Scan an SBOM or dependency file

Scan an uploaded SBOM or dependency file.

Supports CycloneDX (JSON/XML), SPDX, package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, pyproject.toml, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, Excel (.xlsx), and CSV/TSV with a name+version header.

Requires a key like every other data endpoint. The parse + bulk vuln join is materially more expensive than a single check_packages call, so the component cap stays.