Sign in

v1

latestOpenAPI 3.0.12026-08-06151265417.9 KB
Reports

Export application SBOM report asynchronously (Dependencies - SCA)

post/api/v3.0/applications/{applicationUuid}/dependencies/reports/SBOM

Path parameters

applicationUuidstring required

Application UUID (Administration > Applications)

Request body

namestring
format'json' | 'html' | 'unknown' | 'xml' | 'excel' | 'yaml' | 'pdf' | 'tv' | 'rdf' | 'csv' | 'sarif' | 'text'
sendEmailNotificationboolean
projectUuidsstring[]
reportType'attribution' | 'inventory' | 'vulnerabilities' | 'securityAlerts' | 'sbom' | 'Cbom' | 'securityAlertsLibrary' | 'Compliance' | 'Findings' | 'Suppressions' | 'Resolved' | 'spdx' | 'spdx_2_3' | 'cycloneDX' | 'cycloneDX_1_5' | 'cycloneDX_1_6' | 'dueDiligence' | 'unknown' | 'imgAttribution' | 'imgDueDiligence' | 'imgSpdx' | 'imgSpdx_2_3' | 'imgCycloneDX' | 'imgCycloneDX_1_5' | 'aiInventory' | 'aiFindings' | 'imgCycloneDX_1_6' | 'risk' | 'users' | 'zeroDayCatalog' | 'activityLog' | 'spdx' | 'spdx_2_3' | 'cycloneDX' | 'cycloneDX_1_5' | 'cycloneDX_1_6'

SBOM report type. Only SPDX and CycloneDX variants are valid for this endpoint.

maxDepthLevelinteger

Maximum depth level of the dependency tree to include in the report. Applies to CycloneDX variants only and must be between 1 and 4; values outside this range (including 0) are rejected with a 400 error. Ignored for SPDX variants.

includeVulnerabilitiesboolean
isMlBomReportboolean

When true, generates an ML-BOM (AI/ML Bill of Materials) that includes only machine-learning model components. If the selected scope contains no ML/AI model components, the generated report will be empty (for CycloneDX/SPDX this yields an empty ZIP). Defaults to false.

componentGranularity'library' | 'file'

Component granularity: 'library' (default) or 'file' for source-file-level coverage

Example request

{
  "reportType": "spdx",
  "maxDepthLevel": 1,
  "componentGranularity": "library"
}

Response

OK

supportTokenstring

Example response

{
  "supportToken": "1171c60d"
}