Dependency-Track API
9 endpoints. Request and response schemas are described on the schemas page; the other tags are listed in the API index.
Endpoints
GET /api/v1/admin/dependency-track
Get the global Dependency-Track settings
Admin only. The API key is never returned.
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackSettings |
default | Error | application/json: Error |
PUT /api/v1/admin/dependency-track
Replace the global Dependency-Track settings
Admin only. Replaces the non-secret fields; api_key is write-only (omitted keeps it, empty clears it). Enabling needs a base URL and an API key. The URL must pass the outbound SSRF check. Project name and version are templates over {repo}, {name}, {version}, {artifact_id} and {format}.
Request body (required)
application/json: object
| Field | Type | Required | Description |
|---|---|---|---|
api_key | string | no | Plaintext API key. Omit to keep the stored one, empty string clears it. |
auto_push | boolean | no | - |
base_url | string | no | - |
enabled | boolean | yes | - |
project_name | string | no | - |
project_version | string | no | - |
push_vex | boolean | no | - |
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackSettings |
400 | Validation failed | - |
default | Error | application/json: Error |
POST /api/v1/admin/dependency-track/test
Test the global Dependency-Track connection
Admin only. Calls the server with the stored URL and key and reports its version and the API key's permissions against the ones the integration needs.
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackTest |
400 | Not configured, unreachable or key rejected | - |
default | Error | application/json: Error |
GET /api/v1/repositories/{name}/dependency-track
Get a repository's Dependency-Track settings
Admin only. Returns the repository override (null when none) and the effective configuration.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackRepository |
404 | Repository not found | - |
default | Error | application/json: Error |
PUT /api/v1/repositories/{name}/dependency-track
Set a repository's Dependency-Track override
Admin only. Empty strings and null booleans inherit the global settings.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Request body (required)
application/json: object
| Field | Type | Required | Description |
|---|---|---|---|
api_key | string | no | Plaintext API key. Omit to keep the stored one, empty string clears it. |
auto_push | boolean | no | Nullable. |
base_url | string | no | - |
enabled | boolean | yes | false opts the repository out even when the global integration is on. |
project_name | string | no | - |
project_version | string | no | - |
push_vex | boolean | no | Nullable. |
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackRepository |
400 | Validation failed | - |
404 | Repository not found | - |
default | Error | application/json: Error |
DELETE /api/v1/repositories/{name}/dependency-track
Remove a repository's Dependency-Track override
Admin only. The repository falls back to the global settings.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Responses
| Status | Description | Body |
|---|---|---|
204 | Removed | - |
404 | Repository or override not found | - |
default | Error | application/json: Error |
POST /api/v1/repositories/{name}/dependency-track/push
Push an artifact to Dependency-Track
Admin only. Queues the push of the artifact's CycloneDX BOM and, when push_vex is on, its VEX decisions; poll /pushes for the outcome.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Request body (required)
application/json: object
| Field | Type | Required | Description |
|---|---|---|---|
artifact_id | string | yes | name@version |
Responses
| Status | Description | Body |
|---|---|---|
202 | Queued | application/json: DependencyTrackPush |
400 | Validation failed | - |
404 | Repository not found | - |
409 | Integration not enabled for the repository, or queue full | - |
default | Error | application/json: Error |
GET /api/v1/repositories/{name}/dependency-track/pushes
List Dependency-Track pushes
Admin only. The last push of each artifact, newest first.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: object |
404 | Repository not found | - |
default | Error | application/json: Error |
Fields of the 200 response (application/json):
| Field | Type | Required | Description |
|---|---|---|---|
pushes | array of DependencyTrackPush | no | - |
POST /api/v1/repositories/{name}/dependency-track/test
Test a repository's Dependency-Track connection
Admin only. Uses the effective configuration.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | - |
Responses
| Status | Description | Body |
|---|---|---|
200 | Success | application/json: DependencyTrackTest |
400 | Not configured, unreachable or key rejected | - |
404 | Repository not found | - |
default | Error | application/json: Error |