Upload SBOM

POST

/service/{service}/version/{serviceVersionName}/sbom

Upload a Software Bill of Materials (SBOM) for a service version to enable vulnerability analysis. The SBOM can be uploaded during the build step before deployment (e.g., in CI/CD pipeline) or after the service has already been deployed. Multiple SBOMs can be uploaded for the same service version to track vulnerabilities across different components or images.

Important considerations:

• Ensure the serviceVersionName used when uploading the SBOM matches exactly the version name used during deployment. Mismatches will prevent proper association of vulnerability data with your running service.
• When providing the image parameter, use the exact same image reference (including registry, repository, tag, or digest) that will be deployed. This ensures accurate tracking of vulnerabilities for the specific image version.
• The SBOM must be valid JSON in either CycloneDX or SPDX format. Invalid formats will result in a 400 error.

Authorizations

• integration_token

Parameters

Path Parameters

service

required

string

Service name or ID

serviceVersionName

required

string

Version name or alias

Query Parameters

image

string

Container image reference (e.g., registry/repo:tag)

Request Body ^required

SBOM content in JSON format (CycloneDX or SPDX)

SBOM JSON document in CycloneDX or SPDX format

object

Responses

200

SBOM uploaded successfully

400

Invalid SBOM format or request

401

Access token is missing or invalid

Request failure

object

errorMessage

string

404

Unknown service