---
title: "Export a software bill of materials (SBOM) for a repository."
method: GET
path: "/repos/{owner}/{repo}/dependency-graph/sbom"
tags: ["dependency-graph"]
---

# Export a software bill of materials (SBOM) for a repository.

`GET /repos/{owner}/{repo}/dependency-graph/sbom`

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

## Path parameters

- `owner` string, required
- `repo` string, required

## Response `200`

Response

- DependencyGraphSpdxSbom — A schema for the SPDX JSON format returned by the Dependency Graph.
  - `sbom` object, required
    - `SPDXID` string, required — The SPDX identifier for the SPDX document.
    - `spdxVersion` string, required — The version of the SPDX specification that this document conforms to.
    - `comment` string — An optional comment about the SPDX document.
    - `creationInfo` object, required
      - `created` string, required — The date and time the SPDX document was created.
      - `creators` string[], required — The tools that were used to generate the SPDX document.
    - `name` string, required — The name of the SPDX document.
    - `dataLicense` string, required — The license under which the SPDX document is licensed.
    - `documentNamespace` string, required — The namespace for the SPDX document.
    - `packages` object[], required
      - `SPDXID` string — A unique SPDX identifier for the package.
      - `name` string — The name of the package.
      - `versionInfo` string — The version of the package. If the package does not have an exact version specified, a version range is given.
      - `downloadLocation` string — The location where the package can be downloaded, or NOASSERTION if this has not been determined.
      - `filesAnalyzed` boolean — Whether the package's file content has been subjected to analysis during the creation of the SPDX document.
      - `licenseConcluded` string — The license of the package as determined while creating the SPDX document.
      - `licenseDeclared` string — The license of the package as declared by its author, or NOASSERTION if this information was not available when the SPDX document was created.
      - `supplier` string — The distribution source of this package, or NOASSERTION if this was not determined.
      - `copyrightText` string — The copyright holders of the package, and any dates present with those notices, if available.
      - `externalRefs` object[]
        - `referenceCategory` string, required — The category of reference to an external resource this reference refers to.
        - `referenceLocator` string, required — A locator for the particular external resource this reference refers to.
        - `referenceType` string, required — The category of reference to an external resource this reference refers to.
    - `relationships` object[]
      - `relationshipType` string — The type of relationship between the two SPDX elements.
      - `spdxElementId` string — The SPDX identifier of the package that is the source of the relationship.
      - `relatedSpdxElement` string — The SPDX identifier of the package that is the target of the relationship.

## Other responses

- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)