docs

List SBOM components

GET /sscs/sboms/{sbomId}/components

Scope sbom:read Plan Growth+

List the resolved components of one SBOM. Ownership of the SBOM is verified before any component is returned, so an id from another organization yields 404, never another tenant’s data. Requires the sbom:read scope.

Example

curl "https://api.autociso.io/api/v1/sscs/sboms/<sbomId>/components" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "componentId": "comp_example000001",
      "orgId": "org_example000001",
      "sbomId": "sbom_example000001",
      "name": "example.com/lib/parser",
      "version": "v1.9.1",
      "ecosystem": "go",
      "purl": "pkg:golang/example.com/lib/parser",
      "direct": true,
      "license": "MIT",
      "createdAt": "2026-09-01T09:32:41Z",
      "updatedAt": "2026-09-01T09:32:41Z"
    }
  ]
}

Path parameters

  • sbomId string required
    SBOM id.

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • componentId string
  • orgId string required
  • sbomId string required
  • name string required
    Package name as used in its ecosystem.
  • version string required
  • ecosystem string required
    15 values
    "go" | "maven" | "npm" | "pypi" | "nuget" | "cargo" | "gem" | "composer" | "cocoapods" | "swift" | "pub" | "hex" | "rpm" | "deb" | "other"
  • purl string
    Package URL used for CVE matching.
  • cpeUri string
  • upstreamName string
    Canonical upstream project name used in CVE descriptions.
  • direct boolean required
    True for a direct dependency, false for a transitive one.
  • vendorId string
    Linked vendor id, when the component comes from a tracked vendor.
  • license string
  • createdAt string (date-time) required
  • updatedAt string (date-time) required

Errors

Status Code Retry Meaning
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN).
404 NOT_FOUND no Unknown or foreign-tenant SBOM id. code NOT_FOUND.
429 RATE_LIMITED yes Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500 DB_ERROR no Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support.
503 BILLING_UNAVAILABLE yes Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc