Supply Chain API Reference

The supply-chain endpoints are the complete REST surface available to an API token. Base URL:

https://api.autociso.io/api/v1

Every response uses the { data, error, meta } envelope. List endpoints return a bare array in data and do not paginate.

SBOMs

`GET /sscs/sboms`

List Software Bills of Materials. Scope: sbom:read.

Parameter	In	Type	Notes
`q`	query	string	Optional free-text filter on SBOM name

`GET /sscs/sboms/{sbomId}`

Fetch a single SBOM by ID. Scope: sbom:read.

`GET /sscs/sboms/{sbomId}/components`

List the components parsed out of an SBOM. Scope: sbom:read.

`POST /sscs/sboms`

Create an SBOM record without uploading a file. Scope: sbom:write.

{
  "name":     "payment-service",
  "version":  "1.4.2",
  "assetId":  "ast_1hgyun41rx48",
  "repoUrl":  "https://github.com/acme/payment-service",
  "branch":   "main"
}

Only name is required. Unrecognised fields are rejected with VALIDATION_FAILED.

`POST /sscs/sboms/upload`

Upload and parse an SBOM file. Scope: sbom:write. Content type: multipart/form-data.

Field	Required	Notes
`file`	Yes	The SBOM file. Format is detected from the filename extension.
`name`	No	Defaults to the uploaded filename
`version`	No	Free-text version string

Components are parsed and stored in the same request. See Upload an SBOM via API for a full walkthrough.

`DELETE /sscs/sboms/{sbomId}`

Delete an SBOM and its components. Scope: sbom:write.

Findings

Findings are vulnerabilities matched against the components in your SBOMs.

`GET /sscs/findings`

List vulnerability findings. Scope: sbom:read.

Parameter	In	Type	Notes
`status`	query	enum	`open` (default), `mitigated`, `accepted_risk`, `false_positive`, `fixed`
`severity`	query	enum	`CRITICAL`, `HIGH`, `MEDIUM`, `LOW` — uppercase
`sbomId`	query	string	Restrict to one SBOM

`GET /sscs/findings/summary`

Counts of open findings grouped by severity. Scope: sbom:read.

`PATCH /sscs/findings/{findingId}/status`

Triage a finding. Scope: sbom:write.

{
  "status": "accepted_risk",
  "remediationNotes": "Compensating control in place — see RISK-482"
}

status is required and must be one of open, mitigated, accepted_risk, false_positive, fixed.

Vendors

`GET /sscs/vendors`

List supply-chain vendors. Scope: sbom:read.

`GET /sscs/vendors/risk-summary`

Aggregate vendor risk. Scope: sbom:read.

`POST /sscs/vendors`

Create a vendor. Scope: sbom:write.

{
  "name":             "Acme Analytics",
  "website":          "https://acme.example",
  "type":             "commercial",
  "riskTier":         2,
  "assessmentStatus": "not_started",
  "notes":            "Processes pseudonymised telemetry only"
}

Field	Required	Values
`name`	Yes	Non-empty string
`type`	Yes	`oss`, `commercial`, `internal`
`riskTier`	Yes	Integer `1`, `2`, or `3`
`assessmentStatus`	Yes	`not_started`, `in_progress`, `completed`
`website`	No	String
`notes`	No	String

`PUT /sscs/vendors/{vendorId}`

Replace a vendor. Scope: sbom:write. Same body as POST /sscs/vendors — all required fields must be present.

Errors

See API Quickstart for the full status and code table. The two you will meet most often:

403 INSUFFICIENT_SCOPE — the token is valid but lacks sbom:read or sbom:write
400 VALIDATION_FAILED — the JSON body failed schema validation; schemas set additionalProperties: false, so an unexpected field is an error, not a no-op

Next steps

Last reviewed: 2026-09-09

Was this page helpful?