---
title: "Scan an SBOM or dependency file"
method: POST
path: "/v1/sbom/scan"
tags: ["sbom"]
---

# Scan an SBOM or dependency file

`POST /v1/sbom/scan`

## Request

- Base URL: `https://vdb.ai.kr` (the document declares no server; this is the origin it was published from)
- URL: `https://vdb.ai.kr/v1/sbom/scan`
- Auth: none declared

Scan an uploaded SBOM **or** dependency file.

Supports CycloneDX (JSON/XML), SPDX, package.json, package-lock.json,
yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, pyproject.toml,
go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, Excel (.xlsx),
and CSV/TSV with a name+version header.

Requires a key like every other data endpoint. The parse + bulk vuln
join is materially more expensive than a single check_packages call,
so the component cap stays.

## Response `200`

Successful Response

- SbomScanResult
  - `sbom_format` string, required
  - `components_total` integer, required
  - `components_matched` integer, required
  - `vulnerabilities` object[]
  - `summary` object
  - `mcp_components` object[]
  - `coverage_ratio` number
  - `components_covered` integer
  - `components_unknown` integer
  - `unknown_components` string[]
  - `components_truncated` integer
  - `agent_action` string
  - `because` string

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/vdb/apis/vdb-api.md) · [All operations](https://skmtc.dev/vdb/apis/vdb-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vdb/apis/vdb-api/revisions/5d5edc23ea71?raw)