# Upload SBOM manifest

Upload a dependency manifest as `multipart/form-data`.

`POST /sscs/sboms/upload`

Scope `sbom:write` | Plan **Growth+**

Upload a dependency manifest as `multipart/form-data`. The file is parsed, an SBOM and its components are stored, and CVE matching starts in the background: the response returns before matching finishes, so the finding counts are zero here and populate shortly after.

Accepted filenames: `go.sum`, `pom.xml`, `build.gradle`, `build.gradle.kts`, `package.json`, `requirements.txt`. The parser is chosen from the base filename, not the extension. The body limit is 5 MB; a larger body returns 413 FILE_TOO_LARGE.

Requires the sbom:write scope (or a signed-in Owner or Manager session).

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `sbomId`: optional string
- `orgId`: string
- `name`: string Product or repository name.
- `version`: optional string
- `assetId`: optional string Linked asset id, when the SBOM belongs to a known asset.
- `source`: string How the SBOM was ingested.
  - `go.sum`
  - `pom.xml`
  - `build.gradle`
  - `package.json`
  - `requirements.txt`
  - `csproj`
  - `Cargo.lock`
  - `Gemfile.lock`
  - `composer.lock`
  - `Podfile.lock`
  - `Package.resolved`
  - `pubspec.lock`
  - `cyclonedx`
  - `spdx`
  - `manual`
- `sourceRef`: optional string Git SHA, CI build id or filename.
- `repoUrl`: optional string
- `branch`: optional string
- `commitSha`: optional string
- `componentCount`: integer minimum 0
- `findingsCritical`: integer minimum 0
- `findingsHigh`: integer minimum 0
- `findingsMedium`: integer minimum 0
- `findingsLow`: integer minimum 0
- `lastMatchedAt`: optional string (date-time) Time of the last CVE matching run; absent before the first run.
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | `UNSUPPORTED_FORMAT` | no | The upload was rejected. code INVALID_REQUEST (unreadable multipart body), MISSING_FILE (no file field), UNSUPPORTED_FORMAT (filename is not a supported manifest) or PARSE_ERROR (the manifest could not be parsed). |
| 400 | `MISSING_FILE` | no | The upload was rejected. code INVALID_REQUEST (unreadable multipart body), MISSING_FILE (no file field), UNSUPPORTED_FORMAT (filename is not a supported manifest) or PARSE_ERROR (the manifest could not be parsed). |
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN). |
| 413 | `FILE_TOO_LARGE` | no | The body exceeds the size limit. code FILE_TOO_LARGE (upload, 5 MB) or PAYLOAD_TOO_LARGE (JSON body). |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.post(
    "https://api.autociso.io/api/v1/sscs/sboms/upload",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/sscs/sboms/upload", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (201)

```json
{
  "data": {
    "sbomId": "sbom_example000003",
    "orgId": "org_example000001",
    "name": "example-service",
    "version": "2026.9.1",
    "source": "go.sum",
    "componentCount": 0,
    "findingsCritical": 0,
    "findingsHigh": 0,
    "findingsMedium": 0,
    "findingsLow": 0,
    "createdAt": "2026-09-01T09:32:41Z",
    "updatedAt": "2026-09-01T09:32:41Z"
  }
}
```