REST API endpoints for license compliance

Get the license compliance policy for an enterprise

Gets the license compliance policy for an enterprise.

Currently, only the policy with the ID default is supported.

The authenticated user must be an enterprise owner, or have the "View enterprise license policy" or "Edit enterprise license policy" fine-grained permission on the enterprise.

Fine-grained access tokens for "Get the license compliance policy for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise license policy" enterprise permissions (read)

Parameters for "Get the license compliance policy for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`policy_id` string Required The unique identifier of the policy within the enterprise. Currently, only `default` is supported.

HTTP response status codes for "Get the license compliance policy for an enterprise"

Status code	Description
`200`	OK
`404`	Resource not found
`503`	Service unavailable

Code samples for "Get the license compliance policy for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

get/enterprises/{enterprise}/license-compliance/policies/{policy_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/license-compliance/policies/POLICY_ID

Response

Status: 200

{
  "created_at": "2026-09-22T12:00:00Z",
  "licenses": {
    "allowed": [
      {
        "spdx_id": "MIT",
        "added_at": "2026-09-22T12:00:00Z"
      }
    ]
  },
  "packages": [
    {
      "package_manager": "npm",
      "name": "example-package",
      "action": "allowed",
      "reason": "Approved exception.",
      "extra_allowed_spdx_ids": [
        "MIT"
      ],
      "added_at": "2026-09-22T12:00:00Z"
    }
  ]
}

Set the license compliance policy for an enterprise

Sets the license compliance policy for an enterprise.

Currently, only the policy with the ID default is supported.

The authenticated user must be an enterprise owner, or have the "Edit enterprise license policy" fine-grained permission on the enterprise.

Fine-grained access tokens for "Set the license compliance policy for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise license policy" enterprise permissions (write)

Parameters for "Set the license compliance policy for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`policy_id` string Required The unique identifier of the policy within the enterprise. Currently, only `default` is supported.

Name, Type, Description

licenses object Required

Properties of licenses

Name, Type, Description

allowed array of objects Required

The licenses allowed by this policy.

Properties of allowed

Name, Type, Description
`spdx_id` string Required The SPDX identifier of the license.
`added_at` string or null Required The time the license was added to the policy.

packages array of objects Required

The package-level exceptions in this policy.

Properties of packages

Name, Type, Description
`package_manager` string Required The package manager the package belongs to. Can be one of: `unknown`, `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `gomod`, `rust`, `actions`, `pub`, `swift`
`name` string Required The name of the package.
`action` string Required How the package is treated by the policy. Can be one of: `unknown`, `allowed`, `private`
`reason` string Required The reason the exception was added.
`extra_allowed_spdx_ids` array of strings Required Additional SPDX identifiers allowed for this package.
`added_at` string or null Required The time the exception was added to the policy.

HTTP response status codes for "Set the license compliance policy for an enterprise"

Status code	Description
`204`	A header with no content is returned.
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Set the license compliance policy for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

put/enterprises/{enterprise}/license-compliance/policies/{policy_id}

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/license-compliance/policies/POLICY_ID \
  -d '{"licenses":{"allowed":[{"spdx_id":"MIT","added_at":"2026-09-22T12:00:00Z"}]},"packages":[{"package_manager":"npm","name":"example-package","action":"allowed","reason":"Approved exception.","extra_allowed_spdx_ids":["MIT"],"added_at":"2026-09-22T12:00:00Z"}]}'

A header with no content is returned.

Status: 204

Check license compliance for packages

Checks whether packages identified by the supplied package URLs (PURLs) are allowed by the repository's license compliance policy.

For requests made on behalf of a user, that user must have write access to the repository or the "View repository license policy" permission. OAuth apps and classic personal access tokens require the repo scope.

Fine-grained access tokens for "Check license compliance for packages"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Repository license policy" repository permissions (read)

Parameters for "Check license compliance for packages"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.

Body parameters
Name, Type, Description
`purls` array of strings Required Up to 40 package URLs to check against the license compliance policy. Duplicate package URLs count toward the limit but are checked once.

HTTP response status codes for "Check license compliance for packages"

Status code	Description
`200`	Package license compliance results.
`403`	Forbidden
`404`	License compliance policy not found.
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Check license compliance for packages"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request examples

Select the example type

post/repos/{owner}/{repo}/license-compliance/package-checks

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/OWNER/REPO/license-compliance/package-checks \
  -d '{"purls":["pkg:npm/lodash@4.17.21"]}'

Package license compliance results.

Status: 200

{
  "purls": {
    "pkg:npm/lodash@4.17.21": {
      "status": "allowed",
      "license": "MIT",
      "reason": "allowed_license"
    }
  }
}

Get the license compliance policy for an enterprise

Fine-grained access tokens for "Get the license compliance policy for an enterprise"

Parameters for "Get the license compliance policy for an enterprise"

HTTP response status codes for "Get the license compliance policy for an enterprise"

Code samples for "Get the license compliance policy for an enterprise"

Request example

Response

Set the license compliance policy for an enterprise

Fine-grained access tokens for "Set the license compliance policy for an enterprise"

Parameters for "Set the license compliance policy for an enterprise"

HTTP response status codes for "Set the license compliance policy for an enterprise"

Code samples for "Set the license compliance policy for an enterprise"

Request example

A header with no content is returned.

Check license compliance for packages

Fine-grained access tokens for "Check license compliance for packages"

Parameters for "Check license compliance for packages"

HTTP response status codes for "Check license compliance for packages"

Code samples for "Check license compliance for packages"

Request examples

Package license compliance results.

Was this Doc helpful?

Help us make GitHub Docs great!

Still need help?