v68

latestOpenAPI 3.0.3MITraw.githubusercontent.com2026-08-011,21696712.3 MB

dependency-graph

Export a software bill of materials (SBOM) for a repository.

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

get/repos/{owner}/{repo}/dependency-graph/sbom

Path parameters

ownerstring required

The account owner of the repository. The name is not case sensitive.

repostring required

The name of the repository without the .git extension. The name is not case sensitive.

Response

Example response

{
  "sbom": {
    "SPDXID": "SPDXRef-DOCUMENT",
    "spdxVersion": "SPDX-2.3",
    "comment": "Exact versions could not be resolved for some packages. For more information: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/",
    "creationInfo": {
      "created": "2021-11-03T00:00:00Z",
      "creators": [
        "GitHub"
      ]
    },
    "name": "github/github",
    "dataLicense": "CC0-1.0",
    "documentNamespace": "https://spdx.org/spdxdocs/protobom/15e41dd2-f961-4f4d-b8dc-f8f57ad70d57",
    "packages": [
      {
        "SPDXID": "SPDXRef-Package",
        "name": "github/github",
        "versionInfo": "1.0.0",
        "downloadLocation": "NOASSERTION",
        "licenseConcluded": "MIT",
        "licenseDeclared": "NOASSERTION",
        "supplier": "NOASSERTION",
        "copyrightText": "Copyright (c) 1985 GitHub.com",
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceLocator": "pkg:gem/rails@6.0.1",
            "referenceType": "purl"
          }
        ]
      }
    ],
    "relationships": [
      {
        "relationshipType": "DEPENDS_ON"
      }
    ]
  }
}