---
title: "Verify Exported Sbom"
method: POST
path: "/api/v1/verify/sbom"
tags: ["verify"]
---

# Verify Exported Sbom

`POST /api/v1/verify/sbom`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/verify/sbom`
- Auth: none declared

Check the Ed25519 signature on a CycloneDX SBOM exported by Badge.

Public (a buyer's security team has no Badge account). Flag off -> 404.
A bad signature is a 200 with ``valid=false`` and no identity fields: the
answer to "is this document authentic" must not echo unauthenticated
content back as if it were trusted.

## Response `200`

Successful Response

- SbomVerifyResponse
  - `valid` boolean, required
  - `key_id` string, nullable
  - `agent_id` string, nullable
  - `signed_at` string, nullable
  - `reason` string, nullable

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)