--- title: "List assets SBOMs" method: GET path: "/api/v2/security/sboms" tags: ["Security Monitoring"] --- # List assets SBOMs `GET /api/v2/security/sboms` ## Request - Base URL: `https://api.datadoghq.com` - URL: `https://api.datadoghq.com/api/v2/security/sboms` - Auth: API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY` Get a list of assets SBOMs for an organization. The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided). Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error. ### Pagination Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint. ### Filtering Please review the [Filtering section](#filtering) for the "List Vulnerabilities" endpoint. ### Metadata Please review the [Metadata section](#metadata) for the "List Vulnerabilities" endpoint. ## Query parameters - `page[token]` string - `page[number]` integer - `filter[asset_type]` 'Repository' | 'Service' | 'Host' | 'HostImage' | 'Image' | 'ServerlessFunction': The asset type - `filter[asset_name]` string - `filter[package_name]` string - `filter[package_version]` string - `filter[license_name]` string - `filter[license_type]` 'network_strong_copyleft' | 'non_standard_copyleft' | 'other_non_free' | 'other_non_standard' | 'permissive' | 'public_domain' | 'strong_copyleft' | 'weak_copyleft': The SBOM component license type. ## Response `200` OK - ListAssetsSBOMsResponse: The expected response schema when listing assets SBOMs. - `data` SBOM[], required: List of assets SBOMs. - `attributes` SBOMAttributes: The JSON:API attributes of the SBOM. - `bomFormat` string, required: Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOM do not have a filename convention nor does JSON schema support namespaces. This value MUST be `CycloneDX`. - `components` SBOMComponent[], required: A list of software and hardware components. - `bom-ref` string: An optional identifier that can be used to reference the component elsewhere in the BOM. - `licenses` SBOMComponentLicense[]: The software licenses of the SBOM component. - `license` SBOMComponentLicenseLicense, required: The software license of the component of the SBOM. - `name` string, required: The name of the software license of the component of the SBOM. - `name` string, required: The name of the component. This will often be a shortened, single name of the component. - `properties` SBOMComponentProperty[]: The custom properties of the component of the SBOM. - `name` string, required: The name of the custom property of the component of the SBOM. - `value` string, required: The value of the custom property of the component of the SBOM. - `purl` string: Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the [specification](https://github.com/package-url/purl-spec). - `supplier` SBOMComponentSupplier, required: The supplier of the component. - `name` string, required: Identifier of the supplier of the component. - `type` 'application' | 'container' | 'data' | 'device' | 'device-driver' | 'file' | 'firmware' | 'framework' | 'library' | 'machine-learning-model' | 'operating-system' | 'platform', required: The SBOM component type - `version` string, required: The component version. - `dependencies` SBOMComponentDependency[], required: List of dependencies between components of the SBOM. - `dependsOn` string[]: The components that are dependencies of the ref component. - `ref` string: The identifier for the related component. - `metadata` SBOMMetadata, required: Provides additional information about a BOM. - `authors` SBOMMetadataAuthor[]: List of authors of the SBOM. - `name` string: The identifier of the Author of the SBOM. - `component` SBOMMetadataComponent: The component that the BOM describes. - `name` string: The name of the component. This will often be a shortened, single name of the component. - `type` string: Specifies the type of the component. - `timestamp` string: The timestamp of the SBOM creation. - `serialNumber` string, required: Every BOM generated has a unique serial number, even if the contents of the BOM have not changed overt time. The serial number follows [RFC-4122](https://datatracker.ietf.org/doc/html/rfc4122) - `specVersion` '1.0' | '1.1' | '1.2' | '1.3' | '1.4' | '1.5', required: The version of the CycloneDX specification a BOM conforms to. - `version` integer, required: It increments when a BOM is modified. The default value is 1. - `id` string: The unique ID for this SBOM (it is equivalent to the `asset_name` or `asset_name@repo_digest` (Image) - `type` 'sboms': The JSON:API type. - `links` Links: The JSON:API links related to pagination. - `first` string, required: First page link. - `last` string, required: Last page link. - `next` string: Next page link. - `previous` string: Previous page link. - `self` string, required: Request link. - `meta` Metadata: The metadata related to this request. - `count` integer, required: Number of entities included in the response. - `token` string, required: The token that identifies the request. - `total` integer, required: Total number of entities across all pages. ## Other responses - `400`: Bad request: The server cannot process the request due to invalid syntax in the request. - `403`: Forbidden: Access denied - `404`: Not found: asset not found - `429`: Too many requests --- [API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)