---
url: https://ibee.ai/docs/api-reference/container-registry/list-container-registry-sboms
last_updated: 2026-10-25
---

> For clean Markdown of any page, append .md to the page URL. For a complete documentation index, see https://ibee.ai/docs/llms.txt (full text of every page: https://ibee.ai/docs/llms-full.txt). For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://ibee.ai/docs/_mcp/server.

# List SBOMs

GET https://api.ibee.ai/v1/container-registry/registries/{registry_id}/security/sboms

Lists the SBOMs of one repository, one per image digest. Paged with `page` and `page_size` (at most 100). Requires scope: container-registry.read.

```
# Example request with curl (set IBEE_API_TOKEN to a platform API token and WORKSPACE_ID to the workspace first).
# REGISTRY_ID: Registry ID
curl "https://api.ibee.ai/v1/container-registry/registries/$REGISTRY_ID/security/sboms?workspace_id=$WORKSPACE_ID&repository_name=<repository_name>" \
  -H "Authorization: Bearer $IBEE_API_TOKEN"
```

Reference: https://ibee.ai/docs/api-reference/container-registry/list-container-registry-sboms

## Authentication

- `Authorization` header (bearer token, required) — IBEE platform API token. Production tokens start with `ibee_prod_key_`; development tokens start with `ibee_dev_key_`. Use a token only with its matching gateway environment.

## Servers

- `https://api.ibee.ai/v1` (Production, default)
- `https://api.ibee.co.in/v1` (Development)

## Request

### Path parameters

- `registry_id` (string, required) — Registry ID.

### Query parameters

- `workspace_id` (string, required) — The positive numeric workspace ID to scope this request to. Zero, negative, and non-numeric values are rejected.
- `repository_name` (string, required) — Repository name inside the registry, for example `api` or `team/api`.
- `page` (integer, optional, default: 1) — Page number.
- `page_size` (integer, optional, default: 20) — Number of records per page.

## Response

### 200

SBOMs returned.

- `items` (list of ContainerRegistrySbomSummary, required) — Artifacts on this page.
- `page_summary` (ContainerRegistrySbomListPageSummary, required) — SBOM status counts for the items on this page.
- `total` (integer, required) — Total number of items matching the request.
- `page` (integer, required) — Page number returned (1-based).
- `page_size` (integer, required) — Page size that was applied.

## Errors

### 401 Unauthorized Error

The API token is missing, malformed or unknown (`invalid_api_key`).

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

### 403 Forbidden Error

The token may not make this call. Gateway codes: `insufficient_scope` (with `required_scope`), `key_revoked`, `key_disabled`, `key_inactive`, `key_expired`, `unknown_route`, `workspace_not_allowed`, `principal_inactive`, `principal_not_member` and `principal_permission_denied`. On writes, also `organization_restricted` (an admin restricted the organization) and `verification_required` (the token's user has not completed identity verification). A product service may also refuse with `detail`.

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

### 404 Not Found Error

The requested resource was not found.

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

### 409 Conflict Error

The request conflicts with the current resource state.

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

### 422 Unprocessable Entity Error

The registry service rejected a parameter or the body (`detail` lists the invalid fields), or the selected storage plan is not sold here (`detail.code`, for example `billing_sku_unavailable` or `billing_selection_not_found`).

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

### 503 Service Unavailable Error

A service the request depends on did not answer. Gateway codes: `workspace_verification_unavailable`, `principal_verification_unavailable` and `principal_authorization_unavailable`; on billable creates also `billing_admission_timeout`, `billing_admission_unavailable`, `billing_admission_disabled`, `billing_admission_not_configured` and the catalog codes `compute_catalog_unavailable`, `compute_catalog_not_configured`, `product_catalog_timeout`, `product_catalog_unavailable`, `product_catalog_not_configured` and `unsupported_product_quote`. Otherwise the product service's `detail`.

- `error` (string, optional, nullable) — Machine-readable code from the gateway's authorization step, for example `invalid_api_key`, `insufficient_scope`, `organization_restricted`, `organization_suspended`, `verification_required` or `billing_denied`. The response descriptions list the codes for each status.
- `required_scope` (string, optional, nullable) — The scope the token lacks, with `insufficient_scope`.
- `billing_reason` (string, optional, nullable) — Billing's reason with `billing_denied`, passed through unchanged: for example `insufficient_balance`, `credit_limit_exceeded`, `initial_topup_required`, `resource_limit_reached` or `resource_usage_unavailable`.
- `billing_sku_code` (string, optional, nullable) — The SKU the billing admission checked, when there was one.
- `billing_evaluated_at` (string, optional, nullable) — When Billing made the decision, as Billing returned it.
- `admission_context_id` (string, optional, nullable) — Billing admission context for this request, derived from the token, workspace, route and `X-Idempotency-Key`, so a retry with the same key gets the same id.
- `detail` (ErrorDetail, optional) — Error detail from the product service.

