> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate an SBOM from uploaded files > Generate a dependency inventory from manifest and lockfile uploads without creating a project. Manifest-only inputs resolve concrete versions and transitives. Compatible lockfiles supply recorded versions for associated manifests; uncovered manifests resolve separately. **First request** Use a GitHits Bearer credential for an active account with the required terms accepted. In the example, `private-auth.conf` is a caller-owned protected curl configuration containing `header = "Authorization: Bearer "`; replace the placeholder privately. Run from your repository root: ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --form 'files[]=@Cargo.toml;filename=Cargo.toml' \ --form 'files[]=@Cargo.lock;filename=Cargo.lock' \ --output bom.cdx.json \ 'https://api.githits.dev/v1/experimental/sbom?format=cyclonedx' ``` For npm, replace the two files with `package.json` and `package-lock.json`. For a nested project, use both the actual local path and the repository-relative filename, for example `files[]=@app/package.json;filename=app/package.json`. Repeat `files[]` for each file. Let curl set `Content-Type` and the multipart boundary. Send individual manifests and lockfiles, not an archive, repository URL or base64 data. On success the output file contains the document itself. On an HTTP error, curl exits unsuccessfully and saves a JSON problem in that file; check the exit status before importing it as an SBOM. **Upload rules** Send repeated `files[]` parts with repository-relative filenames and raw UTF-8 contents. Keep directories intact, for example `app/package.json` and `app/package-lock.json`. Only `files[]` and optional `format` are accepted. The complete multipart body, including framing, is limited to 8,000,000 bytes: 1–256 files, each at most 5,242,880 bytes, with filenames at most 1,024 UTF-8 bytes. Empty, dot and parent path segments, backslashes and controls are invalid. Unknown fields, missing filenames and duplicate format values in one location are rejected. A malformed query format is invalid even when multipart supplies a format. Supported lockfile families include Cargo, npm, pnpm, Yarn classic and Berry, uv, Poetry, PDM, Pipenv, Swift, Gradle, NuGet, Dart, Composer, Mix, Bundler, Rebar, Conan and Go dep. Filename and contents determine recognition; renaming an unsupported file does not add support. Lockfiles can be uploaded alone. A compatible same-directory lockfile supplies recorded versions for its manifest; this does not verify that the lockfile is up to date. For monorepos, preserve all relative paths; a nested manifest does not automatically inherit an ancestor lockfile. **Choose an output** | `format` | Response `Content-Type` | Contents | | --- | --- | --- | | `cyclonedx` (default) | `application/vnd.cyclonedx+json` | CycloneDX 1.7 JSON | | `spdx` | `text/spdx` | SPDX 2.3 tag-value, not JSON | | `text` | `text/plain` | Human-readable inventory report, not a standard SBOM serialization | All outputs use UTF-8 and are limited to 16,777,216 bytes. Change the example's query to `?format=spdx` or `?format=text`, or add `--form 'format=spdx'`; the multipart value wins. `Accept` does not select the format. Success returns HTTP 200 with the direct document, without a JSON wrapper or retrieval URL. No `fields` selector is supported. Standard document fields retain their standard spelling. The response schema describes an extensible subset of CycloneDX 1.7, not a field allowlist: additional standard metadata, component, license, dependency and other fields are accepted at every object level. Clients must preserve or ignore unfamiliar fields. SPDX tag-value documents may likewise include additional standard fields. **Interpret the inventory** One unusable file rejects the upload. Incomplete resolution and missing licenses can still produce a successful partial document. License declarations are evidence, not legal conclusions or artifact verification. Lockfile agreement and platform conditions are not checked. Preserve completeness, provenance, license expression/name variants and optional PURLs when consuming the result. In CycloneDX, find the document-level property named `githits:completeness` by name rather than array position: | Value | Meaning | | --- | --- | | `resolved_manifest_inventory` | Inventory from manifest dependency resolution | | `partial_manifest_inventory` | Resolution is incomplete; the component list can be empty | | `recorded_lockfile_inventory` | Inventory recorded in uploaded lockfiles | | `mixed_dependency_inventory` | Lockfile records plus separately resolved manifests | None guarantees an exact installed inventory or complete license coverage. Inspect `githits:resolutions` and `githits:manifest_associations` for per-manifest evidence. Structured `githits:` property values are JSON encoded inside strings and require a separate decode. Component names are not unique; retain `bom-ref` for document relationships. A missing version, PURL or license means unavailable evidence, not permission to invent a value. **Handle errors and retries** Errors use `application/problem+json` in every output format. Branch on `code`, not `detail`, and retain `X-Request-ID` for support. The response definitions below provide problem schemas and examples. | Status / code | Caller action | | --- | --- | | 400 `VALIDATION_ERROR` | Correct multipart fields, filenames or format values before retrying. | | 401 `AUTHENTICATION_REQUIRED` | Supply a valid Bearer credential. | | 403 `FORBIDDEN`, `ACCOUNT_INACTIVE`, `TERMS_ACCEPTANCE_REQUIRED` | Resolve credential access, account eligibility or terms acceptance. | | 408 `UPLOAD_TIMEOUT` | Ensure the upload can finish within 30 seconds. | | 413 `INPUT_TOO_LARGE` | Reduce file count, path length or bytes to the documented limits. | | 415 `UNSUPPORTED_MEDIA_TYPE` | Send multipart/form-data with a valid boundary. | | 422 `UNUSABLE_MANIFEST` | Inspect `files`: each entry identifies the original `path` and `status` (`unsupported`, `invalid_utf8` or `unparsed`). Correct or remove those inputs; the entire upload was rejected. | | 422 `NO_MANIFEST_EVIDENCE` | Supply a manifest with named package evidence or a supported lockfile. | | 422 `UNREPRESENTABLE_SPDX` | Request `cyclonedx` to preserve names or versions that SPDX tag-value cannot represent. | | 422 `SBOM_OUTPUT_TOO_LARGE` | Reduce the requested inventory; the generated document exceeded an output limit. | | 429 `RATE_LIMITED` | Respect `Retry-After` when present. | | 502 `UPSTREAM_ERROR`, 503 `SBOM_UNAVAILABLE` / `UPSTREAM_UNAVAILABLE` | A service failure prevented generation; retry later if appropriate. | | 504 `TIMEOUT` | Generation exceeded a service deadline; a retry may repeat work. | Uploads and documents are not retained for retrieval. Save the response. Repeated requests recompute and consume the same upstream REST quota. Client upload has a 30-second deadline; the default upstream deadline is 90 seconds, in addition to upload time. A timeout does not guarantee remote work stopped. Avoid unconditional retries: there is no idempotency key or saved result to resume. ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json post /v1/experimental/sbom openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation | List package documentation, then read a page | | Navigate source code | List files, read a file or search text within a target | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Ask a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Generate an SBOM | Upload manifests and lockfiles to receive a CycloneDX, SPDX or text inventory | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`; development uses `https://api-dev.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Standard SBOM documents retain their format's field names. Percent-encode a package name or opaque read target as one path segment, including any embedded slash. For query values, encode a literal plus sign as `%2B`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Ask, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Discover existing documentation pages and read their content with exact source locators and availability information. name: Documentation - description: >- Enumerate files, read exact content and grep within a package or repository. Responses retain served identity, indexing state and completeness information. name: Code - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: >- Preview operations for target resolution, source comparison, cited questions and SBOM generation. Routes use /v1/experimental and may later move to permanent v1 locations under a documented migration policy. name: Experimental paths: /v1/experimental/sbom: post: tags: - Experimental summary: Generate an SBOM from uploaded files description: > Generate a dependency inventory from manifest and lockfile uploads without creating a project. Manifest-only inputs resolve concrete versions and transitives. Compatible lockfiles supply recorded versions for associated manifests; uncovered manifests resolve separately. **First request** Use a