sbom

Generate SBOM and optionally run vulnerability scan

Changed on

Generate a CycloneDX or SPDX SBOM from installed packages.

After generation, optionally run osv-scanner or grype for vulnerability scanning. When block_on_critical=true and critical findings are detected, responds with HTTP 422 so CI/CD pipelines can gate merges on vulnerability status.

SBOM artifacts are written to .sdd/artifacts/sbom/.

post/api/v1/sbom/generate

Request

  • The document declares no server URL.
  • Auth
    none declared

Request body

sbom_formatstring

Output format: 'cyclonedx-json' or 'spdx-json'.

sourcestring

Package source label (pip, npm, requirements.txt, etc.).

run_scanboolean

Run vulnerability scanning (osv-scanner or grype) after generation.

block_on_criticalboolean

Raise 422 when critical vulnerabilities are found.

Response

Successful Response

serial_numberstring required
sbom_formatstring required
component_countinteger required
artifact_pathstring required

Changes