> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/sbom.md).

# SBOM

APIs for managing SBOMs

## Get the SBOM of the specified asset

> Get an SBOM (Software Bill of Materials) report for the specified asset. You can specify the format and version of the SBOM, as well as which attribute you would like included.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Management, requires the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex XDR 5.1"},"tags":[{"name":"SBOM","description":"APIs for managing SBOMs"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/{assetID}/sbom":{"get":{"tags":["SBOM"],"summary":"Get the SBOM of the specified asset","description":"Get an SBOM (Software Bill of Materials) report for the specified asset. You can specify the format and version of the SBOM, as well as which attribute you would like included.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Management, requires the Cortex Cloud Runtime Security add-on.","operationId":"get-public_api-v1-assets-assetID-sbom","parameters":[{"name":"format","in":"query","description":"The format in which the SBOM is to be exported.","schema":{"type":"string","enum":["XML","JSON"]}},{"name":"output_format","in":"query","description":"The version of the SBOM format to be used.","schema":{"type":"string","enum":["CycloneDX 1.4","SPDX"]}},{"name":"attributes","in":"query","description":"The list of attributes to be included in the SBOM. If not specified, all fields are included except `Type` and `Name`, which are always included.","schema":{"type":"string","enum":["PURL","Author","Version","License","Source Package","Binaries"]}},{"name":"assetID","in":"path","description":"ID of the asset of which you want to export the SBOM","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"OK. The request was successful, and the SBOM data is returned in the specified format.","content":{"application/xml":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Bad Request. The request was malformed, missing the required parameters, or the Asset ID provided does not support SBOM Export.","content":{"application/json":{"schema":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}},"401":{"description":"The API key provided is invalid or missing.","content":{"application/json":{"schema":{"type":"object","properties":{"err_code":{"$ref":"#/components/schemas/err_code"},"err_msg":{"$ref":"#/components/schemas/err_msg"},"err_extra":{"$ref":"#/components/schemas/err_extra"}}}}}},"403":{"description":"Forbidden. The API key does not have the necessary permissions to access the requested resource.","content":{"application/json":{"schema":{"type":"object","properties":{"err_code":{"$ref":"#/components/schemas/err_code"},"err_msg":{"$ref":"#/components/schemas/err_msg"},"err_extra":{"$ref":"#/components/schemas/err_extra"}}}}}},"404":{"description":"The specified asset was not found.","content":{"application/json":{"schema":{"type":"object","properties":{"err_code":{"$ref":"#/components/schemas/err_code"},"err_msg":{"$ref":"#/components/schemas/err_msg"},"err_extra":{"$ref":"#/components/schemas/err_extra"}}}}}},"500":{"description":"An error occurred on the server while processing the request.","content":{"application/json":{"schema":{"type":"object","properties":{"err_code":{"$ref":"#/components/schemas/err_code"},"err_msg":{"$ref":"#/components/schemas/err_msg"},"err_extra":{"$ref":"#/components/schemas/err_extra"}}}}}}}}}},"components":{"schemas":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/sbom.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.