Dependency packages

Creating, editing, validating, building, and deleting requires dep_packages.write; reading requires dep_packages.read. Owners, admins, and developers can manage packages, while viewers can inspect them. Full models are in the OpenAPI reference.

Create a package

curl --fail-with-body -X POST "$DAGY_API_URL/dep-packages" \
  -H "Authorization: Bearer $DAGY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"Commerce HTTP client",
    "description":"Libraries used by order ingestion flows",
    "python_version":"3.12",
    "dependencies":[{"name":"httpx","version_spec":"==0.28.1"}]
  }'

The version above is an example pin; choose and test the release your application requires. The 201 response contains package_id, slug, name, Python version, dependencies, validation/build status, and timestamps. Save both identifiers: use package_id for management and the returned slug when attaching it to a deployment.

Supported requested Python versions are 3.10, 3.11, 3.12, and 3.13, with default 3.12. Choose a version compatible with the actual execution runtime; choosing a package version does not change the runtime's interpreter. Creation requires at least one dependency and allows at most 200. Duplicate dependency names are consolidated; supply each intended package once.

Validate and build

1. Call POST /dep-packages/{package_id}/validate.
2. Inspect valid, resolved, conflicts, and warnings. Correct conflicts before release.
3. Call POST /dep-packages/{package_id}/build.
4. Poll GET /dep-packages/{package_id} until packaging_status is COMPLETED or FAILED.

Example successful validation:

{"valid":true,"resolved":["httpx==0.28.1"],"conflicts":null,"warnings":null}

Actual resolved output includes transitive dependencies and may contain additional requirements. A build revalidates when the dependency definition changed. Validation failure during build returns 422 with detail.validation_errors.

Build submission returns 202 with message and the updated package. Possible build states include IDLE, QUEUED, INSTALLING, PACKAGING, UPLOADING, COMPLETED, and FAILED. Follow current_dependency, error_message, and build logs for progress. A successful submission does not mean the package is ready.

Validation has a two-minute resolution timeout. A timeout or unavailable build capability needs investigation; repeatedly starting builds will not fix an incompatible dependency set.

Attach a completed package

Use the returned slug in a deployment:

PUT /deployments/orders-develop/settings

{"dep_package_slugs":["YOUR_PACKAGE_SLUG"]}

Or attach during CLI deploy:

dagy deploy /PATH/TO/artifact.zip --deployment orders-develop \
  --dep-packages YOUR_PACKAGE_SLUG --yes

The settings array replaces all current attachments. Send [] to remove them. Use only completed packages, then run a small import/functional check in the selected runtime. Version resolution passing does not guarantee native wheels or system-library compatibility. Runtime support differs; verify the chosen execution mode with your actual dependencies.

Updating dependencies resets validation; it does not rebuild automatically. The package can still show a previous completed build, so explicitly validate and build the changed definition before relying on it. For reproducible releases, create a separate package for a materially different dependency set rather than changing a shared one under several deployments.

Environment promotion does not preserve dependency-package attachments. Reapply the target deployment's slugs after promoting.

Inspect and manage packages

Do not put signed download URLs in long-lived configuration. Request a fresh URL when needed and do not attach the Dagy bearer token when fetching it. Remove deployment references before deleting a package that existing flows use.

Common problems

Dependency packages install Python requirements. They do not automatically package unrelated local source files or provision external databases and services. Use saved connectors for supported connection settings and deployment for flow source.