# Composer Scan API Reference

Which of a site's `drupal/*` packages need a new release for a target
core, and which have none? One POST with the site's composer files replaces a
lookup per package.

## POST /v1/composer/scan

```json
{"composer_json": "<composer.json text>",
 "composer_lock": "<composer.lock text>",
 "target_core": "11.4"}
```

- `composer_lock` — required; the file, or the slim form
  `{"packages":[{"name":"drupal/webform","version":"6.2.9"}]}` with only
  `drupal/*` packages.
- `composer_json` — optional; adds the constraints and `extra.patches`.
- `target_core` — `11.4` or `11.4.5`; empty scans against the installed core (`target_is_installed`): what can be updated without a core upgrade. Constraints are read by composer's own semver library.
- Body at most 4 MB; at most 400 packages.

## Response

`{target_core, core_installed, bundle_date, counts, rows, patches, unlocked}`.
`rows` is ranked: `no_release` (no published release supports the target;
`latest_any` and `dev_branch` say what exists), `update` (a compatible
release the site does not have: `latest`, `latest_date`, `latest_core`),
`unknown` (not a drupal.org project in the bundle), `current`.
`patches` is `extra.patches` as `/v1/patch/check` items with the installed
version filled in. `bundle_date` is when the release data was published:
a release after it is invisible here.