# Upload an SBOM from CI
URL: https://docs.autociso.io/api/upload-sbom/
Description: Send a dependency manifest (go.sum, pom.xml, Gradle, package.json or requirements.txt) to AutoCISO from your pipeline so its components are inventoried and matched against known vulnerabilities.

Upload a dependency manifest on every build and AutoCISO keeps an up-to-date software bill of materials (SBOM) for
each service: it parses the components, stores them, and matches them against vulnerability feeds in the background.
Findings appear under **Operations → Supply Chain → Findings** in the console
([screen reference](https://docs.autociso.io/console/supply-chain/findings/)) and through the
[supply chain API](https://docs.autociso.io/api/reference/sboms/upload/).

## Before you start

- Your organisation is on [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/) (Supply Chain Security). Otherwise the endpoint answers
  `402 FEATURE_GATED`.
- An API token with the `sbom:write` scope, stored as a CI secret — see [API tokens](https://docs.autociso.io/developers/api-tokens/).
- The manifest of the service you build. Accepted files, recognised **by file name**:

| Ecosystem | File name |
|---|---|
| Go | `go.sum` |
| Maven | `pom.xml` |
| Gradle | `build.gradle`, `build.gradle.kts` |
| npm | `package.json` |
| Python | `requirements.txt` |

**Warning — The file name decides the parser**

AutoCISO chooses the parser from the uploaded file's base name, not its content or extension. Upload `package.json`
as `package.json`, not `deps.json`. Other formats, including CycloneDX and SPDX documents, are rejected with
`400 UNSUPPORTED_FORMAT`.

## The request

`POST https://api.autociso.io/api/v1/sscs/sboms/upload` with `multipart/form-data`
([endpoint reference](https://docs.autociso.io/api/reference/sboms/upload/)).

The form fields are `file` (required, the manifest, at most 5 MB), `name` and `version` (both optional). Their exact rules and defaults are on the [Upload SBOM](https://docs.autociso.io/api/reference/sboms/upload/) page.

Unknown form fields are ignored, so a typo in `name` silently names the SBOM after the file.

```bash
curl -s -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
  -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
  -F "file=@go.sum" \
  -F "name=payment-service" \
  -F "version=1.4.2"
```

## The response

`201 Created` with the new SBOM. Components are stored in the same request; vulnerability matching starts in the
background, so finding counts are zero in this response and fill in shortly after.

```json
{
  "data": {
    "sbomId": "sbom_1hgyun41rx48",
    "orgId": "org_1hgyuk0c2m9a",
    "name": "payment-service",
    "version": "1.4.2",
    "source": "go.sum",
    "findingsCritical": 0,
    "findingsHigh": 0,
    "findingsMedium": 0,
    "findingsLow": 0,
    "createdAt": "2026-10-07T10:00:00Z"
  },
  "error": null
}
```

## Errors

The upload answers with the standard [error codes](https://docs.autociso.io/developers/errors-and-limits/): a file that is missing, in an unsupported format or too large is refused before anything is stored; a file over 5 MB gets `413 FILE_TOO_LARGE`. Each status and code is listed on the [Upload SBOM](https://docs.autociso.io/api/reference/sboms/upload/) page.

## GitHub Actions

```yaml
- name: Upload SBOM to AutoCISO
  env:
    AUTOCISO_API_TOKEN: ${{ secrets.AUTOCISO_API_TOKEN }}
  run: |
    curl -sf -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
      -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
      -F "file=@go.sum" \
      -F "name=${{ github.event.repository.name }}" \
      -F "version=${{ github.sha }}"
```

`curl -f` makes the step fail on any HTTP error, so a revoked token or a plan change is noticed in CI rather than
silently skipped. Each upload creates a new SBOM record; delete old ones with [`DELETE /api/v1/sscs/sboms/{sbomId}`](https://docs.autociso.io/api/reference/sboms/delete/)
if you only want to keep the latest, or in [SBOM Inventory](https://docs.autociso.io/console/supply-chain/sboms/) in the console.

## Next steps

- Read findings back with [`GET /api/v1/sscs/findings`](https://docs.autociso.io/api/reference/findings/list/) — see the
  [supply chain API](https://docs.autociso.io/api/reference/sboms/upload/).
- Every parameter of every endpoint: [SBOMs endpoint reference](https://docs.autociso.io/api/reference/sboms/list/).