_Package",
      "spdxId": "http://legaldb.suse.de/spdx/23#package",
      "creationInfo": "_:creationInfo",
      "name": "perl-Mojolicious",
      "software_packageVersion": "7.25"
    }
  ]
}