<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Software Composition Governance — API Reference

## FOSSA CLI

```bash
# Initialize FOSSA project
fossa init

# Run analysis
fossa analyze --branch main

# Test against policies
fossa test --timeout 600 --json

# List project dependencies
fossa list-deps --json
```

## OPA Policy Engine

```bash
# Evaluate policy
opa eval -i input.json -d policy.rego "data.composition.deny"

# Run policy tests
opa test policy/ -v

# Bundle policies for distribution
opa build -b policy/ -o bundle.tar.gz
```

## License Detection

```bash
# Scan with scancode-toolkit
scancode -clpieu --json-pp output.json /path/to/source

# Extract SPDX license identifiers
jq '[.files[].licenses[].spdx_license_key] | unique' output.json

# Check license compatibility
license-expression parse "MIT AND Apache-2.0"
```