GitHits Bearer credential for an active account with the required terms accepted. In the example, `private-auth.conf` is a caller-owned protected curl configuration containing `header = "Authorization: Bearer "`; replace the placeholder privately. Run from your repository root: ```sh curl --config /path/to/private-auth.conf \ --fail-with-body --silent --show-error \ --form 'files[]=@Cargo.toml;filename=Cargo.toml' \ --form 'files[]=@Cargo.lock;filename=Cargo.lock' \ --output bom.cdx.json \ 'https://api.githits.dev/v1/experimental/sbom?format=cyclonedx' ``` For npm, replace the two files with `package.json` and `package-lock.json`. For a nested project, use both the actual local path and the repository-relative filename, for example `files[]=@app/package.json;filename=app/package.json`. Repeat `files[]` for each file. Let curl set `Content-Type` and the multipart boundary. Send individual manifests and lockfiles, not an archive, repository URL or base64 data. On success the output file contains the document itself. On an HTTP error, curl exits unsuccessfully and saves a JSON problem in that file; check the exit status before importing it as an SBOM. **Upload rules** Send repeated `files[]` parts with repository-relative filenames and raw UTF-8 contents. Keep directories intact, for example `app/package.json` and `app/package-lock.json`. Only `files[]` and optional `format` are accepted. The complete multipart body, including framing, is limited to 8,000,000 bytes: 1–256 files, each at most 5,242,880 bytes, with filenames at most 1,024 UTF-8 bytes. Empty, dot and parent path segments, backslashes and controls are invalid. Unknown fields, missing filenames and duplicate format values in one location are rejected. A malformed query format is invalid even when multipart supplies a format. Supported lockfile families include Cargo, npm, pnpm, Yarn classic and Berry, uv, Poetry, PDM, Pipenv, Swift, Gradle, NuGet, Dart, Composer, Mix, Bundler, Rebar, Conan and Go dep. Filename and contents determine recognition; renaming an unsupported file does not add support. Lockfiles can be uploaded alone. A compatible same-directory lockfile supplies recorded versions for its manifest; this does not verify that the lockfile is up to date. For monorepos, preserve all relative paths; a nested manifest does not automatically inherit an ancestor lockfile. **Choose an output** | `format` | Response `Content-Type` | Contents | | --- | --- | --- | | `cyclonedx` (default) | `application/vnd.cyclonedx+json` | CycloneDX 1.7 JSON | | `spdx` | `text/spdx` | SPDX 2.3 tag-value, not JSON | | `text` | `text/plain` | Human-readable inventory report, not a standard SBOM serialization | All outputs use UTF-8 and are limited to 16,777,216 bytes. Change the example's query to `?format=spdx` or `?format=text`, or add `--form 'format=spdx'`; the multipart value wins. `Accept` does not select the format. Success returns HTTP 200 with the direct document, without a JSON wrapper or retrieval URL. No `fields` selector is supported. Standard document fields retain their standard spelling. The response schema describes an extensible subset of CycloneDX 1.7, not a field allowlist: additional standard metadata, component, license, dependency and other fields are accepted at every object level. Clients must preserve or ignore unfamiliar fields. SPDX tag-value documents may likewise include additional standard fields. **Interpret the inventory** One unusable file rejects the upload. Incomplete resolution and missing licenses can still produce a successful partial document. License declarations are evidence, not legal conclusions or artifact verification. Lockfile agreement and platform conditions are not checked. Preserve completeness, provenance, license expression/name variants and optional PURLs when consuming the result. In CycloneDX, find the document-level property named `githits:completeness` by name rather than array position: | Value | Meaning | | --- | --- | | `resolved_manifest_inventory` | Inventory from manifest dependency resolution | | `partial_manifest_inventory` | Resolution is incomplete; the component list can be empty | | `recorded_lockfile_inventory` | Inventory recorded in uploaded lockfiles | | `mixed_dependency_inventory` | Lockfile records plus separately resolved manifests | None guarantees an exact installed inventory or complete license coverage. Inspect `githits:resolutions` and `githits:manifest_associations` for per-manifest evidence. Structured `githits:` property values are JSON encoded inside strings and require a