Upload an SBOM via API

AutoCISO accepts SBOM files in CycloneDX and SPDX formats via a REST API endpoint. This guide walks through the upload flow.

Endpoint

POST https://api.autociso.io/api/v1/sscs/sboms/upload

Prerequisites

• An API token with the sbom:write scope — see Obtaining an API Token
• An SBOM file in CycloneDX JSON/XML or SPDX JSON format

Request

Send a multipart/form-data request with the SBOM file attached:

curl -X POST https://api.autociso.io/api/v1/sscs/sboms/upload \
  -H "Authorization: Bearer <your-token>" \
  -F "file=@sbom.cyclonedx.json" \
  -F "assetName=my-service" \
  -F "version=1.2.3"

Request fields

Response

A successful upload returns 201 Created:

{
  "data": {
    "id": "sbom_1hgyun41rx48",
    "assetName": "my-service",
    "version": "1.2.3",
    "format": "cyclonedx",
    "componentCount": 142,
    "createdAt": "2026-04-26T10:00:00Z"
  },
  "error": null
}

Error responses

CI/CD integration example

# GitHub Actions example
- name: Upload SBOM
  run: |
    curl -X POST https://api.autociso.io/api/v1/sscs/sboms/upload \
      -H "Authorization: Bearer ${{ secrets.AUTOCISO_API_TOKEN }}" \
      -F "file=@sbom.json" \
      -F "assetName=${{ github.repository }}" \
      -F "version=${{ github.sha }}"

Next steps

• Review uploaded SBOMs under SSCS → SBOMs in the AutoCISO console
• Vulnerabilities found in uploaded SBOMs appear under SSCS → Vulnerabilities