---
title: "Export a software bill of materials (SBOM) for a repository."
method: GET
path: "/repos/{owner}/{repo}/dependency-graph/sbom"
tags: ["dependency-graph"]
deprecated: true
---

# Export a software bill of materials (SBOM) for a repository.

`GET /repos/{owner}/{repo}/dependency-graph/sbom`

> **Deprecated.**

> [!WARNING]
> **Closing down notice:** This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use "[Request generation of a software bill of materials (SBOM) for a repository](https://docs.github.com/rest/dependency-graph/sboms#request-generation-of-a-software-bill-of-materials-sbom-for-a-repository)" to trigger the report, then "[Fetch a software bill of materials (SBOM) for a repository](https://docs.github.com/rest/dependency-graph/sboms#fetch-a-software-bill-of-materials-sbom-for-a-repository)" to retrieve it. For more information, see the [changelog](https://github.blog/changelog/2026-05-12-synchronous-sbom-api-deprecated/).

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

## Path parameters

- `owner` string, required
- `repo` string, required

## Response `200`

Response

- DependencyGraphSpdxSbom — A schema for the SPDX JSON format returned by the Dependency Graph.
  - `sbom` object, required
    - `SPDXID` string, required — The SPDX identifier for the SPDX document.
    - `spdxVersion` string, required — The version of the SPDX specification that this document conforms to.
    - `comment` string — An optional comment about the SPDX document.
    - `creationInfo` object, required
      - `created` string, required — The date and time the SPDX document was created.
      - `creators` string[], required — The tools that were used to generate the SPDX document.
    - `name` string, required — The name of the SPDX document.
    - `dataLicense` string, required — The license under which the SPDX document is licensed.
    - `documentNamespace` string, required — The namespace for the SPDX document.
    - `packages` object[], required
      - `SPDXID` string — A unique SPDX identifier for the package.
      - `name` string — The name of the package.
      - `versionInfo` string — The version of the package. If the package does not have an exact version specified, a version range is given.
      - `downloadLocation` string — The location where the package can be downloaded, or NOASSERTION if this has not been determined.
      - `filesAnalyzed` boolean — Whether the package's file content has been subjected to analysis during the creation of the SPDX document.
      - `licenseConcluded` string — The license of the package as determined while creating the SPDX document.
      - `licenseDeclared` string — The license of the package as declared by its author, or NOASSERTION if this information was not available when the SPDX document was created.
      - `supplier` string — The distribution source of this package, or NOASSERTION if this was not determined.
      - `copyrightText` string — The copyright holders of the package, and any dates present with those notices, if available.
      - `externalRefs` object[]
        - `referenceCategory` string, required — The category of reference to an external resource this reference refers to.
        - `referenceLocator` string, required — A locator for the particular external resource this reference refers to.
        - `referenceType` string, required — The category of reference to an external resource this reference refers to.
    - `relationships` object[]
      - `relationshipType` string — The type of relationship between the two SPDX elements.
      - `spdxElementId` string — The SPDX identifier of the package that is the source of the relationship.
      - `relatedSpdxElement` string — The SPDX identifier of the package that is the target of the relationship.

## Other responses

- `403` — Forbidden
- `404` — Resource not found

## Changes

> 62 revisions in range; 1 not diffed.

- **2026-08-26** (2022-11-28) `2a292eb46bb4` — 1 info
  - endpoint deprecated

[Change history](https://skmtc.dev/github/apis/rest/changes/repos/:owner/:repo/dependency-graph/sbom/get.md)

---

[API](https://skmtc.dev/github/apis/rest.md) · [All operations](https://skmtc.dev/github/apis/rest/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/github/rest/revisions/5bded2c77b93/schema)