separate decode. Component names are not unique; retain `bom-ref` for document relationships. A missing version, PURL or license means unavailable evidence, not permission to invent a value. **Handle errors and retries** Errors use `application/problem+json` in every output format. Branch on `code`, not `detail`, and retain `X-Request-ID` for support. The response definitions below provide problem schemas and examples. | Status / code | Caller action | | --- | --- | | 400 `VALIDATION_ERROR` | Correct multipart fields, filenames or format values before retrying. | | 401 `AUTHENTICATION_REQUIRED` | Supply a valid Bearer credential. | | 403 `FORBIDDEN`, `ACCOUNT_INACTIVE`, `TERMS_ACCEPTANCE_REQUIRED` | Resolve credential access, account eligibility or terms acceptance. | | 408 `UPLOAD_TIMEOUT` | Ensure the upload can finish within 30 seconds. | | 413 `INPUT_TOO_LARGE` | Reduce file count, path length or bytes to the documented limits. | | 415 `UNSUPPORTED_MEDIA_TYPE` | Send multipart/form-data with a valid boundary. | | 422 `UNUSABLE_MANIFEST` | Inspect `files`: each entry identifies the original `path` and `status` (`unsupported`, `invalid_utf8` or `unparsed`). Correct or remove those inputs; the entire upload was rejected. | | 422 `NO_MANIFEST_EVIDENCE` | Supply a manifest with named package evidence or a supported lockfile. | | 422 `UNREPRESENTABLE_SPDX` | Request `cyclonedx` to preserve names or versions that SPDX tag-value cannot represent. | | 422 `SBOM_OUTPUT_TOO_LARGE` | Reduce the requested inventory; the generated document exceeded an output limit. | | 429 `RATE_LIMITED` | Respect `Retry-After` when present. | | 502 `UPSTREAM_ERROR`, 503 `SBOM_UNAVAILABLE` / `UPSTREAM_UNAVAILABLE` | A service failure prevented generation; retry later if appropriate. | | 504 `TIMEOUT` | Generation exceeded a service deadline; a retry may repeat work. | Uploads and documents are not retained for retrieval. Save the response. Repeated requests recompute and consume the same upstream REST quota. Client upload has a 30-second deadline; the default upstream deadline is 90 seconds, in addition to upload time. A timeout does not guarantee remote work stopped. Avoid unconditional retries: there is no idempotency key or saved result to resume. operationId: generate_sbom parameters: - description: >- Output format; a multipart format field overrides this value. No Accept negotiation. Duplicate values and unknown query fields are rejected. in: query name: format required: false schema: $ref: '#/components/schemas/SbomOutputFormat' - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created. in: header name: X-GitHits-Session-ID required: false schema: type: string requestBody: content: multipart/form-data: encoding: files[]: contentType: application/octet-stream schema: additionalProperties: false properties: files[]: description: >- Repeat the literal field name files[] once per file, with raw UTF-8 file contents rather than base64. Set each part's filename to the file's path relative to a common repository root, for example app/package.json and app/package-lock.json. Preserve directory structure so manifests can be associated with their lockfiles. Send 1–256 files, each at most 5,242,880 bytes. Each filename must be at most 1,024 UTF-8 bytes and must be relative, with no empty, dot (.) or parent (..) path segments, backslashes or control characters. Every file must be a supported, readable manifest or lockfile; one unusable file rejects the entire upload. items: format: binary type: string maxItems: 256 minItems: 1 type: array format: $ref: '#/components/schemas/SbomOutputFormat' description: >- Select the response format. This value overrides the query parameter; omit both to receive CycloneDX JSON. required: - files[] type: object description: >- Send a multipart upload. The complete request, including multipart headers and boundaries, must fit within 8,000,000 bytes. required: true responses: '200': content: application/vnd.cyclonedx+json: example: bomFormat: CycloneDX components: [] compositions: - aggregate: incomplete assemblies: [] metadata: timestamp: '2026-09-09T00:00:00Z' properties: - name: githits:completeness value: partial_manifest_inventory serialNumber: urn:uuid:00000000-0000-4000-8000-000000000001 specVersion: '1.7' version: 1 schema: $ref: '#/components/schemas/SbomCycloneDxInventory' text/plain: example: > GitHits dependency inventory report Notice: Recorded lockfile inventory, not an exact installed build or a compliance assertion. Report ID: sbom-fixture-report Generated: 2026-09-09T00:00:00Z Entries: 