---
title: "Watch this SBOM: subscribe the document's resolved lines to EOL and KEV alerts"
method: POST
path: "/v1/sbom/watch"
---

# Watch this SBOM: subscribe the document's resolved lines to EOL and KEV alerts

`POST /v1/sbom/watch`

## Request

- Base URL: `https://api.endoflife.ai`
- URL: `https://api.endoflife.ai/v1/sbom/watch`
- Auth: one of:
  - none
  - API key in header `X-API-Key`
  - HTTP bearer

Body: { "email": "...", "sbom": <CycloneDX or SPDX JSON>, "strict": false }. Every component is resolved the same way /v1/sbom resolves it (purl exact, name only without a purl, never a guess) and each resolved product line (slug:cycle) joins the subscriber's watch list on the existing alert system: a confirmation email first (double opt-in), then emails when a watched line comes inside 12 months of end of life, at 90/60/30/7 days, on the day it passes, and immediately when a CISA known-exploited CVE lands on a watched end-of-life line. Only the slug:cycle lines are stored - never the document. The list replaces the subscriber's previous watch list; 50 lines maximum.

## Request body

- object
  - `email` string, required
  - `sbom` object, required
  - `strict` boolean

## Response `200`

ok, watching (slug:cycle list), confirmed, message, sbom {format, components, lines_resolved, lines_watched, lines_dropped, not_tracked, version_not_tracked}

## Other responses

- `400`: Invalid body, or no component resolves to a tracked line
- `413`: Body over 5 MB, more than 5,000 components, or nesting deeper than 32 levels
- `429`: Signup limit (10 a day per address) or daily quota
- `503`: Alert storage unavailable

---

[API](https://skmtc.dev/endoflife/apis/endoflife-ai-api.md) · [All operations](https://skmtc.dev/endoflife/apis/endoflife-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/endoflife/apis/endoflife-ai-api/revisions/266133050383?raw)