Download The CLM Book - Optimized Component Lifecycle Management with

The CLM Book - Optimized Component Lifecycle Management with Sonatype CLM
20.8
304 / 330
Component Evaluation REST APIs (v2)
The Component Evaluation REST API allows for a single component, or multiple components to be
evaluated against a specific application, and the associated policies.
This API uses the following REST resources:
• POST - to submit a component or list of components, as well as the application containing the polices
the component(s) will be evaluated against.
• GET - to check the status of the evaluation and retrieve the results when completed.
For the API we provide a step-by-step example using the HTTP client CURL, though any HTTP client tool
could be used. In addition we’ll reference other APIs such as the one required to obtain an application’s
internal ID.
Step 1 - Get Component Information
First, you need to decide which components you want to evaluate. You’ll need a bit of component information in the form of the GAVE (Group, Artifact, Version, and Extension) or the hash for each component
you wish to evaluate.
There are a variety of ways to get the GAVE, the most common is to get the information from the repository that houses the component. For example, The Central Repository has the GAVE for all components
stored there.
If you wish to use the hash, Sonatype uses sha1 for all components it processes.
Tip
Only components known to Sonatype will provide security, license, and popularity data related to policies. However, depending on the policies for the application you choose to evaluate the component
against, other policy conditions, such as match state, will help in determining if the component is known
to your instance of CLM.