SBOM Management

APIs for managing SBOMs

Get an SBOM for the specified repository

get

Get an SBOM (Software Bill of Materials) report for the specified repository.

Only the following combinations are supported:

format: cyclonedx fileType: json or xml version: 1.4or1.5or1.6`

format: spdx fileType: json or txt version: 2.3`

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters

repoIdstringRequired

Unique identifier of the repository for which to retrieve the SBOM report.

To retrieve this value, call GET /public_api/appsec/v1/repositories and use the id field from each repository object in the response.

Example: 67db03bb1246ebdc5a86ca2d6cbb379391aa3d3c7639538aba9c47f6e5614e99

branchNamestringOptional

Branch name for which you want to export the SBOM.

Example: main

fileTypestring · enumOptional

Define the file type you want to export. For cyclonedx, either json or xml. For spdx, either json or txt.

Default: xmlExample: jsonPossible values:

versionstring · enumOptional

For cyclonedx, version can be 1.4, 1.5, or 1.6. For spdx, version is 2.3.

Default: 1.6Example: 1.6Possible values:

formatstring · enumOptional

Define the SBOM format.

Default: cyclonedxExample: cyclonedxPossible values:

Header parameters

AuthorizationstringRequired

{api_key}

Example: your-api-key-here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok. The SBOM report was generated successfully. The response body is the raw SBOM file content streamed directly (not base64-encoded).

application/json

string · byteOptional

Raw CycloneDX or SPDX XML or JSON file content, streamed directly in the response body.

get/public_api/appsec/v1/sbom/repository

GET /public_api/appsec/v1/sbom/repository?repoId=text HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Accept: */*

200

Ok. The SBOM report was generated successfully. The response body is the raw SBOM file content streamed directly (not base64-encoded).

{
  "$schema": "string",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d66c8bb5-4b17-4790-85b2-3e8e0135039b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-02T16:01:03.254839+00:00",
    "tools": [
      {
        "vendor": "CycloneDX",
        "name": "cyclonedx-python-lib",
        "version": "7.6.2"
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:pypi/aiodns@3.6.1",
      "group": "SCA",
      "name": "aiodns",
      "version": "3.6.1",
      "purl": "pkg:pypi/aiodns@3.6.1",
      "licenses": [
        {}
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/aiodns@3.6.1"
    }
  ]
}

Get all SBOMs for the specified organization

get

Returns SBOM reports for all repositories belonging to the specified organization, bundled as a single downloadable ZIP file.

Downloading the ZIP file

A successful 200 response returns the SBOMs as a .zip archive. How you save the file depends on your HTTP client.

Using cURL

Add the -o flag to save the response body directly to a local file:

curl --location 'https://api-<yourfqdn>/public_api/appsec/v1/sbom/organization?orgName=<orgName>&fileType=xml&version=1.6&format=cyclonedx' \
  --header 'Authorization: <api_key>' \
  --header 'x-xdr-auth-id: <api_key_id>' \
  -o ./sbom-org-export.zip

This saves the ZIP archive as sbom-org-export.zip in the current directory.

Using Postman

After sending the request, click Send > Download Response to save the .zip file to your local system.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters

orgNamestringRequired

Name of the organization (asset owner) for which to retrieve all SBOM reports. To retrieve this value, call GET /public_api/appsec/v1/repositories and use the owner field from each repository object in the response.

Example: my-org