1 Locked packages: 1 Uploaded roots: 0 Structural records: 0 Resolved packages: 0 Document facts: completeness: "recorded_lockfile_inventory" Package: "dep" ID: locked-dep-1.2.0 Known version: "1.2.0" License: unknown record_kind: "locked_package" schema: pattern: ^GitHits (manifest|dependency) inventory report\n type: string text/spdx: example: > SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: GitHits dependency inventory DocumentNamespace: urn:uuid:24e6d898-af42-4113-b174-7388662d8648 Creator: Tool: GitHits Created: 2026-09-05T12:00:00Z DocumentComment: {"completeness":"recorded_lockfile_inventory","declarations":"[]","lockfiles":"[{\"path\":\"package-lock.json\",\"format\":\"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK\",\"context\":{\"categories\":[],\"requires_python\":\"\",\"resolution_markers\":[],\"provided_extras\":[],\"gradle_configurations\":[],\"supported_markers\":[],\"required_markers\":[],\"dart_sdk_constraints\":[],\"python_version\":\"\",\"bundler_platforms\":[],\"python_full_version\":\"\",\"python_targets\":[],\"nuget_targets\":[]},\"format_version\":0,\"dependency_count\":0,\"completeness\":\"LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY\",\"root_package_ids\":[1],\"format_revision\":null,\"native_format_version\":\"\",\"association_status\":\"standalone\",\"checksum_count\":0,\"manifest_lock_consistency\":\"not_checked\",\"manifest_paths\":[],\"omitted_context_counts\":{\"conflicts\":0,\"bundler_tool_checksums\":0,\"composer_platform_overrides\":0,\"conan_overrides\":0,\"conan_inventories\":0,\"composer_aliases\":0,\"conan_aliases\":0,\"poetry_checksum_sets\":0,\"dep_input_imports\":0},\"package_count\":3,\"projection_notices\":[\"relationships_not_projected\",\"integrity_not_projected\",\"resolution_context_not_projected\"],\"requirement_count\":0,\"structural_count\":1,\"structural_records\":[{\"id\":3,\"name\":\"\",\"version\":\"\",\"context\":{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"},\"role\":\"LOCKED_PACKAGE_ROLE_IMPORTER\",\"source_kind\":\"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY\"}]},{\"path\":\"nested/package-lock.json\",\"format\":\"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK\",\"context\":{\"categories\":[],\"requires_python\":\"\",\"resolution_markers\":[],\"provided_extras\":[],\"gradle_configurations\":[],\"supported_markers\":[],\"required_markers\":[],\"dart_sdk_constraints\":[],\"python_version\":\"\",\"bundler_platforms\":[],\"python_full_version\":\"\",\"python_targets\":[],\"nuget_targets\":[]},\"format_version\":0,\"dependency_count\":0,\"completeness\":\"LOCKFILE_COMPLETENESS_PACKAGE_ENTRIES_ONLY\",\"root_package_ids\":[1],\"format_revision\":null,\"native_format_version\":\"\",\"association_status\":\"standalone\",\"checksum_count\":0,\"manifest_lock_consistency\":\"not_checked\",\"manifest_paths\":[],\"omitted_context_counts\":{\"conflicts\":0,\"bundler_tool_checksums\":0,\"composer_platform_overrides\":0,\"conan_overrides\":0,\"conan_inventories\":0,\"composer_aliases\":0,\"conan_aliases\":0,\"poetry_checksum_sets\":0,\"dep_input_imports\":0},\"package_count\":1,\"projection_notices\":[\"relationships_not_projected\",\"integrity_not_projected\",\"resolution_context_not_projected\"],\"requirement_count\":0,\"structural_count\":0,\"structural_records\":[]}]","manifest_associations":"{}","notice":"Recorded conditional lockfile inventory, not an exact installed build or a compliance assertion. Manifest/lock consistency is not checked. Relationships and integrity are not projected. Licenses are uploaded-root or public-registry coordinate declarations, not source-artifact verification or legal conclusions.","resolution_basis":"lockfile_records","resolutions":"[]"} PackageName: dep SPDXID: SPDXRef-locked-42925864b1614adf48873a749eb88299882ddee203e2ac218e962986df33f40d PackageVersion: 1.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: MIT PackageLicenseComments: {"license":"MIT","source":"registry_declared"} PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","license_artifact_verification":"not_checked","license_catalog_version":"3.28.0","license_expression":"MIT","license_raw":"MIT","license_source":"registry_declared","license_status":"expression","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"package-lock.json","metadata_status":"available","package_id":"1","record_kind":"locked_package","registry":"npm","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY"} PackageName: dep SPDXID: SPDXRef-locked-4d058b03a8843e670ab6222627b94be44647ce35eb7f5e824c7760a5e9b6726d PackageVersion: 1.