{"uid":"cap_nPHXZcgbQFCK3vqQdHxaO","slug":"spdx-package-file-sha1-verification-code-reconstruction-7071fc5f","name":"SPDX Package File SHA1 Verification Code Reconstruction","description":"Reconstruct an SPDX package verification code from its file SHA1 inventory and declared exclusions.","url":"https://detect.halowerk.com/v1/F-TD2000-DOCUMENTS-01/spdx-package-file-sha1-verification-code-reconstruction?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"artifact":{"type":"object","required":["packageVerification"],"properties":{"packageVerification":{"type":"object","required":["data","claim"],"properties":{"data":{"type":"object","required":["files","excluded"],"properties":{"files":{"type":"array","items":{"type":"object","required":["name","sha1"],"properties":{"name":{"type":"string","maxLength":64},"sha1":{"type":"string","pattern":"^[0-9a-f]{40}$"}},"additionalProperties":false},"maxItems":128,"minItems":0},"excluded":{"type":"array","items":{"type":"string","maxLength":64},"maxItems":128,"minItems":0}},"additionalProperties":false},"claim":{"anyOf":[{"type":"null"},{"type":"object","required":["excluded_files","included_files","verification_code"],"properties":{"excluded_files":{"type":"array","items":{"type":"string","maxLength":20000},"maxItems":4096},"included_files":{"type":"array","items":{"type":"string","maxLength":20000},"maxItems":4096},"verification_code":{"type":"string","maxLength":20000}},"additionalProperties":false}]}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_hcusYNdUEN8jQ4FhP5jVN","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reconstructs an SPDX package verification code from a list of file names with their SHA1 hashes and a set of declared exclusions.","exampleAgentPrompt":"Reconstruct the SPDX package verification code for a package whose files include 'src/main.c' with SHA1 'da39a3ee5e6b4b0d3255bfef95601890afd80709' and 'src/util.c' with SHA1 'adc83b19e793491b1c6ea0fd8b46cd9f32e592fc', excluding the file 'build/artifact.bin'.","exampleUseCases":[{"title":"SBOM generation for open source package","prompt":"I'm generating an SBOM for our open source library and need the SPDX PackageVerificationCode — here are all the file names and their SHA1 hashes, and I want to exclude the file 'Makefile' from the verification."},{"title":"Auditing a claimed SPDX verification code","prompt":"We received an SPDX document with a PackageVerificationCode claim and I want to check whether it's correct — here's the list of files with their SHA1s and the declared exclusions from the document, can you reconstruct the code and compare it to the claim?"},{"title":"CI pipeline SPDX integrity check","prompt":"In our CI pipeline after building the package, compute the SPDX package verification code from these 50 files and their SHA1 checksums, excluding '.gitignore' and 'LICENSE', so we can stamp it into the SPDX manifest."}],"resultDescription":"Returns the reconstructed SPDX PackageVerificationCode string along with the lists of included and excluded files used in the computation, optionally compared against a provided claim.","failureModes":["Invalid SHA1 format (not 40 lowercase hex characters) causes validation error","File name exceeds 64-character limit returns schema error","More than 128 files or exclusions submitted exceeds array limits","Malformed claim object (missing required fields) returns error","Network timeout or service unavailability returns HTTP 5xx"],"whenToPreferThis":"Choose this endpoint when you need a standards-compliant SPDX PackageVerificationCode computed from a file SHA1 inventory with explicit exclusion support, especially in SBOM generation, software supply chain auditing, or license compliance workflows where verifying or reconstructing SPDX package integrity is required.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-04T06:40:54.189Z","isFirstParty":false,"canonicalSlug":"spdx-package-file-sha1-verification-code-reconstruction-7071fc5f"}