REST API endpoints for license compliance

Check license compliance for packages

Checks whether packages identified by the supplied package URLs (PURLs) are allowed by the repository's license compliance policy.

For requests made on behalf of a user, that user must have write access to the repository or the "View repository license policy" permission. OAuth apps and classic personal access tokens require the repo scope.

Fine-grained access tokens for "Check license compliance for packages"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Repository license policy" repository permissions (read)

Parameters for "Check license compliance for packages"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.

Body parameters
Name, Type, Description
`purls` array of strings Required Package URLs to check against the license compliance policy. Duplicate package URLs are checked once.

HTTP response status codes for "Check license compliance for packages"

Status code	Description
`200`	Package license compliance results.
`403`	Forbidden
`404`	License compliance policy not found.
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Check license compliance for packages"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request examples

Select the example type

post/repos/{owner}/{repo}/license-compliance/package-checks

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/OWNER/REPO/license-compliance/package-checks \
  -d '{"purls":["pkg:npm/lodash@4.17.21"]}'

Package license compliance results.

Status: 200

{
  "purls": {
    "pkg:npm/lodash@4.17.21": {
      "status": "allowed",
      "license": "MIT",
      "reason": "allowed_license"
    }
  }
}