sbom

Generate SBOM and optionally run vulnerability scan

Generate a CycloneDX or SPDX SBOM from installed packages.

After generation, optionally run osv-scanner or grype for vulnerability scanning. When block_on_critical=true and critical findings are detected, responds with HTTP 422 so CI/CD pipelines can gate merges on vulnerability status.

SBOM artifacts are written to .sdd/artifacts/sbom/.

post/sbom/generate

Request

  • Base URL: http://127.0.0.1:8052
  • URL: http://127.0.0.1:8052/sbom/generate
  • Auth: none declared

Request body

sbom_formatstring

Output format: 'cyclonedx-json' or 'spdx-json'.

sourcestring

Package source label (pip, npm, requirements.txt, etc.).

run_scanboolean

Run vulnerability scanning (osv-scanner or grype) after generation.

block_on_criticalboolean

Raise 422 when critical vulnerabilities are found.

Response

Successful Response

serial_numberstring required
sbom_formatstring required
component_countinteger required
artifact_pathstring required

Changes

No recorded changes to this operation across all 1 revision of this API.