DevGuard License Risk API

Not every dependency problem is a vulnerability. A component under a copyleft license, or under no clearly detected license at all, can be just as blocking at release time. DevGuard tracks those separately as license risks, and this API manages them for an asset version.

License risks follow the same lifecycle as vulnerabilities: list what is open, read one in detail, append events as the assessment develops, and mitigate when the problem is resolved — by replacing the dependency, obtaining a license, or accepting the risk deliberately.

The final license decision endpoint is the one that settles the matter. Where automatic detection is wrong or ambiguous — a common outcome with dual-licensed or poorly declared packages — it records the license that actually applies, and that decision is what downstream SBOM and compliance output then reports.

Have feedback? We want to hear from you!

Fields marked with * are required