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: MIT PackageLicenseComments: {"license":"MIT","source":"registry_declared"} PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","license_artifact_verification":"not_checked","license_catalog_version":"3.28.0","license_expression":"MIT","license_raw":"MIT","license_source":"registry_declared","license_status":"expression","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"nested/package-lock.json","metadata_status":"available","package_id":"1","record_kind":"locked_package","registry":"npm","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_REGISTRY"} PackageName: local-dep SPDXID: SPDXRef-locked-e738e69432f53950a50dcf2514b6cefda5315365b7f94e9f661196b4e8d087dc PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NOASSERTION PackageComment: {"context":"{\"peer\":false,\"source\":{\"local_kind\":\"LOCKED_LOCAL_SOURCE_KIND_UNSPECIFIED\"},\"optional\":false,\"requires_python\":\"\",\"nuget_dependency_type\":\"NUGET_DEPENDENCY_TYPE_UNSPECIFIED\",\"bundler_platform\":\"\",\"group_conditions\":[],\"dev_optional\":false,\"extraneous\":false,\"dart_dependency_kind\":\"DART_DEPENDENCY_KIND_UNSPECIFIED\",\"berry_link_kind\":\"BERRY_LINK_KIND_UNSPECIFIED\",\"dev_only\":false,\"resolution_markers\":[],\"provided_extras\":[],\"berry_patched\":false,\"conditions\":null,\"requested_extras\":[],\"otp_application_name\":\"\"}","lockfile_format":"LOCKFILE_FORMAT_NPM_PACKAGE_LOCK","lockfile_path":"package-lock.json","metadata_reason":"missing_coordinate","metadata_status":"not_eligible","package_id":"2","record_kind":"locked_package","resolution_basis":"lockfile_record","role":"LOCKED_PACKAGE_ROLE_PACKAGE","source_kind":"LOCKED_PACKAGE_SOURCE_KIND_LOCAL"} Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-42925864b1614adf48873a749eb88299882ddee203e2ac218e962986df33f40d Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-4d058b03a8843e670ab6222627b94be44647ce35eb7f5e824c7760a5e9b6726d Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-locked-e738e69432f53950a50dcf2514b6cefda5315365b7f94e9f661196b4e8d087dc schema: pattern: '^SPDXVersion: SPDX-2\.3\n' type: string description: >- Complete UTF-8 document, at most 16,777,216 bytes. Inventory and license evidence may be partial; save this response because no retrieval URL is created. headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '400': content: application/problem+json: example: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: VALIDATION_ERROR headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: AUTHENTICATION_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer challenge. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: FORBIDDEN, ACCOUNT_INACTIVE, TERMS_ACCEPTANCE_REQUIRED headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: POST.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '408': content: application/problem+json: example: code: UPLOAD_TIMEOUT detail: The upload did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 408 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UPLOAD_TIMEOUT headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '413': content: application/problem+json: example: code: INPUT_TOO_LARGE detail: The upload exceeds a file, path, count or body limit. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 413 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: INPUT_TOO_LARGE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '415': content: application/problem+json: example: code: UNSUPPORTED_MEDIA_TYPE detail: Use multipart/form-data. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 415 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UNSUPPORTED_MEDIA_TYPE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '422': content: application/problem+json: example: code: NO_MANIFEST_EVIDENCE detail: >- Supply a manifest with named package evidence or a supported lockfile. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 422 title: SBOM request failed type: about:blank schema: oneOf: - allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: code: enum: - NO_MANIFEST_EVIDENCE - UNREPRESENTABLE_SPDX - SBOM_OUTPUT_TOO_LARGE type: string type: object - allOf: - $ref: '#/components/schemas/SbomProblem' - properties: code: enum: - UNUSABLE_MANIFEST type: string type: object description: >- UNUSABLE_MANIFEST, NO_MANIFEST_EVIDENCE, UNREPRESENTABLE_SPDX, SBOM_OUTPUT_TOO_LARGE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: RATE_LIMITED headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: Validated delay or HTTP-date for quota reset, when available. schema: type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '500': description: >- Request identity could not be created. Empty body without X-Request-ID; no problem object is available. