Yes, for some ecosystems. The deps.dev API has a GetDependencies method that returns a resolved dependency graph for a given package version, and the documentation says it is available for npm, Cargo, Maven and PyPI. It models a generic Linux install, so it is not a substitute for your own lockfile.
What deps.dev is
deps.dev provides access to Open Source Insights data. The API documentation says it can be used by tool builders, researchers and tinkerers, and that you can call it with any HTTP client such as curl. For methods that use GET, required parameters go in the path and optional ones in the query string, all encoded for safe use in a URL.
Methods worth knowing
The documentation lists GetPackage, GetVersion, GetRequirements, GetDependencies, GetProject, GetProjectPackageVersions and GetAdvisory, plus a query method. For graph work, two matter.
| Method | What it returns |
|---|---|
| GetRequirements | The dependency constraints a version declares |
| GetDependencies | A resolved graph, the constraints turned into specific versions |
A requirement is a range, such as any version at or above some number. A resolved dependency is one concrete version chosen to satisfy it. A lockfile is a record of the second. GetDependencies computes the second from the first.
What the graph assumes
The documentation says the dependency graph should be similar to one produced by installing the package version on a generic 64 bit Linux system with no other dependencies present, and that the precise meaning varies by system. The response gives nodes, where the first node is the root.
That tells you what the answer is not. It does not reflect your platform, your other dependencies, your registry mirror or your pinned versions. It describes a package version in isolation.
Name handling
The documentation lists naming rules that affect any integration. Names generally follow the ecosystem, including capitalization. Maven names have the form group ID, colon, artifact ID. PyPI names are normalized under PEP 503. NuGet names are lowercased. Pass names the way the API expects or lookups will miss.
The system parameter takes values such as GO, RUBYGEMS, NPM, CARGO, MAVEN, PYPI and NUGET, but dependency resolution covers only the four ecosystems named above. Calling it for another one will not give a graph.
Coverage limits
The documentation notes some collection choices. For Maven, it gathers Maven Central plus the Jenkins, Gradle Plugins and Google registries. For PyPI, only wheels and source distributions. For Go, only modules fetched through the Go proxy and those declared as dependencies by them.
If your software depends on a private registry, a vendored copy or a fork, the public graph will not describe it.
When to use it
- Quick analysis of a package you are considering, before you add it.
- Research across many packages, where a local install of each is impractical.
- A sanity check against the graph your own tool produced.
When not to use it
- For the inventory of a shipped product. Use a lockfile or a scan of the build output.
- For an SBOM you will hand to a customer. It should reflect what you actually built.
- For air gapped environments, since it needs network access.
See is an SBOM the same as a lockfile for why the actual build record wins.
Try it yourself
Click through it at your own pace, or open it full screen. Expand the transitive entries and note how many components come from one direct dependency.
Where this fits
Resolved graphs are the starting point for reachability and vulnerability work. Safeguard offers SBOM and dependency scanning with reachability analysis, and the free scan can build the inventory for a real project.
Quick check
Does GetDependencies work for every ecosystem?
No. The documentation says dependencies are currently available for npm, Cargo, Maven and PyPI.
Is the returned graph the same as my lockfile?
Not necessarily. It resembles a fresh install on a generic Linux system, not your pinned build.
Sources
Last reviewed: 19 October 2026.
