SBOM export

Learn about SBOM export reports.

This feature is only available for enterprise users. Already have an account? Click here to upgrade.

Export a CycloneDX or SPDX SBOM using web tool

Keep in mind that this feature is only available for enterprise users.

In order to generate the CycloneDX or SPDX SBOM Export:

1. Click Generate export on the top right corner of the page.

2. Under Scope, choose one of the following options:

   1. Global export: Export the SBOM for all repositories you have access to.

   2. Repositories: Select specific repositories for which you want to view the data and then choose the corresponding branch. If you select multiple repositories, the Branch drop-down will display only the branches common to all the selected repositories.

   3. Groups: Export the SBOM for a specific group of repositories.

3. Under Export Type, select CycloneDX or SPDX under SBOM.

4. Click Generate.

5. Check your email for the exported data, which will be sent to you in the .json format. If you cannot find the email in your inbox, check the spam folder.

Export a CycloneDX or SPDX SBOM using web tool - video guide

Export a CycloneDX or SPDX SBOM to email using API

If you have already integrated your repository with Fortify SCA, you can generate a CycloneDX or SPDX SBOM by fetching your data through the API.

To use the Fortify SCA REST API, you should authenticate first.

Endpoint: /api/{1.0}/open/sbom/generate

Following is an example of a request using curl to generate an SPDX SBOM (to generate a CycloneDX SBOM use "format": "CycloneDX"):

curl -X 'POST' \
  'https://debricked.com/api/1.0/open/sbom/generate' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "format": "SPDX-2.3",
  "email": "[e-mail]",
  "repositoryIds": [
    1
  ],
  "vulnerabilities": true,
  "rootFixes": true,
  "licenses": true,
  "sendEmail": true
}'

You can send the following parameters in the body of the request: commitId, email, repositoryIds, branch, locale. You can choose to add license and vulnerability data, using licenses: true/false and vulnerabilities: true/false.

If you provide a commitId, the branch and repositoryIds will be ignored. If you leave the branch field empty, the report is generated for the identified default branch (most likely 'main' or 'master', if applicable) of the selected repository. It is also possible to create an SBOM for all repositories by not specifying any repositoryIds.

Once you send the request, you will receive your SBOM via email, which will be sent to you in the .json format. If you can’t find the email in your inbox, make sure to check the SPAM folder. If you do not provide an email address, the SBOM will be sent to the email of the user who created the request.

Export a CycloneDX or SPDX SBOM to email using API - video guide

Export a CycloneDX or SPDX SBOM directly from API

It is also possible to generate a CycloneDX or SPDX SBOM and download it directly through the API. As part of the response of the /api/1.0/open/sbom/generate endpoint, a reportUuid is sent, which can be used in the /api/1.0/open/sbom/download endpoint.

Following is an example response from the /api/1.0/open/sbom/generate endpoint:

{
  "message": "The report has started generating and can be downloaded through the 'download' endpoint once ready, by using the reportUuId stated below. Be aware that it might take some time before it's finished",
  "reportUuid": "<report_uuid>",
  "notes": [
    "Example note"
  ]
}

Following is an example request for the /api/1.0/open/sbom/download endpoint:

curl -X 'GET' \
  'https://debricked.com/api/1.0/open/sbom/download?reportUuid=<report_uuid>' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer <token>'

If you do not want the report to also be sent to your email, it is possible to turn this off by setting the "sendEmail" value to "false" in the /api/1.0/open/sbom/generate endpoint.

Click the following link for an example on exporting CycloneDX SBOM:

CycloneDX SBOM file example

Click the following link to view the list of commands to create an SBOM using the CLI.

Manually create an SBOM using the CLI

Automatically create an SBOM after scanning, using the CLI

CycloneDX SBOM export

SPDX SBOM export