---
title: "Generate SBOM and optionally run vulnerability scan"
method: POST
path: "/sbom/generate"
tags: ["sbom"]
---

# Generate SBOM and optionally run vulnerability scan

`POST /sbom/generate`

Generate a CycloneDX or SPDX SBOM from installed packages.

After generation, optionally run ``osv-scanner`` or ``grype`` for
vulnerability scanning.  When ``block_on_critical=true`` and critical
findings are detected, responds with HTTP 422 so CI/CD pipelines can
gate merges on vulnerability status.

SBOM artifacts are written to ``.sdd/artifacts/sbom/``.

## Request body

- SBOMGenerateRequest — Body for POST /sbom/generate.
  - `sbom_format` string — Output format: 'cyclonedx-json' or 'spdx-json'.
  - `source` string — Package source label (pip, npm, requirements.txt, etc.).
  - `run_scan` boolean — Run vulnerability scanning (osv-scanner or grype) after generation.
  - `block_on_critical` boolean — Raise 422 when critical vulnerabilities are found.

## Response `200`

Successful Response

- SBOMGenerateResponse — Response from POST /sbom/generate.
  - `serial_number` string, required
  - `sbom_format` string, required
  - `component_count` integer, required
  - `artifact_path` string, required
  - `scan_result` SBOMScanResultResponse — Serialised scan result.
    - `scanner` string, required
    - `finding_count` integer, required
    - `highest_severity` string, required
    - `findings` SBOMVulnFindingResponse[], required
      - `component_name` string, required
      - `component_version` string, required
      - `vuln_id` string, required
      - `severity` string, required
      - `summary` string, required
      - `fix_version` string, required
      - `scanner` string, required
    - `errors` string[], required
    - `passed_gate` boolean, required

## Other responses

- `400` — Unknown SBOM format
- `422` — Critical vulnerabilities found (gate blocked)
- `503` — Server workdir not configured

---

[API](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server.md) · [All operations](https://skmtc.net/sipyourdrink-ltd/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sipyourdrink-ltd/bernstein-task-server/revisions/86f514b4e920/schema)