MEmend
Reports

Export application SBOM report asynchronously (Dependencies - SCA)

Changed on
post/api/v3.0/applications/{applicationUuid}/dependencies/reports/SBOM

Request

Path parameters

applicationUuidstring required

Application UUID (Administration > Applications)

Request body

namestring
format'json' | 'html' | 'unknown' | 'xml' | 'excel' | 'yaml' | 'pdf' | 'tv' | 'rdf' | 'csv' | 'sarif' | 'text'
sendEmailNotificationboolean
projectUuidsstring[]
reportType'attribution' | 'inventory' | 'vulnerabilities' | 'securityAlerts' | 'sbom' | 'Cbom' | 'securityAlertsLibrary' | 'Compliance' | 'Findings' | 'Suppressions' | 'Resolved' | 'spdx' | 'spdx_2_3' | 'cycloneDX' | 'cycloneDX_1_5' | 'cycloneDX_1_6' | 'dueDiligence' | 'unknown' | 'imgAttribution' | 'imgDueDiligence' | 'imgSpdx' | 'imgSpdx_2_3' | 'imgCycloneDX' | 'imgCycloneDX_1_5' | 'aiInventory' | 'aiFindings' | 'aiBom' | 'aiEntities' | 'conversationalSystemPrompts' | 'imgCycloneDX_1_6' | 'risk' | 'users' | 'zeroDayCatalog' | 'activityLog' | 'unifiedFindings' | 'spdx' | 'spdx_2_3' | 'cycloneDX' | 'cycloneDX_1_5' | 'cycloneDX_1_6'

SBOM report type. Only SPDX and CycloneDX variants are valid for this endpoint.

maxDepthLevelinteger

Maximum depth level of the dependency tree to include in the report. Applies to CycloneDX variants only and must be between 1 and 4; values outside this range (including 0) are rejected with a 400 error. Ignored for SPDX variants.

includeVulnerabilitiesboolean
isMlBomReportboolean

When true, generates an ML-BOM (AI/ML Bill of Materials) that includes only machine-learning model components. If the selected scope contains no ML/AI model components, the generated report will be empty (for CycloneDX/SPDX this yields an empty ZIP). Defaults to false.

componentGranularity'library' | 'file'

Component granularity: 'library' (default) or 'file' for source-file-level coverage

reportStructure'PER_PROJECT' | 'AGGREGATED' | 'PER_PROJECT' | 'AGGREGATED'

How the report is split over files. 'PER_PROJECT' (default) generates one SBOM file per project in the scope; 'AGGREGATED' generates a single file covering all of them, rooted in this application. 'AGGREGATED' requires a scope of more than one project — it is rejected when projectUuids selects exactly one project — and supports componentGranularity 'library' only. Aggregated files can be very large for applications with many projects.

Example request

{
  "reportType": "spdx",
  "maxDepthLevel": 1,
  "componentGranularity": "library",
  "reportStructure": "PER_PROJECT"
}

Response

OK

supportTokenstring

Example response

{
  "supportToken": "1171c60d"
}

Changes

  • 17de76ee2fb8Revision changes
    • breaking

      removed the enum value aiConversational of the request property

    • breaking

      removed the enum value aiDataExport of the request property

    • warning

      added the new aiEntities enum value to the / response property for the response status

    • warning

      added the new conversationalSystemPrompts enum value to the / response property for the response status

    • info

      added the new optional request property

    • info

      added the new aiEntities enum value to the request property

    • info

      added the new conversationalSystemPrompts enum value to the request property

    • info

      removed the aiConversational enum value from the / response property for the response status

    • info

      removed the aiDataExport enum value from the / response property for the response status

  • 67a0e59611cdRevision changes
    • warning

      added the new aiConversational enum value to the / response property for the response status

    • warning

      added the new aiDataExport enum value to the / response property for the response status

    • info

      added the new aiConversational enum value to the request property

    • info

      added the new aiDataExport enum value to the request property