# Export application SBOM report asynchronously (Dependencies - SCA)

Endpoint: POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/SBOM
Version: 3.0
Security: bearer-key

## Path parameters:

  - `applicationUuid` (string, required)
    Application UUID (Administration > Applications)

## Request fields (application/json):

  - `name` (string)

  - `format` (string)
    Enum: "json", "html", "unknown", "xml", "excel", "yaml", "pdf", "tv", "rdf", "csv", "sarif", "text"

  - `sendEmailNotification` (boolean)

  - `projectUuids` (array)

  - `reportType` (string)
    SBOM report type. Only SPDX and CycloneDX variants are valid for this endpoint.
    Enum: "attribution", "inventory", "vulnerabilities", "securityAlerts", "sbom", "Cbom", "securityAlertsLibrary", "Compliance", "Findings", "Suppressions", "Resolved", "spdx", "spdx_2_3", "cycloneDX", "cycloneDX_1_5", "cycloneDX_1_6", "dueDiligence", "unknown", "imgAttribution", "imgDueDiligence", "imgSpdx", "imgSpdx_2_3", "imgCycloneDX", "imgCycloneDX_1_5", "aiInventory", "aiFindings", "imgCycloneDX_1_6", "risk", "users", "zeroDayCatalog", "activityLog", "spdx", "spdx_2_3", "cycloneDX", "cycloneDX_1_5", "cycloneDX_1_6"

  - `maxDepthLevel` (integer)
    Maximum depth level of the dependency tree to include in the report. Applies to CycloneDX variants only and must be between 1 and 4; values outside this range (including 0) are rejected with a 400 error. Ignored for SPDX variants.
    Example: 1

  - `includeVulnerabilities` (boolean)

  - `isMlBomReport` (boolean)
    When true, generates an ML-BOM (AI/ML Bill of Materials) that includes only machine-learning model components. If the selected scope contains no ML/AI model components, the generated report will be empty (for CycloneDX/SPDX this yields an empty ZIP). Defaults to false.

  - `componentGranularity` (string)
    Component granularity: 'library' (default) or 'file' for source-file-level coverage
    Enum: "library", "file"

## Response 200 fields (application/json):

  - `supportToken` (string)
    Example: "1171c60d"

  - `response` (object)

  - `response.uuid` (string)

  - `response.name` (string)

  - `response.scopeUuid` (string)

  - `response.scopeName` (string)

  - `response.subScopes` (array)

  - `response.subScopes.uuid` (string)

  - `response.subScopes.name` (string)

  - `response.subScopes.scopeUuid` (string)

  - `response.subScopes.scopeName` (string)

  - `response.title` (string)

  - `response.reportType` (string)
    Enum: "attribution", "inventory", "vulnerabilities", "securityAlerts", "sbom", "Cbom", "securityAlertsLibrary", "Compliance", "Findings", "Suppressions", "Resolved", "spdx", "spdx_2_3", "cycloneDX", "cycloneDX_1_5", "cycloneDX_1_6", "dueDiligence", "unknown", "imgAttribution", "imgDueDiligence", "imgSpdx", "imgSpdx_2_3", "imgCycloneDX", "imgCycloneDX_1_5", "aiInventory", "aiFindings", "imgCycloneDX_1_6", "risk", "users", "zeroDayCatalog", "activityLog"

  - `response.format` (string)
    Enum: same as `format` (12 values)

  - `response.scopeType` (string)
    Enum: "organization", "product", "project", "unsupported", "account"

  - `response.scopeUuidList` (array)

  - `response.projectUuids` (array)

  - `response.status` (string)
    Enum: "PENDING", "IN_PROGRESS", "FAILED", "FAILURE", "SUCCESS"

  - `response.createdBy` (string)

  - `response.createdAt` (string)

  - `response.sendEmailNotification` (boolean)

  - `response.labelsUuidList` (array)

  - `response.includeVulnerabilities` (boolean)

  - `response.excludeInactiveProjects` (boolean)

## Response 400 fields (*/*):

  - `supportToken` (string)
    Example: "1171c60d"