docs

Create SBOM

POST /sscs/sboms

Scope sbom:write Plan Growth+

Register an SBOM record without uploading a manifest, for example when components are attached by a later process. source is forced to manual; sbomId and orgId are server-assigned and sending them is rejected. Requires the sbom:write scope (or a signed-in Owner or Manager session).

Example

curl -X POST "https://api.autociso.io/api/v1/sscs/sboms" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"example-service","version":"2026.9.1","repoUrl":"https://git.example.com/example-org/example-service","branch":"main"}'

Response 201

{
  "data": {
    "sbomId": "sbom_example000002",
    "orgId": "org_example000001",
    "name": "example-service",
    "version": "2026.9.1",
    "source": "manual",
    "repoUrl": "https://git.example.com/example-org/example-service",
    "branch": "main",
    "componentCount": 0,
    "findingsCritical": 0,
    "findingsHigh": 0,
    "findingsMedium": 0,
    "findingsLow": 0,
    "createdAt": "2026-09-01T09:32:41Z",
    "updatedAt": "2026-09-01T09:32:41Z"
  }
}

Request body

  • name string required
    minLength 1
  • version string
  • assetId string
  • repoUrl string
  • branch string
  • No other fields.

Returns

The data field of the standard { data, error, meta } envelope:

  • sbomId string
  • orgId string required
  • name string required
    Product or repository name.
  • version string
  • assetId string
    Linked asset id, when the SBOM belongs to a known asset.
  • source string required
    How the SBOM was ingested.
    15 values
    "go.sum" | "pom.xml" | "build.gradle" | "package.json" | "requirements.txt" | "csproj" | "Cargo.lock" | "Gemfile.lock" | "composer.lock" | "Podfile.lock" | "Package.resolved" | "pubspec.lock" | "cyclonedx" | "spdx" | "manual"
  • sourceRef string
    Git SHA, CI build id or filename.
  • repoUrl string
  • branch string
  • commitSha string
  • componentCount integer required
    minimum 0
  • findingsCritical integer required
    minimum 0
  • findingsHigh integer required
    minimum 0
  • findingsMedium integer required
    minimum 0
  • findingsLow integer required
    minimum 0
  • lastMatchedAt string (date-time)
    Time of the last CVE matching run; absent before the first run.
  • createdAt string (date-time) required
  • updatedAt string (date-time) required

Errors

Status Code Retry Meaning
400 VALIDATION_FAILED no The JSON body does not match the request schema. code VALIDATION_FAILED, or INVALID_REQUEST when the body cannot be read.
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN).
413 FILE_TOO_LARGE no The body exceeds the size limit. code FILE_TOO_LARGE (upload, 5 MB) or PAYLOAD_TOO_LARGE (JSON body).
429 RATE_LIMITED yes Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500 DB_ERROR no Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support.
503 BILLING_UNAVAILABLE yes Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc