---
title: "SPDX SBOM Validator (EU CRA Annex I)"
method: POST
path: "/v1/tools/validate_spdx_sbom"
tags: ["TODO_TAGS_REVIEW"]
---

# SPDX SBOM Validator (EU CRA Annex I)

`POST /v1/tools/validate_spdx_sbom`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/validate_spdx_sbom`
- Auth: none declared

Validates an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: spdxVersion matches SPDX-2.x or SPDX-3.x, SPDXID present, all packages carry name+versionInfo+downloadLocation (or purl externalRef), relationships array non-empty. Emits sbom_valid verdict and per-package gap list. Root stage of cra-product-conformance chain.

**Tool URL:** https://ainumbers.co/chaingraph/art-138-spdx-sbom-validator.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `sbom` unknown

## Response `200`

Successful tool execution result

- object
  - `format` string
  - `has_relationships` boolean
  - `package_count` integer
  - `packages_missing_version` unknown[]
    - unknown
  - `sbom_valid` boolean
  - `spdx_version` string

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)