Get SBOM

GET

/container-registry/registries/:registry_id/security/sboms/:artifact_digest

GET

/v1/container-registry/registries/:registry_id/security/sboms/:artifact_digest

# Example request with curl (set IBEE_API_TOKEN to a platform API token and WORKSPACE_ID to the workspace first).
# REGISTRY_ID: Registry ID
# ARTIFACT_DIGEST: Image digest, for example `sha256:4f3c
curl "https://api.ibee.ai/v1/container-registry/registries/$REGISTRY_ID/security/sboms/$ARTIFACT_DIGEST?workspace_id=$WORKSPACE_ID&repository_name=<repository_name>" \
  -H "Authorization: Bearer $IBEE_API_TOKEN"

{
  "repository_name": "<repository_name>",
  "artifact_digest": "<artifact_digest>",
  "media_type": "<media_type>",
  "components": [
    {
      "component_id": "<component_id>",
      "name": "<name>",
      "version": "<version>",
      "component_type": "<component_type>",
      "licenses": [],
      "supplier": "<supplier>",
      "purl": "<purl>"
    }
  ],
  "relationships": [
    {
      "source": "<source>",
      "target": "<target>",
      "relationship": "<relationship>"
    }
  ],
  "total_components": 1,
  "page": 1,
  "page_size": 1,
  "generated_at": "2026-10-25T12:00:00Z",
  "scanner": {
    "name": "<name>",
    "vendor": "<vendor>",
    "version": "<version>"
  }
}

Returns one image’s SBOM components and their relationships. q filters components by name, version, type, license, supplier or package URL. Components are paged with page and page_size (at most 100). Requires scope: container-registry.read.

# Example request with curl (set IBEE_API_TOKEN to a platform API token and WORKSPACE_ID to the workspace first).
# REGISTRY_ID: Registry ID
# ARTIFACT_DIGEST: Image digest, for example `sha256:4f3c
curl "https://api.ibee.ai/v1/container-registry/registries/$REGISTRY_ID/security/sboms/$ARTIFACT_DIGEST?workspace_id=$WORKSPACE_ID&repository_name=<repository_name>" \
  -H "Authorization: Bearer $IBEE_API_TOKEN"

Authentication

AuthorizationBearer

IBEE platform API token. Production tokens start with ibee_prod_key_; development tokens start with ibee_dev_key_. Use a token only with its matching gateway environment.

Path parameters

registry_idstringRequiredformat: "uuid"

Registry ID.

artifact_digeststringRequiredformat: "^[a-z0-9_+.-]+:[A-Fa-f0-9]+$"

Image digest, for example sha256:4f3c....

Query parameters

workspace_idstringRequiredformat: "^[1-9][0-9]*$">=1 character

The positive numeric workspace ID to scope this request to. Zero, negative, and non-numeric values are rejected.

repository_namestringRequiredformat: "^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"1-255 characters

Repository name inside the registry, for example api or team/api.

qstringOptional1-200 characters

Component search text.

pageintegerOptional>=1Defaults to 1

Page number.

page_sizeintegerOptional1-100Defaults to 20

Number of records per page.

Response

SBOM returned.

repository_namestring

Repository the artifact is in.

artifact_digeststring

Digest of the artifact.

media_typestring

Media type of the SBOM document, which identifies its format.

componentslist of objects

Components on this page.

relationshipslist of objects

Relationships that touch a component on this page.

total_componentsinteger

Total number of components in the SBOM.

pageinteger

Page number returned (1-based).

page_sizeinteger

Page size that was applied.

generated_atdatetime or nullOptional

When the SBOM was generated (ISO 8601).

scannerobject or nullOptional

Scanner that generated the SBOM.

Errors

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

409

Conflict Error

422

Unprocessable Entity Error

503

Service Unavailable Error