curl -X POST 'https://api.github.com/repos/example-owner/example-repo/dependency-graph/snapshots' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "version": 0,
  "job": {
    "id": "5622a2b0-63f6-4732-8c34-a1ab27e102a11",
    "correlator": "yourworkflowname_yourjobname",
    "html_url": "http://example.com/build"
  },
  "sha": "ddc951f4b1293222421f2c8df679786153acf689",
  "ref": "refs/heads/main",
  "detector": {
    "name": "docker buildtime detector",
    "version": "1.0.0",
    "url": "http://example.com/docker-buildtimer-detector"
  },
  "scanned": "2020-06-13T14:52:50-05:00"
}'

# POST /repos/{owner}/{repo}/dependency-graph/snapshots (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create a snapshot of dependencies for a repository

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/repos/example-owner/example-repo/dependency-graph/snapshots' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "version": 0,
  "job": {
    "id": "5622a2b0-63f6-4732-8c34-a1ab27e102a11",
    "correlator": "yourworkflowname_yourjobname",
    "html_url": "http://example.com/build"
  },
  "sha": "ddc951f4b1293222421f2c8df679786153acf689",
  "ref": "refs/heads/main",
  "detector": {
    "name": "docker buildtime detector",
    "version": "1.0.0",
    "url": "http://example.com/docker-buildtimer-detector"
  },
  "scanned": "2020-06-13T14:52:50-05:00"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| version | body | integer | Yes | The version of the repository snapshot submission. |
| job | body | object | Yes | Request body field job. |
| sha | body | string | Yes | The commit SHA associated with this dependency snapshot. Maximum length: 64 c... |
| ref | body | string | Yes | The repository branch that triggered this snapshot. |
| detector | body | object | Yes | A description of the detector used. |
| scanned | body | string | Yes | The time at which the snapshot was scanned. |
Other params: metadata, manifests

## Response example
{"id":0,"created_at":"string","result":"string","message":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /repos/{owner}/{repo}/dependency-graph/snapshots — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create a snapshot of dependencies for a repository

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 394 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/repos/example-owner/example-repo/dependency-graph/snapshots' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "version": 0,  "job": {    "id": "5622a2b0-63f6-4732-8c34-a1ab27e102a11",    "correlator": "yourworkflowname_yourjobname",    "html_url": "http://example.com/build"  },  "sha": "ddc951f4b1293222421f2c8df679786153acf689",  "ref": "refs/heads/main",  "detector": {    "name": "docker buildtime detector",    "version": "1.0.0",    "url": "http://example.com/docker-buildtimer-detector"  },  "scanned": "2020-06-13T14:52:50-05:00"}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
version	body	integer	Yes	The version of the repository snapshot submission.
job	body	object	Yes	Request body field job.
sha	body	string	Yes	The commit SHA associated with this dependency snapshot. Maximum length: 64 characters.
ref	body	string	Yes	The repository branch that triggered this snapshot.
detector	body	object	Yes	A description of the detector used.
metadata	body	object	No	User-defined metadata to store domain-specific information limited to 8 keys with scalar values.
manifests	body	object	No	A collection of package manifests, which are a collection of related dependencies declared in a file or representing a logical group of dependencies.
scanned	body	string	Yes	The time at which the snapshot was scanned.

Response 200 OK

{
  "id": 0,
  "created_at": "string",
  "result": "string",
  "message": "string"
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.