---
title: "Get SBOM Results"
method: POST
path: "/api/analysis/results/sbom"
tags: ["Analysis"]
---

# Get SBOM Results

`POST /api/analysis/results/sbom`

Retrieves the Software Bill of Materials (SBOM) results for a specific repository and commit

## Request body

- SBOMRequest
  - `repo` string, required — Repository identifier (format varies by service)
  - `commit_id` string — Git commit SHA or identifier. Either commit_id or branch is required. If both are provided, commit_id takes precedence.
  - `branch` string — Git branch name. When provided without commit_id, the service resolves the latest commit from scan history for this branch. Either commit_id or branch is required.
  - `access_token` string, required — Authentication token for the service
  - `service` 'github' | 'azuredevops' | 'gitlab' | 'bitbucket', required — Version control service provider
  - `gitlab_base_url` string — Base URL for the service (optional for GitHub, required for GitLab)

## Response `200`

SBOM results retrieved successfully

- SBOMResponse — Software Bill of Materials (SBOM) response containing package and license information
  - `results` object — SBOM analysis results
    - `rootFolder` string — Root folder path where the analysis was performed
    - `timestamp` string, nullable — Timestamp of the analysis
    - `sboms` object[] — List of SBOM entries for different languages
      - `language` string — Programming language of the packages
      - `sourceFile` string — Source file containing package information
      - `packages` object[] — List of packages found in the source file
        - `name` string — Package name
        - `version` string — Package version or hash
        - `licenseDeclared` string — Declared license for the package
        - `licenseConcluded` string — Concluded license after analysis
        - `licenseReason` string — Reason for license determination
        - `licenseStandard` boolean — Whether the license is a standard license
        - `copyleftStrength` 'permissive' | 'weak' | 'strong' | 'proprietary_or_unknown' — Copyleft strength classification
        - `policyLevel` 'allow' | 'review' | 'deny' — Policy compliance level
        - `policyNote` string — Notes about policy requirements
        - `spdxId` string, nullable — SPDX identifier for the license
        - `badTerms` object[] — List of concerning license terms
          - `tag` string — Tag identifying the concerning term
          - `start` integer — Start position of the term in license text
          - `end` integer — End position of the term in license text
          - `evidence` string — Excerpt of the concerning text
      - `packagesCount` integer — Total number of packages found
  - `status` 'pending' | 'processing' | 'done' | 'failed' — Status of the SBOM analysis
  - `commit_id` string — Git commit SHA that was analyzed

## Other responses

- `401` — Invalid access token
- `500` — Internal server error

---

[API](https://skmtc.dev/codeant/apis/codeant-ai-api.md) · [All operations](https://skmtc.dev/codeant/apis/codeant-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/codeant/codeant-ai-api/revisions/d1eb7c083a39/schema)