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: UPSTREAM_ERROR headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '503': content: application/problem+json: example: code: SBOM_UNAVAILABLE detail: SBOM generation is temporarily unavailable. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 503 title: SBOM request failed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: SBOM_UNAVAILABLE, UPSTREAM_UNAVAILABLE headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: TIMEOUT headers: Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string security: - bearer_auth: [] components: schemas: SbomOutputFormat: default: cyclonedx description: >- cyclonedx returns CycloneDX 1.7 JSON (application/vnd.cyclonedx+json); spdx returns SPDX 2.3 tag-value (text/spdx); text returns a human-readable report (text/plain). All outputs use UTF-8. Accept does not select the successful output format. enum: - cyclonedx - spdx - text type: string SbomCycloneDxInventory: additionalProperties: true description: >- Extensible CycloneDX 1.7 document. This schema describes a compatible subset, not the entire standard. Additional fields are allowed at every object level; clients must preserve or ignore unfamiliar data. Inventory and license completeness must be read from evidence, not inferred from this schema. properties: bomFormat: enum: - CycloneDX type: string components: description: >- Named project roots and dependency entries. Unresolved declarations remain in document properties rather than becoming package components. The array may be empty when no concrete packages or named roots are available. Separate lockfile occurrences may have the same name and version; do not deduplicate by those fields alone. items: $ref: '#/components/schemas/SbomComponent' type: array compositions: description: Completeness declaration for the listed component references. items: additionalProperties: true properties: aggregate: description: >- Producer-reported completeness of the referenced inventory. Do not infer that additional fields establish completeness. type: string assemblies: description: >- References to entries in components, using each entry's bom-ref. items: type: string type: array required: - aggregate type: object type: array metadata: additionalProperties: true properties: timestamp: description: Time this document was generated. format: date-time type: string type: object properties: description: >- Document evidence. githits:completeness distinguishes resolved_manifest_inventory, partial_manifest_inventory, recorded_lockfile_inventory and mixed_dependency_inventory; none guarantees that every license is known. githits:resolution_basis distinguishes manifest_resolution, lockfile_records and lockfile_records_and_manifest_resolution. Inspect githits:resolutions for per-manifest outcomes, githits:declarations for original requirements, and githits:lockfiles and githits:manifest_associations for lockfile coverage. githits:notice summarizes limitations. items: $ref: '#/components/schemas/SbomProperty' type: array serialNumber: description: >- Unique identifier for this generated document. This URN is not a retrieval URL. pattern: >- ^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ type: string specVersion: enum: - '1.7' type: string version: description: Document revision, not a package version. minimum: 1 type: integer required: - bomFormat - specVersion type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: An optional acceptance URL supplied by the upstream allow-list. type: string code: description: The stable uppercase API error code. type: string detail: description: A stable, client-safe explanation of the failure. type: string instance: description: The active request trace ID. type: string status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: An optional terms URL supplied by the upstream allow-list. