Check package compliance

post

{protocol}://{host}:{port}/xray/api/v1/curation/compliance

Check whether a package version is allowed by Curation policies and, when it is blocked, return compliant alternatives when they exist.

Requires a user with READ permissions. Curation must be enabled.

Supported package_type values are npm, PyPI, Gems, NuGet, Maven, Gradle, and SBT. Other curated types (for example Docker) return HTTP 400.

CLI and other non-agent callers must send remote_source_url (typically the Artifactory download URL). Agent callers set X-JFrog-Curation-Agentic-Request to true and must send package_version. Gradle and SBT use the same Artifactory path layout as Maven.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

package_name

string

required

Package name. For Maven, Gradle, and SBT, use groupId:artifactId.

package_type

string

enum

required

Package types accepted by the Compliance API. Values are case-insensitive and normalized to these PrettyName strings.

Allowed:

package_version

string

Package version. Required when X-JFrog-Curation-Agentic-Request is true.

remote_source_url

uri

Artifactory or public download URL used to resolve the curated repository. Required for CLI and other non-agent callers. Gradle and SBT URLs use the Maven repository layout.

Headers

X-JFrog-Curation-Agentic-Request

string

enum

Set to true when the caller is an LLM agent. Agent requests require package_version and do not require remote_source_url.

Allowed:

Responses

Language

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Compliance result.

400Missing required field, unsupported package type, invalid remote_source_url, or empty package_version on a non-agent request.

403Curation is not enabled for this JFrog Platform.

500Internal compliance check error.