v6

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-01485121699.8 KB

sbom

Generate SBOM and optionally run vulnerability scan

Generate a CycloneDX or SPDX SBOM from installed packages.

After generation, optionally run osv-scanner or grype for vulnerability scanning. When block_on_critical=true and critical findings are detected, responds with HTTP 422 so CI/CD pipelines can gate merges on vulnerability status.

SBOM artifacts are written to .sdd/artifacts/sbom/.

post/sbom/generate

Request body

sbom_formatstring

Output format: 'cyclonedx-json' or 'spdx-json'.

sourcestring

Package source label (pip, npm, requirements.txt, etc.).

run_scanboolean

Run vulnerability scanning (osv-scanner or grype) after generation.

block_on_criticalboolean

Raise 422 when critical vulnerabilities are found.

Response

Successful Response

serial_numberstring required

sbom_formatstring required

component_countinteger required

artifact_pathstring required