# List SBOM components

List the resolved components of one SBOM.

`GET /sscs/sboms/{sbomId}/components`

Scope `sbom:read` | Plan **Growth+**

List the resolved components of one SBOM. Ownership of the SBOM is verified before any component is returned, so an id from another organization yields 404, never another tenant's data. Requires the sbom:read scope.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `sbomId` | string | yes | SBOM id. |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `componentId`: optional string
- `orgId`: string
- `sbomId`: string
- `name`: string Package name as used in its ecosystem.
- `version`: string
- `ecosystem`: string
  - `go`
  - `maven`
  - `npm`
  - `pypi`
  - `nuget`
  - `cargo`
  - `gem`
  - `composer`
  - `cocoapods`
  - `swift`
  - `pub`
  - `hex`
  - `rpm`
  - `deb`
  - `other`
- `purl`: optional string Package URL used for CVE matching.
- `cpeUri`: optional string
- `upstreamName`: optional string Canonical upstream project name used in CVE descriptions.
- `direct`: boolean True for a direct dependency, false for a transitive one.
- `vendorId`: optional string Linked vendor id, when the component comes from a tracked vendor.
- `license`: optional string
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN). |
| 404 | `NOT_FOUND` | no | Unknown or foreign-tenant SBOM id. code NOT_FOUND. |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/sscs/sboms/<sbomId>/components" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/sscs/sboms/<sbomId>/components",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/sscs/sboms/<sbomId>/components", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "componentId": "comp_example000001",
      "orgId": "org_example000001",
      "sbomId": "sbom_example000001",
      "name": "example.com/lib/parser",
      "version": "v1.9.1",
      "ecosystem": "go",
      "purl": "pkg:golang/example.com/lib/parser",
      "direct": true,
      "license": "MIT",
      "createdAt": "2026-09-01T09:32:41Z",
      "updatedAt": "2026-09-01T09:32:41Z"
    }
  ]
}
```