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object SbomProblem: allOf: - $ref: '#/components/schemas/ProblemResponse' - properties: files: description: >- Unusable uploaded files; paths refer only to this request's uploads. items: $ref: '#/components/schemas/SbomFileFailure' maxItems: 256 minItems: 1 type: array required: - files type: object description: >- File-specific diagnostics returned only when generation rejects uploaded inputs. SbomComponent: additionalProperties: true description: >- An uploaded project root, a resolved dependency or a recorded lockfile package. Use githits:record_kind in properties to distinguish them. properties: bom-ref: description: >- Opaque component identifier used by references within this document. It is not a package URL or an artifact checksum. type: string licenses: description: >- Standard license choices: SPDX expressions or licenses identified by id or name, with optional acknowledgement and additional standard evidence. Preserve the original evidence; the gateway does not infer license conclusions. items: oneOf: - additionalProperties: true properties: license: additionalProperties: true properties: id: description: SPDX license identifier. type: string name: description: >- License name, including free-text and proprietary names. type: string type: object required: - license type: object - additionalProperties: true properties: acknowledgement: description: >- Standard license acknowledgement, such as declared or concluded; preserve the producer value. type: string expression: description: >- Recognized SPDX license expression, including a single identifier such as MIT or a compound expression such as MIT OR Apache-2.0. This is a declaration, not a legal conclusion or artifact verification. type: string required: - expression type: object type: array name: description: >- Package or project name. Names are not unique across registries, versions or lockfile occurrences. type: string properties: description: >- Component evidence. githits:purl_basis=manifest_resolution identifies the basis of an emitted PURL. For resolved packages without a PURL, githits:purl_omission_reason is missing_identity_facets (required identity details unavailable), unsupported_registry (no supported PURL mapping), or invalid_coordinate (the coordinate cannot form a valid PURL). Other record kinds omit both facts. githits:record_kind distinguishes manifest, resolved_package and locked_package entries. githits:resolution_basis identifies how a dependency was selected. githits:metadata_status reports metadata availability, not license verification. Where present, githits:license_artifact_verification=not_checked means the specific source artifact or commit was not checked. items: $ref: '#/components/schemas/SbomProperty' type: array purl: description: >- Identifies a concrete package selected by manifest dependency resolution. Present for supported registry coordinates even when license metadata is unavailable. Omitted for uploaded roots, unresolved declarations and lockfile occurrences, and when required identity details are unavailable. Presence does not verify installed or artifact contents; it is not a download URL. Preserve bom-ref for document relationships and occurrences. examples: - pkg:npm/%40scope/dep@1.2.3 minLength: 1 pattern: '^pkg:' type: string type: description: >- CycloneDX component classification, such as library, application or container. Clients must allow new standard classifications. type: string version: description: >- Version declared by an uploaded project, selected during dependency resolution, or recorded in a lockfile. Omitted when unknown; omission does not mean the latest version. type: string required: - type - name type: object SbomProperty: additionalProperties: true description: >- Extensible standard property. Match by name rather than array position; ignore names your client does not recognize. examples: - name: githits:record_kind value: resolved_package - name: githits:manifest_paths value: '["app/package.json"]' properties: name: description: >- Property name. GitHits evidence uses the githits: namespace; other namespaces are also allowed. type: string value: description: >- Evidence value, always encoded as a string. Structured values such as githits:declarations, githits:resolutions, githits:lockfiles, githits:manifest_associations, githits:manifest_paths and githits:lockfile_paths contain JSON; decode those values separately when needed. type: string required: - name type: object SbomFileFailure: description: One rejected uploaded file, without parser diagnostics. properties: path: description: Original repository-relative filename supplied by the caller. type: string status: $ref: '#/components/schemas/SbomFileStatus' description: Why this file could not contribute evidence. required: - path - status type: object SbomFileStatus: description: Bounded upstream file outcomes. enum: - unsupported - invalid_utf8 - unparsed type: string securitySchemes: bearer_auth: scheme: bearer type: http ````