GET/repos/{owner}/{repo}/dependency-graph/sbom/fetch-report/{sbom_uuid}

Fetch a software bill of materials (SBOM) for a repository.

Fetches a previously generated software bill of materials (SBOM) for a repository. When the SBOM is ready, the response is a 302 redirect to a temporary download URL for the SBOM in SPDX JSON format. The generated SBOM report may be retained for up to one week from the original request. The temporary download URL returned by this endpoint expires separately, and its expiry is set when the fetch request is made.

RetriesRetries up to 2×, 500ms backoff, 30s timeout.

3 parameters

ownerstringrequired

The account owner of the repository. The name is not case sensitive.

repostringrequired

The name of the repository without the `.git` extension. The name is not case sensitive.

sbom_uuidstringrequired

The unique identifier of the SBOM export.

4 status codes

202SBOM is still being processed, no content is returned.

302Redirects to a temporary download URL for the completed SBOM.

403Forbidden

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

404Resource not found

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

Error handling

A 403 is returned: Forbidden. A 404 is returned: Resource not found.

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.fetchReport.get({
  owner: "octocat",
  repo: "hello-world",
  sbomUuid: "c0a80123-4567-89ab-cdef-0123456789ab",
});

{
  "message": "This is an example message.",
  "documentation_url": "https://example.com",
  "url": "https://example.com",
  "status": "active"
}

Request

Response

Errors