---
title: "List assets SBOMs"
method: GET
path: "/api/v2/security/sboms"
tags: ["Security Monitoring"]
---

# List assets SBOMs

`GET /api/v2/security/sboms`

Get a list of assets SBOMs for an organization.

The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided).
Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required
for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`)
with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error.

### Pagination

Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.

### Filtering

Please review the [Filtering section](#filtering) for the "List Vulnerabilities" endpoint.

### Metadata

Please review the [Metadata section](#metadata) for the "List Vulnerabilities" endpoint.

## Query parameters

- `page[token]` string
- `page[number]` integer
- `filter[asset_type]` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction' — The asset type
- `filter[asset_name]` string
- `filter[package_name]` string
- `filter[package_version]` string
- `filter[license_name]` string
- `filter[license_type]` 'network_strong_copyleft' | 'non_standard_copyleft' | 'other_non_free' | 'other_non_standard' | 'permissive' | 'public_domain' | 'strong_copyleft' | 'weak_copyleft' — The SBOM component license type.

## Response `200`

OK

- ListAssetsSBOMsResponse — The expected response schema when listing assets SBOMs.
  - `data` SBOM[], required — List of assets SBOMs.
    - `attributes` SBOMAttributes — The JSON:API attributes of the SBOM.
      - `bomFormat` string, required — Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOM do not have a filename convention nor does JSON schema support namespaces. This value MUST be `CycloneDX`.
      - `components` SBOMComponent[], required — A list of software and hardware components.
        - `bom-ref` string — An optional identifier that can be used to reference the component elsewhere in the BOM.
        - `licenses` SBOMComponentLicense[] — The software licenses of the SBOM component.
          - `license` SBOMComponentLicenseLicense, required — The software license of the component of the SBOM.
            - `name` string, required — The name of the software license of the component of the SBOM.
        - `name` string, required — The name of the component. This will often be a shortened, single name of the component.
        - `properties` SBOMComponentProperty[] — The custom properties of the component of the SBOM.
          - `name` string, required — The name of the custom property of the component of the SBOM.
          - `value` string, required — The value of the custom property of the component of the SBOM.
        - `purl` string — Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the [specification](https://github.com/package-url/purl-spec).
        - `supplier` SBOMComponentSupplier, required — The supplier of the component.
          - `name` string, required — Identifier of the supplier of the component.
        - `type` 'application' | 'container' | 'data' | 'device' | 'device-driver' | 'file' | 'firmware' | 'framework' | 'library' | 'machine-learning-model' | 'operating-system' | 'platform', required — The SBOM component type
        - `version` string, required — The component version.
      - `dependencies` SBOMComponentDependency[], required — List of dependencies between components of the SBOM.
        - `dependsOn` string[] — The components that are dependencies of the ref component.
        - `ref` string — The identifier for the related component.
      - `metadata` SBOMMetadata, required — Provides additional information about a BOM.
        - `authors` SBOMMetadataAuthor[] — List of authors of the SBOM.
          - `name` string — The identifier of the Author of the SBOM.
        - `component` SBOMMetadataComponent — The component that the BOM describes.
          - `name` string — The name of the component. This will often be a shortened, single name of the component.
          - `type` string — Specifies the type of the component.
        - `timestamp` string — The timestamp of the SBOM creation.
      - `serialNumber` string, required — Every BOM generated has a unique serial number, even if the contents of the BOM have not changed overt time. The serial number follows [RFC-4122](https://datatracker.ietf.org/doc/html/rfc4122)
      - `specVersion` '1.0' | '1.1' | '1.2' | '1.3' | '1.4' | '1.5', required — The version of the CycloneDX specification a BOM conforms to.
      - `version` integer, required — It increments when a BOM is modified. The default value is 1.
    - `id` string — The unique ID for this SBOM (it is equivalent to the `asset_name` or `asset_name@repo_digest` (Image)
    - `type` 'sboms' — The JSON:API type.
  - `links` Links — The JSON:API links related to pagination.
    - `first` string, required — First page link.
    - `last` string, required — Last page link.
    - `next` string — Next page link.
    - `previous` string — Previous page link.
    - `self` string, required — Request link.
  - `meta` Metadata — The metadata related to this request.
    - `count` integer, required — Number of entities included in the response.
    - `token` string, required — The token that identifies the request.
    - `total` integer, required — Total number of entities across all pages.

## Other responses

- `400` — Bad request: The server cannot process the request due to invalid syntax in the request.
- `403` — Forbidden: Access denied
- `404` — Not found: asset not found
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)