Sign in
dependency-graph

Export a software bill of materials (SBOM) for a repository.

[!WARNING] Closing down notice: This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use "Request generation of a software bill of materials (SBOM) for a repository" to trigger the report, then "Fetch a software bill of materials (SBOM) for a repository" to retrieve it. For more information, see the changelog.

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

get/repos/{owner}/{repo}/dependency-graph/sbom

Path parameters

ownerstring required

The account owner of the repository. The name is not case sensitive.

repostring required

The name of the repository without the .git extension. The name is not case sensitive.

Response

Response

Example response

{
  "sbom": {
    "SPDXID": "SPDXRef-DOCUMENT",
    "spdxVersion": "SPDX-2.3",
    "comment": "Exact versions could not be resolved for some packages. For more information: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/",
    "creationInfo": {
      "created": "2021-11-03T00:00:00Z",
      "creators": [
        "GitHub"
      ]
    },
    "name": "github/github",
    "dataLicense": "CC0-1.0",
    "documentNamespace": "https://spdx.org/spdxdocs/protobom/15e41dd2-f961-4f4d-b8dc-f8f57ad70d57",
    "packages": [
      {
        "SPDXID": "SPDXRef-Package",
        "name": "github/github",
        "versionInfo": "1.0.0",
        "downloadLocation": "NOASSERTION",
        "licenseConcluded": "MIT",
        "licenseDeclared": "NOASSERTION",
        "supplier": "NOASSERTION",
        "copyrightText": "Copyright (c) 1985 GitHub.com",
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceLocator": "pkg:gem/rails@6.0.1",
            "referenceType": "purl"
          }
        ]
      }
    ],
    "relationships": [
      {
        "relationshipType": "DEPENDS_ON"
      }
    ]
  }
}

Changes

Changed in 1 of the 62 revisions of this API.1