---
title: "Generate SBOM and optionally run vulnerability scan"
method: POST
path: "/api/v1/sbom/generate"
tags: ["sbom"]
---

# Generate SBOM and optionally run vulnerability scan

`POST /api/v1/sbom/generate`

## Request

- Base URL: `http://127.0.0.1:8052`
- URL: `http://127.0.0.1:8052/api/v1/sbom/generate`
- Auth: none declared

Generate a CycloneDX or SPDX SBOM from installed packages.

After generation, optionally run ``osv-scanner`` or ``grype`` for
vulnerability scanning.  When ``block_on_critical=true`` and critical
findings are detected, responds with HTTP 422 so CI/CD pipelines can
gate merges on vulnerability status.

SBOM artifacts are written to ``.sdd/artifacts/sbom/``.

## Request body

- SBOMGenerateRequest: Body for POST /sbom/generate.
  - `sbom_format` string: Output format: 'cyclonedx-json' or 'spdx-json'.
  - `source` string: Package source label (pip, npm, requirements.txt, etc.).
  - `run_scan` boolean: Run vulnerability scanning (osv-scanner or grype) after generation.
  - `block_on_critical` boolean: Raise 422 when critical vulnerabilities are found.

## Response `200`

Successful Response

- SBOMGenerateResponse: Response from POST /sbom/generate.
  - `serial_number` string, required
  - `sbom_format` string, required
  - `component_count` integer, required
  - `artifact_path` string, required
  - `scan_result` SBOMScanResultResponse: Serialised scan result.
    - `scanner` string, required
    - `finding_count` integer, required
    - `highest_severity` string, required
    - `findings` SBOMVulnFindingResponse[], required
      - `component_name` string, required
      - `component_version` string, required
      - `vuln_id` string, required
      - `severity` string, required
      - `summary` string, required
      - `fix_version` string, required
      - `scanner` string, required
    - `errors` string[], required
    - `passed_gate` boolean, required

## Other responses

- `400`: Unknown SBOM format
- `422`: Critical vulnerabilities found (gate blocked)
- `503`: Server workdir not configured

---

[API](https://skmtc.dev/bernstein/apis/bernstein-task-server.md) · [All operations](https://skmtc.dev/bernstein/apis/bernstein-task-server/llms.txt) · [OpenAPI document](https://skmtc.dev/bernstein/apis/bernstein-task-server/revisions/2a20a34ad2eb?raw)