Upload an SBOM from CI

Upload a dependency manifest on every build and AutoCISO keeps an up-to-date software bill of materials (SBOM) for each service: it parses the components, stores them, and matches them against vulnerability feeds in the background. Findings appear under Operations → Supply Chain → Findings in the console (screen reference) and through the supply chain API.

Before you start

• Your organisation is on The Growth plan or higher (Supply Chain Security). Otherwise the endpoint answers 402 FEATURE_GATED.
• An API token with the sbom:write scope, stored as a CI secret — see API tokens.
• The manifest of the service you build. Accepted files, recognised by file name:

The request

POST https://api.autociso.io/api/v1/sscs/sboms/upload with multipart/form-data (endpoint reference).

The form fields are file (required, the manifest, at most 5 MB), name and version (both optional). Their exact rules and defaults are on the Upload SBOM page.

Unknown form fields are ignored, so a typo in name silently names the SBOM after the file.

curl -s -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
  -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
  -F "file=@go.sum" \
  -F "name=payment-service" \
  -F "version=1.4.2"

The response

201 Created with the new SBOM. Components are stored in the same request; vulnerability matching starts in the background, so finding counts are zero in this response and fill in shortly after.

{
  "data": {
    "sbomId": "sbom_1hgyun41rx48",
    "orgId": "org_1hgyuk0c2m9a",
    "name": "payment-service",
    "version": "1.4.2",
    "source": "go.sum",
    "findingsCritical": 0,
    "findingsHigh": 0,
    "findingsMedium": 0,
    "findingsLow": 0,
    "createdAt": "2026-10-07T10:00:00Z"
  },
  "error": null
}

Errors

The upload answers with the standard error codes: a file that is missing, in an unsupported format or too large is refused before anything is stored; a file over 5 MB gets 413 FILE_TOO_LARGE. Each status and code is listed on the Upload SBOM page.

GitHub Actions

- name: Upload SBOM to AutoCISO
  env:
    AUTOCISO_API_TOKEN: ${{ secrets.AUTOCISO_API_TOKEN }}
  run: |
    curl -sf -X POST "https://api.autociso.io/api/v1/sscs/sboms/upload" \
      -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
      -F "file=@go.sum" \
      -F "name=${{ github.event.repository.name }}" \
      -F "version=${{ github.sha }}"

curl -f makes the step fail on any HTTP error, so a revoked token or a plan change is noticed in CI rather than silently skipped. Each upload creates a new SBOM record; delete old ones with DELETE /api/v1/sscs/sboms/{sbomId} if you only want to keep the latest, or in SBOM Inventory in the console.

Next steps

• Read findings back with GET /api/v1/sscs/findings — see the supply chain API.
• Every parameter of every endpoint: SBOMs endpoint reference.