---
title: "Generate a project's SBOM"
method: POST
path: "/api/sca/deployments/{deploymentId}/sbom_async"
tags: ["SupplyChain2Service"]
---

# Generate a project's SBOM

`POST /api/sca/deployments/{deploymentId}/sbom_async`

Starts a job to asynchronously generate a Software Bill of Materials (SBOM) for a given project. It does not return the SBOM itself, only schedules the job and returns a task JWT.

The [Tasks Service](#tag/TasksService) can accept the task token to get the status and result of the job.

## Path parameters

- `deploymentId` string, int64, required — Deployment ID (numeric). Example: `123`. Can be found at `/deployments`, or in your Settings in the web UI.

## Request body

- ProtosScaV1GenerateSbomAsyncRequest — This is the API message proto for `GenerateSbomAsync`, but it should stay roughly in-sync with the product message `GenerateSbomRequest`.
  - `deploymentId` string, int64 — Deployment ID (numeric). Example: `123`. Can be found at `/deployments`, or in your Settings in the web UI.
  - `repositoryId` string, int64 — Project ID to export SBOM for. Use Projects endpoints to find IDs.
  - `ref` string — Branch to export SBOM for.
  - `formatVersion` ProtosScaV1SbomFormatVersion
    - `format` 'SBOM_FORMAT_CYCLONEDX', enum — Format for the SBOM export. | value | description | |-------|---------------| | SBOM_FORMAT_CYCLONEDX | |
    - `cyclonedxVersion` 'SBOM_CYCLONE_DX_VERSION_V1_4' | 'SBOM_CYCLONE_DX_VERSION_V1_5' | 'SBOM_CYCLONE_DX_VERSION_V1_6' | 'SBOM_CYCLONE_DX_VERSION_V1_7', enum — CycloneDX schema version for the SBOM export. Supported: 1.4, 1.5, 1.6, 1.7. Defaults to 1.4 when unset. | value | description | |-------|---------------| | SBOM_CYCLONE_DX_VERSION_V1_4 | | | SBOM_CYCLONE_DX_VERSION_V1_5 | | | SBOM_CYCLONE_DX_VERSION_V1_6 | | | SBOM_CYCLONE_DX_VERSION_V1_7 | |
  - `sbomOutputFormat` 'SBOM_OUTPUT_FORMAT_XML' | 'SBOM_OUTPUT_FORMAT_JSON', enum — Output format for the SBOM file. | value | description | |-------|---------------| | SBOM_OUTPUT_FORMAT_XML | | | SBOM_OUTPUT_FORMAT_JSON | |
  - `metadataComponentType` 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_APPLICATION' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FRAMEWORK' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_LIBRARY' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_CONTAINER' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_PLATFORM' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_OPERATING_SYSTEM' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DEVICE' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DEVICE_DRIVER' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FIRMWARE' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FILE' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_MACHINE_LEARNING_MODEL' | 'SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DATA', enum — Type of component being documented. | value | description | |-------|---------------| | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_APPLICATION | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FRAMEWORK | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_LIBRARY | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_CONTAINER | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_PLATFORM | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_OPERATING_SYSTEM | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DEVICE | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DEVICE_DRIVER | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FIRMWARE | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_FILE | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_MACHINE_LEARNING_MODEL | | | SBOM_METADATA_COMPONENT_TYPE_CYCLONE_DX_V15_DATA | |
  - `metadataSupplier` ProtosScaV1SbomMetadataSupplier
    - `name` string
    - `url` string
    - `contact` ProtosScaV1SbomMetadataContact
      - `name` string
      - `email` string
      - `phone` string

## Response `202`

Accepted

- ProtosScaV1GenerateSbomAsyncResponse
  - `taskTokenJwt` string — Task token to track the status and result of the export job.

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/revisions/6483eeecd582/schema)