Export a software bill of materials (SBOM) for a repository.

GET

/repos/{owner}/{repo}/dependency-graph/sbom

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

Responses

200

Response

Media type application/json

Dependency Graph SPDX SBOM

A schema for the SPDX JSON format returned by the Dependency Graph.

object

sbom

required

object

SPDXID

required

The SPDX identifier for the SPDX document.

string

spdxVersion

required

The version of the SPDX specification that this document conforms to.

string

comment

An optional comment about the SPDX document.

string

creationInfo

required

object

created

required

The date and time the SPDX document was created.

string

creators

required

The tools that were used to generate the SPDX document.

Array<string>

name

required

The name of the SPDX document.

string

dataLicense

required

The license under which the SPDX document is licensed.

string

documentNamespace

required

The namespace for the SPDX document.

string

packages

required

Array<object>

object

SPDXID

A unique SPDX identifier for the package.

string

name

The name of the package.

string

versionInfo

The version of the package. If the package does not have an exact version specified, a version range is given.

string

downloadLocation

The location where the package can be downloaded, or NOASSERTION if this has not been determined.

string

filesAnalyzed

Whether the package’s file content has been subjected to analysis during the creation of the SPDX document.

boolean

licenseConcluded

The license of the package as determined while creating the SPDX document.

string

licenseDeclared

The license of the package as declared by its author, or NOASSERTION if this information was not available when the SPDX document was created.

string

supplier

The distribution source of this package, or NOASSERTION if this was not determined.

string

copyrightText

The copyright holders of the package, and any dates present with those notices, if available.

string

externalRefs

Array<object>

object

referenceCategory

required

The category of reference to an external resource this reference refers to.

string

referenceLocator

required

A locator for the particular external resource this reference refers to.

string

referenceType

required

The category of reference to an external resource this reference refers to.

string

relationships

Array<object>

object

relationshipType

The type of relationship between the two SPDX elements.

string

spdxElementId

The SPDX identifier of the package that is the source of the relationship.

string

relatedSpdxElement

The SPDX identifier of the package that is the target of the relationship.

string

Examples

Example default

{
  "sbom": {
    "SPDXID": "SPDXRef-DOCUMENT",
    "spdxVersion": "SPDX-2.3",
    "creationInfo": {
      "created": "2021-09-01T00:00:00Z",
      "creators": [
        "Tool: GitHub.com-Dependency-Graph"
      ]
    },
    "name": "github/example",
    "dataLicense": "CC0-1.0",
    "documentNamespace": "https://spdx.org/spdxdocs/protobom/15e41dd2-f961-4f4d-b8dc-f8f57ad70d57",
    "packages": [
      {
        "name": "rails",
        "SPDXID": "SPDXRef-Package",
        "versionInfo": "1.0.0",
        "downloadLocation": "NOASSERTION",
        "filesAnalyzed": false,
        "licenseConcluded": "MIT",
        "licenseDeclared": "MIT",
        "copyrightText": "Copyright (c) 1985 GitHub.com",
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceType": "purl",
            "referenceLocator": "pkg:gem/rails@1.0.0"
          }
        ]
      },
      {
        "name": "github/example",
        "SPDXID": "SPDXRef-Repository",
        "versionInfo": "main",
        "downloadLocation": "NOASSERTION",
        "filesAnalyzed": false,
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceType": "purl",
            "referenceLocator": "pkg:github/example@main"
          }
        ]
      }
    ],
    "relationships": [
      {
        "relationshipType": "DEPENDS_ON",
        "spdxElementId": "SPDXRef-Repository",
        "relatedSpdxElement": "SPDXRef-Package"
      },
      {
        "relationshipType": "DESCRIBES",
        "spdxElementId": "SPDXRef-DOCUMENT",
        "relatedSpdxElement": "SPDXRef-Repository"
      }
    ]
  }
}

Headers

Link

string

Example

<https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"

403

Forbidden

Media type application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

Media type application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}