@manuel.riezebosch_8638 the purl argument was never actually read, so you could have really put anything in there :) It was just one of those docs error; many other api endpoints will use a purl argument And you're right... all the other package types have metadata inside the package, so that's what's read. Some require a file name, but Debian is an outlier in that it requires a distribution argument as well.