---
title: "Export CycloneDX SBOM (Beta)"
method: GET
path: "/orgs/{org_slug}/export/cdx/{id}"
tags: ["full-scans"]
---

# Export CycloneDX SBOM (Beta)

`GET /orgs/{org_slug}/export/cdx/{id}`

Export a Socket SBOM as a CycloneDX SBOM

Supported ecosystems:

- crates
- go
- maven
- npm
- nuget
- pypi
- rubygems
- spdx
- cdx

Unsupported ecosystems are filtered from the export.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- report:read

## Path parameters

- `org_slug` string, required
- `id` string, required

## Query parameters

- `author` string
- `project_group` string
- `project_name` string
- `project_version` string
- `project_id` string
- `include_vulnerabilities` string

## Response `200`

CycloneDX SBOM

- CDXManifestSchema
  - `bomFormat` string, required
  - `specVersion` string, required
  - `serialNumber` string, required
  - `version` number, required
  - `metadata` object, required
    - `timestamp` string, required
    - `tools` object, required
      - `components` object[], required
        - `author` string
        - `publisher` string
        - `group` string, required
        - `name` string, required
        - `version` string, required
        - `description` string
        - `scope` string
        - `hashes` object[]
          - `alg` string, required
          - `content` string, required
        - `licenses` object[]
          - `expression` string
          - `license` object
            - `id` string
            - `name` string
            - `url` string
        - `purl` string, required
        - `externalReferences` object[]
          - `type` string, required
          - `url` string, required
        - `type` string, required
        - `bom-ref` string, required
        - `evidence` object
          - `identity` object, required
            - `field` string, required
            - `confidence` number, required
            - `methods` object[], required
              - …
          - `occurrences` object[]
            - `location` string, required
        - `tags` string[]
        - `properties` object[]
          - `name` string, required
          - `value` string, required
        - `cryptoProperties` object[]
          - `assetType` string, required
          - `algorithmProperties` object, required
            - `executionEnvironment` string, required
            - `implementationPlatform` string, required
        - `components` CDXComponentSchema[]
          - `author` string
          - `publisher` string
          - `group` string, required
          - `name` string, required
          - `version` string, required
          - `description` string
          - `scope` string
          - `hashes` object[]
            - `alg` string, required
            - `content` string, required
          - `licenses` object[]
            - `expression` string
            - `license` object
              - …
          - `purl` string, required
          - `externalReferences` object[]
            - `type` string, required
            - `url` string, required
          - `type` string, required
          - `bom-ref` string, required
          - `evidence` object
            - `identity` object, required
              - …
            - `occurrences` object[]
              - …
          - `tags` string[]
          - `properties` object[]
            - `name` string, required
            - `value` string, required
          - `cryptoProperties` object[]
            - `assetType` string, required
            - `algorithmProperties` object, required
              - …
          - `components` CDXComponentSchema[]
        - `authors` string[]
    - `authors` object[], required
      - `name` string, required
    - `supplier` string
    - `lifecycles` object[], required
      - `phase` string, required
    - `component` CDXComponentSchema, required
      - `author` string
      - `publisher` string
      - `group` string, required
      - `name` string, required
      - `version` string, required
      - `description` string
      - `scope` string
      - `hashes` object[]
        - `alg` string, required
        - `content` string, required
      - `licenses` object[]
        - `expression` string
        - `license` object
          - `id` string
          - `name` string
          - `url` string
      - `purl` string, required
      - `externalReferences` object[]
        - `type` string, required
        - `url` string, required
      - `type` string, required
      - `bom-ref` string, required
      - `evidence` object
        - `identity` object, required
          - `field` string, required
          - `confidence` number, required
          - `methods` object[], required
            - `technique` string, required
            - `confidence` number, required
            - `value` string, required
        - `occurrences` object[]
          - `location` string, required
      - `tags` string[]
      - `properties` object[]
        - `name` string, required
        - `value` string, required
      - `cryptoProperties` object[]
        - `assetType` string, required
        - `algorithmProperties` object, required
          - `executionEnvironment` string, required
          - `implementationPlatform` string, required
      - `components` CDXComponentSchema[]
    - `properties` object[]
      - `name` string, required
      - `value` string, required
  - `components` CDXComponentSchema[], required
    - `author` string
    - `publisher` string
    - `group` string, required
    - `name` string, required
    - `version` string, required
    - `description` string
    - `scope` string
    - `hashes` object[]
      - `alg` string, required
      - `content` string, required
    - `licenses` object[]
      - `expression` string
      - `license` object
        - `id` string
        - `name` string
        - `url` string
    - `purl` string, required
    - `externalReferences` object[]
      - `type` string, required
      - `url` string, required
    - `type` string, required
    - `bom-ref` string, required
    - `evidence` object
      - `identity` object, required
        - `field` string, required
        - `confidence` number, required
        - `methods` object[], required
          - `technique` string, required
          - `confidence` number, required
          - `value` string, required
      - `occurrences` object[]
        - `location` string, required
    - `tags` string[]
    - `properties` object[]
      - `name` string, required
      - `value` string, required
    - `cryptoProperties` object[]
      - `assetType` string, required
      - `algorithmProperties` object, required
        - `executionEnvironment` string, required
        - `implementationPlatform` string, required
    - `components` CDXComponentSchema[]
  - `dependencies` object[], required
    - `ref` string, required
    - `dependsOn` string[]
  - `vulnerabilities` object[]
    - `id` string, required
    - `ref` string
    - `source` object
      - `name` string
      - `url` string
    - `ratings` object[]
      - `source` object
        - `name` string
        - `url` string
      - `score` number
      - `severity` string
      - `method` string
      - `vector` string
    - `cwes` number[]
    - `description` string
    - `detail` string
    - `recommendation` string
    - `advisories` object[]
      - `url` string, required
      - `title` string
    - `created` string
    - `published` string
    - `updated` string
    - `affects` object[]
      - `ref` string, required
      - `versions` object[]
        - `version` string
        - `status` string
    - `analysis` object
      - `state` string
      - `justification` string
      - `response` string[]
      - `detail` string
      - `firstIssued` string
      - `lastUpdated` string

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)