Get an SBOM for a OCI image manifest or image index.
const url = 'https://api.craci.dev/v1experimental1/sbom/oci_manifest?digest=sha256%3A0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.craci.dev/v1experimental1/sbom/oci_manifest?digest=sha256%3A0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' \ --header 'Authorization: Bearer <token>'Multiple jobs can contribute towards one OCI image or index manifest. This endpoint helps to find all involved jobs and the dependencies of those jobs. The SBOM contains metadata listing all involved jobs, their type of involvement (created a manifest, a config blob, or a layer blob), and which dependencies were observed in the job.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”Manifest digest, either sha256 or sha512.
Example
sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdefScope listed jobs by involvement type. Available values: any (default), manifest, config-blob, layer-blob. Parameter can be repeated.
Responses
Section titled “Responses”CycloneDX 1.7 SBOM with flat job metadata and component job references
Malformed digest, unknown involvement or query parameter, or repeated digest
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}Missing or invalid API token
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}Manifest or index not recorded for your organization
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}A contributing job has not finished; retry later
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}Artifact graph exceeds the supported export size
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}Dependency unavailable or stored evidence could not be read
object
Human-readable explanation specific to this occurrence.
HTTP status code returned with the problem.
Short, human-readable summary of the problem.
URI identifying the problem type. about:blank uses the HTTP status meaning.
Examplegenerated
{ "detail": "example", "status": 1, "title": "example", "type": "example"}