Skip to main content

Download the scan's SBOM (CycloneDX 1.5 or SPDX 2.3 JSON).

GET 
/v1/reports/:scan_id/sbom

Rendered from the scan's durable dependency-scan artifact: the full pinned-component inventory, with OSV advisories embedded in the CycloneDX variant. 404 for scans without a dependency inventory (remote scans, dependency scan disabled, or no pinned dependencies).

Request​

Responses​

The SBOM document as an attachment.