Skip to content
Platform API 3.0
/
/
Export application SBOM r...

Export application SBOM report asynchronously (Dependencies - SCA)

Request

Security
bearer-key
Path
applicationUuidstringrequired

Application UUID (Administration > Applications)

Bodyapplication/jsonrequired
namestring
formatstring
Enum:"json""html""unknown""xml""excel""yaml""pdf""tv""rdf""csv"
sendEmailNotificationboolean
projectUuidsArray of strings
reportTypestring

SBOM report type. Only SPDX and CycloneDX variants are valid for this endpoint.

Enum:"attribution""inventory""vulnerabilities""securityAlerts""sbom""Cbom""securityAlertsLibrary""Compliance""Findings""Suppressions"
Example:"spdx"
maxDepthLevelinteger, (int32), [ 1 .. 4 ]

Maximum depth level of the dependency tree to include in the report. Applies to CycloneDX variants only and must be between 1 and 4; values outside this range (including 0) are rejected with a 400 error. Ignored for SPDX variants.

Example:1
includeVulnerabilitiesboolean
isMlBomReportboolean

When true, generates an ML-BOM (AI/ML Bill of Materials) that includes only machine-learning model components. If the selected scope contains no ML/AI model components, the generated report will be empty (for CycloneDX/SPDX this yields an empty ZIP). Defaults to false.

Example:false
componentGranularitystring

Component granularity: 'library' (default) or 'file' for source-file-level coverage

Enum:"library""file"
Example:"library"
reportStructurestring

How the report is split over files. 'PER_PROJECT' (default) generates one SBOM file per project in the scope; 'AGGREGATED' generates a single file covering all of them, rooted in this application. 'AGGREGATED' requires a scope of more than one project — it is rejected when projectUuids selects exactly one project — and supports componentGranularity 'library' only. Aggregated files can be very large for applications with many projects.

Enum:"PER_PROJECT""AGGREGATED""PER_PROJECT""AGGREGATED"
Example:"PER_PROJECT"
{
  "name": "string",
  "format": "json",
  "sendEmailNotification": true,
  "projectUuids": [
    "string"
  ],
  "reportType": "spdx",
  "maxDepthLevel": 1,
  "includeVulnerabilities": true,
  "isMlBomReport": false,
  "componentGranularity": "library",
  "reportStructure": "PER_PROJECT"
}

Responses

OK

Bodyapplication/json
supportTokenstring(Support Token)
Example:"1171c60d"
responseobject(ReportExportProcessDTO)
Response
{
  "supportToken": "1171c60d",
  "response": {
    "uuid": "string",
    "name": "string",
    "scopeUuid": "string",
    "scopeName": "string",
    "subScopes": [ … ],
    "title": "string",
    "reportType": "attribution",
    "format": "json",
    "scopeType": "organization",
    "scopeUuidList": [ … ],
    "projectUuids": [ … ],
    "status": "PENDING",
    "createdBy": "string",
    "createdAt": "2019-08-24T14:15:22Z",
    "sendEmailNotification": true,
    "labelsUuidList": [ … ],
    "includeVulnerabilities": true,
    "excludeInactiveProjects": true
  }
}