GET/repos/{owner}/{repo}/dependency-graph/sbomDeprecated

Export a software bill of materials (SBOM) for a repository.

[!WARNING] Closing down notice: This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use "Request generation of a software bill of materials (SBOM) for a repository" to trigger the report, then "Fetch a software bill of materials (SBOM) for a repository" to retrieve it. For more information, see the changelog.

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

RetriesRetries up to 2×, 500ms backoff, 30s timeout.

2 parameters

ownerstringrequired

The account owner of the repository. The name is not case sensitive.

repostringrequired

The name of the repository without the `.git` extension. The name is not case sensitive.

3 status codes

200Response

sbomobjectrequired

403Forbidden

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

404Resource not found

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

Error handling

A 403 is returned: Forbidden. A 404 is returned: Resource not found.

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.sbom.list({
  owner: "octocat",
  repo: "hello-world",
});

{
  "sbom": {
    "SPDXID": "SPDXRef-DOCUMENT",
    "spdxVersion": "SPDX-2.3",
    "creationInfo": {
      "created": "2021-09-01T00:00:00Z",
      "creators": [
        "Tool: GitHub.com-Dependency-Graph"
      ]
    },
    "name": "github/example",
    "dataLicense": "CC0-1.0",
    "documentNamespace": "https://spdx.org/spdxdocs/protobom/15e41dd2-f961-4f4d-b8dc-f8f57ad70d57",
    "packages": [
      {
        "name": "rails",
        "SPDXID": "SPDXRef-Package",
        "versionInfo": "1.0.0",
        "downloadLocation": "NOASSERTION",
        "filesAnalyzed": false,
        "licenseConcluded": "MIT",
        "licenseDeclared": "MIT",
        "copyrightText": "Copyright (c) 1985 GitHub.com",
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceType": "purl",
            "referenceLocator": "pkg:gem/rails@1.0.0"
          }
        ]
      },
      {
        "name": "github/example",
        "SPDXID": "SPDXRef-Repository",
        "versionInfo": "main",
        "downloadLocation": "NOASSERTION",
        "filesAnalyzed": false,
        "externalRefs": [
          {
            "referenceCategory": "PACKAGE-MANAGER",
            "referenceType": "purl",
            "referenceLocator": "pkg:github/example@main"
          }
        ]
      }
    ],
    "relationships": [
      {
        "relationshipType": "DEPENDS_ON",
        "spdxElementId": "SPDXRef-Repository",
        "relatedSpdxElement": "SPDXRef-Package"
      },
      {
        "relationshipType": "DESCRIBES",
        "spdxElementId": "SPDXRef-DOCUMENT",
        "relatedSpdxElement": "SPDXRef-Repository"
      }
    ]
  }
}

Request

Response

Errors