Upload SBOM manifest

POST /sscs/sboms/upload

Scope sbom:write Plan Growth+

Upload a dependency manifest as multipart/form-data. The file is parsed, an SBOM and its components are stored, and CVE matching starts in the background: the response returns before matching finishes, so the finding counts are zero here and populate shortly after.

Accepted filenames: go.sum, pom.xml, build.gradle, build.gradle.kts, package.json, requirements.txt. The parser is chosen from the base filename, not the extension. The body limit is 5 MB; a larger body returns 413 FILE_TOO_LARGE.

Requires the sbom:write scope (or a signed-in Owner or Manager session).

curl -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
  -H "Authorization: Bearer <your-api-token>"

import requests

response = requests.post(
    "https://api.autociso.io/api/v1/sscs/sboms/upload",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/sscs/sboms/upload", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());

{
  "data": {
    "sbomId": "sbom_example000003",
    "orgId": "org_example000001",
    "name": "example-service",
    "version": "2026.9.1",
    "source": "go.sum",
    "componentCount": 0,
    "findingsCritical": 0,
    "findingsHigh": 0,
    "findingsMedium": 0,
    "findingsLow": 0,
    "createdAt": "2026-09-01T09:32:41Z",
    "updatedAt": "2026-09-01T09:32:41Z"
  }
}