SPDX Licenses

Name: SPDX Licenses
Creator: staticdata.dev
License: https://opensource.org/licenses/MIT

Every license identifier in the SPDX License List — the canonical short identifiers (like MIT, Apache-2.0, and GPL-3.0-or-later) used in package manifests, SBOMs, and SPDX-License-Identifier headers. Each entry records the official full name, whether the license is OSI-approved, whether the identifier is deprecated, and a link to its SPDX reference page.

v1.0.0 MIT 740 records Updated 2026-10-05 stable Source: SPDX License List, spdx/license-list-data

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/spdx-licenses.json

Or use as a typed import: import { spdxLicenses } from "https://staticdata.dev/v1/spdx-licenses.ts"

Formats

JSON 143.8 KB

/v1/spdx-licenses.json

Open

min: 117.7 KB · /v1/spdx-licenses.min.json
CSV 73.7 KB

/v1/spdx-licenses.csv

Open
TypeScript 143.9 KB

/v1/spdx-licenses.ts

export const spdxLicenses

type SpdxLicense = (typeof spdxLicenses)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
id	string	SPDX short identifier	Apache-2.0
name	string	Full license name	Apache License 2.0
osiApproved	boolean	Approved by the Open Source Initiative	true
deprecated	boolean	Whether the SPDX identifier is deprecated	false
referenceUrl	string	SPDX reference page for the license	https://spdx.org/licenses/Apache-2.0.html

Preview

First 10 records.

Data preview
id	name	osiApproved	deprecated	referenceUrl
0BSD	BSD Zero Clause License	true	false	https://spdx.org/licenses/0BSD.html
3D-Slicer-1.0	3D Slicer License v1.0	false	false	https://spdx.org/licenses/3D-Slicer-1.0.html
AAL	Attribution Assurance License	true	false	https://spdx.org/licenses/AAL.html
Abstyles	Abstyles License	false	false	https://spdx.org/licenses/Abstyles.html
AdaCore-doc	AdaCore Doc License	false	false	https://spdx.org/licenses/AdaCore-doc.html
Adobe-2006	Adobe Systems Incorporated Source Code License Agreement	false	false	https://spdx.org/licenses/Adobe-2006.html
Adobe-Display-PostScript	Adobe Display PostScript License	false	false	https://spdx.org/licenses/Adobe-Display-PostScript.html
Adobe-Glyph	Adobe Glyph List License	false	false	https://spdx.org/licenses/Adobe-Glyph.html
Adobe-Utopia	Adobe Utopia Font License	false	false	https://spdx.org/licenses/Adobe-Utopia.html
ADSL	Amazon Digital Services License	false	false	https://spdx.org/licenses/ADSL.html

Showing 10 of 740. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/spdx-licenses.json | jq '.[0]'

JavaScript

import type { SpdxLicense } from "https://staticdata.dev/v1/spdx-licenses.ts";

const res = await fetch("https://staticdata.dev/v1/spdx-licenses.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const spdxLicenses: SpdxLicense[] = await res.json();
console.log(spdxLicenses[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/spdx-licenses.min.json") as r:
    spdxLicenses = json.load(r)

print(spdxLicenses[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/spdx-licenses.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/spdx-licenses.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The data is generated from the official SPDX License List as published in the spdx/license-list-data repository (json/licenses.json). Every license identifier in SPDX License List version 3.29.0 (released 2026-09-16, current as of October 2026) is included — 740 entries, sorted by id. License exceptions (e.g. Classpath-exception-2.0) are a separate SPDX list and are not included. The SPDX License List data is published under CC0-1.0, so relicensing this dataset as MIT is permitted.

id is the value you put after SPDX-License-Identifier: in source files and in the license field of package.json, Cargo.toml, and similar manifests. Use the identifier verbatim. The SPDX specification says identifiers should be matched case-insensitively, but tools commonly compare them exactly, so keep the canonical casing.

deprecated flags identifiers that SPDX still recognizes but no longer recommends (for example GPL-3.0 and LGPL-2.1, superseded by the explicit -only / -or-later forms). They remain in the list so existing manifests keep validating; prefer the non-deprecated identifier for new projects.

osiApproved reflects whether the Open Source Initiative has approved the license. A license can be a legitimate, widely used open-source license without OSI approval, so treat this as one signal rather than a definitive open-source test. SPDX license expressions (e.g. MIT OR Apache-2.0, GPL-2.0-or-later WITH Classpath-exception-2.0) are composed from these identifiers but are not themselves entries in this dataset.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the spdx-licenses changelog for this dataset's history.

Related datasets

tlds