API

The package registry, the scan queue and the rating history of one module are readable as JSON. Plain GET, no key, no CORS headers, so call it from a server or a script rather than another site's page. The badge is an SVG for a README.

Console

Endpoint Module path

`GET /api/packages`

Every known package in the order it was added, the std baseline row included, with its scan status and the overall rating of its newest rated scan. One document, no paging. Open.

Field	Meaning
`import_path`	the module path, as on the package page
`git_remote_addr`	derived from the path as `https://<import_path>.git`; not a record of where the code was fetched, which is the Go module proxy
`git_commit`	the module version that was scanned: a tag, a pseudo-version, or a `+incompatible` version; the Go release on the `std` row
`status`	`ok` once any version has scanned, `error` when none has. A newer version that fails keeps `ok` and records the reason in `error`
`error`	what the scanner recorded on the last failure, empty when the last scan succeeded
`license`	the license identifier found in the tree; `unknown` when a license file could not be classified; empty when none, or until the license pass runs after a version change
`has_license_copyright`	`1` when the license text carries a `Copyright (c) YEAR holder` line, else `0`
`size_bytes`	bytes of the module zip at the version sized, `0` until measured
`code_size`	bytes of the Go files read by the newest rated scan; a separate fetch from `size_bytes`, so it can exceed it
`rating`	the overall score of the newest rated scan, a number; `null` when nothing is rated yet
`created_at`, `updated_at`	UTC, `YYYY-MM-DD HH:MM:SS`, no zone designator. `updated_at` moves when the scanned version changes

`GET /api/queue`

The submission queue in submission order: what the scanner has waiting and how the past submissions went. Open.

Field	Meaning
`import_path`	the module path as submitted
`status`	`pending` until the scanner picks it up, then `ok` or `error`; `invalid` when the path is not a module path
`created_at`	when it was submitted, UTC
`updated_at`	when the scanner last changed the status; `null` while pending

`GET /api/history?package=`

The overall score of every rated scan of one module, in version order with non-version labels last, the way the history chart draws it. The path resolves the way a package page does, so a subpackage or a metaversion lands on its module; a module whose status is error answers like an unknown one: an empty package and an empty list.

Field	Meaning
`package`	the module path the query resolved to
`history`	a list, one entry per rated scan
`history[].git_commit`	the version scanned
`history[].score`	the overall rating of that scan
`history[].created_at`	when that version was scanned, UTC
`history[].rated_at`	when that scan was rated, UTC

`GET /badge/<module>`

The overall rating as an SVG badge, goreportcard style. The module path goes in as is, not percent-encoded. A path with no rated scan answers a grey n/a with status 200, so an image proxy keeps it and a README never shows a broken image. Responses are cached for an hour, the n/a too, and a README's image proxy adds its own cache: a module reads n/a until it is scanned, rated, and both caches have turned over.

For the README.md, the badge linking to the report:

[![goqu](https://goqu.incubator.to/badge/github.com/docker/cli)](https://goqu.incubator.to/github.com/docker/cli)