# SBOM Inventory
URL: https://docs.autociso.io/console/supply-chain/sboms/
Description: A Software Bill of Materials (SBOM) is a list of the open-source and third-party components your software depends on.

*This is the help text the console shows in the help panel on this page.*

A **Software Bill of Materials (SBOM)** is a list of the open-source and third-party components your software depends on. Upload a dependency manifest and AutoCISO lists its components and matches them against [known vulnerabilities](https://docs.autociso.io/console/supply-chain/findings/). Supply Chain is available on [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/).

### Why Maintain an SBOM Inventory?
- **Supply Chain Visibility**: Know exactly what's inside your software, including transitive dependencies listed in the manifest.
- **Continuous Monitoring**: AutoCISO re-checks your inventory against the NVD and Red Hat vulnerability feeds every night, with no re-upload needed.
- **One place for results**: The four cards at the top show open findings by severity (Critical, High, Medium, Low) across all your SBOMs.

### Managing Your Inventory
- **Upload Manifest**: Click **Upload Manifest**, choose a file, enter an SBOM name and an optional version. Accepted files: `go.sum`, `pom.xml`, `build.gradle` / `build.gradle.kts`, `package.json`, `requirements.txt` (max 5 MB). The file name decides how it is parsed. CycloneDX and SPDX documents are not accepted.
- **Table**: Name, Version, Findings (C / H / M / L counts) and Last Scanned. Use the search box to filter by name.
- **Details**: Click a row to see the [SBOM's components](https://docs.autociso.io/api/reference/sboms/list-components/) (name, version, ecosystem, PURL) and its findings.
- **Delete**: The trash icon deletes the SBOM together with its components and findings. This cannot be undone.

### CI/CD Integration

[Automate uploads from your build pipeline](https://docs.autociso.io/api/upload-sbom/): push the dependency manifest of each service on every build.

**API Token**: Create a [dedicated token](https://docs.autociso.io/developers/api-tokens/) with the `sbom:write` scope from the user menu → [**API Tokens**](https://docs.autociso.io/console/settings/api-tokens/) and store it as a CI/CD secret.

**curl**
```bash
curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
    -H 'Authorization: Bearer aci_...' \
    -F 'file=@/path/to/build.gradle' \
    -F 'name=my-org/my-service' \
    -F 'version=1.0.0'
```

**GitHub Actions**
```yaml
- name: Upload SBOM to AutoCISO
  run: |
    curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
      -H 'Authorization: Bearer ${{ secrets.AUTOCISO_API_TOKEN }}' \
      -F 'file=@build.gradle' \
      -F 'name=${{ github.repository }}' \
      -F 'version=${{ github.ref_name }}'
```

Store the token as `AUTOCISO_API_TOKEN` in **Settings → Secrets and variables → Actions**.

**GitLab CI**
```yaml
upload-sbom:
  stage: security
  script:
    - |
      curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
        -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
        -F 'file=@build.gradle' \
        -F "name=$CI_PROJECT_PATH" \
        -F "version=$CI_COMMIT_REF_NAME"
```

Store the token as `AUTOCISO_API_TOKEN` in **Settings → CI/CD → Variables** (masked, protected).