Welcome to Support Portal

Overview

The Dependencies tab in the Aqua Console and the Supply Chain dependencies API return results for a specific repository branch. When the console shows no dependencies for a branch, but an API response appears to list packages, the difference is usually the branch filter applied to each request—not inconsistent data between UI and API.

This article explains how Aqua tracks dependencies per branch and how to align console and API queries.

Symptoms

• The Dependencies page shows zero dependencies for a repository on branch main
• An API export or local search of a dependencies response shows packages such as chromadb
• Apparent mismatch between console and API for the same repository

How Dependency Data Is Scoped

Aqua tracks dependencies and vulnerabilities per branch (and per build/scan associated with that branch).

The Builds tab helps correlate scan history, branch, and dependency outcomes.

Aligning API Requests with the Console

When comparing API output to the UI, use the same repository ID and branch.

Example API pattern:

GET /supply_chain/v2/build/repositories/{repository_id}/dependencies?page=1&page_size=10&export_format=cyclonedx&branch=main

If branch=main returns no dependencies, that matches an empty Dependencies view for main in the console.

Searching a large export file that was generated without a branch filter—or with a different branch—can surface packages that belong to another branch’s scan.

Recommended checks

• Note the branch selected in the Aqua Console Dependencies view
• Add the same branch query parameter to the API call
• Compare results for the same repository_id and branch only
• Use Builds to confirm which branches were scanned and when

Verification and Monitoring

• Select branch main in the UI and record dependency count
• Call the dependencies API with branch=main and confirm the same outcome
• Repeat for other active branches (for example develop) where dependencies are expected

Platform Coverage