## Types

### ContainerRegistrySbomSummary

SBOM status of one artifact.

- `repository_name` (string, required) — Repository the artifact is in.
- `artifact_digest` (string, required) — Digest of the artifact.
- `tags` (list of string, required) — Tags pointing at the artifact.
- `status` (enum, required) — - `GENERATED`: an SBOM exists for the artifact. - `PROCESSING`: generation is running. - `FAILED`: generation failed. - `NOT_GENERATED`: no SBOM has been requested or produced. - `UNKNOWN`: the registry did not report a status.
  - Allowed values: `GENERATED`, `PROCESSING`, `FAILED`, `NOT_GENERATED`, `UNKNOWN`
- `artifact_kind` (enum, required) — - `image`: a single-platform image. - `index`: a multi-platform manifest index; see `platforms`.
  - Allowed values: `image`, `index`
- `platforms` (list of ContainerRegistryArtifactPlatform, required) — Platforms of a multi-platform index.
- `start_time` (datetime, optional, nullable) — When SBOM generation started (ISO 8601).
- `end_time` (datetime, optional, nullable) — When SBOM generation finished (ISO 8601).
- `duration` (integer, optional, nullable) — Generation time in seconds.
- `sbom_digest` (string, optional, nullable) — Digest of the generated SBOM.
- `report_id` (string, optional, nullable) — Report ID in the registry backend.
- `scanner` (ContainerRegistryScanner, optional, nullable) — Scanner that generated the SBOM.
- `format` (enum, optional, nullable) — SBOM format. - `SPDX` - `CycloneDX`
  - Allowed values: `SPDX`, `CycloneDX`
- `package_count` (integer, optional, nullable) — Number of packages listed in the SBOM.
- `platform` (ContainerRegistryArtifactPlatform, optional, nullable) — Platform of a single-platform image.

### ContainerRegistrySbomListPageSummary

SBOM status counts for the items on this page.

- `generated` (integer, optional) — Items with status `GENERATED`.
- `processing` (integer, optional) — Items with status `PROCESSING`.
- `failed` (integer, optional) — Items with status `FAILED`.
- `not_generated` (integer, optional) — Items with status `NOT_GENERATED`.
- `unknown` (integer, optional) — Items with status `UNKNOWN`.

### ErrorDetail

Error detail from the product service.

- string
- map from string to any
- list of any

### ContainerRegistryArtifactPlatform

One platform of a multi-platform image.

- `digest` (string, required) — Digest of the platform-specific manifest.
- `architecture` (string, optional, nullable) — CPU architecture, for example `amd64`.
- `os` (string, optional, nullable) — Operating system, for example `linux`.
- `variant` (string, optional, nullable) — Architecture variant, for example `v8`, when present.

### ContainerRegistryScanner

The scanner that produced a report.

- `name` (string, optional) — Scanner name.
- `vendor` (string, optional) — Scanner vendor.
- `version` (string, optional) — Scanner version.

## Examples

**Response**

```json
{
  "items": [
    {
      "repository_name": "<repository_name>",
      "artifact_digest": "<artifact_digest>",
      "tags": [],
      "status": "GENERATED",
      "artifact_kind": "image",
      "platforms": [],
      "start_time": "2026-10-25T12:00:00Z",
      "end_time": "2026-10-25T12:00:00Z",
      "duration": 1,
      "sbom_digest": "<sbom_digest>",
      "report_id": "<report_id>",
      "scanner": {
        "name": "<name>",
        "vendor": "<vendor>",
        "version": "<version>"
      },
      "format": "SPDX",
      "package_count": 1,
      "platform": {
        "digest": "<digest>",
        "architecture": "<architecture>",
        "os": "<os>",
        "variant": "<variant>"
      }
    }
  ],
  "page_summary": {
    "generated": 1,
    "processing": 1,
    "failed": 1,
    "not_generated": 1,
    "unknown": 1
  },
  "total": 1,
  "page": 1,
  "page_size": 1
}
```

**SDK Code**

```python
import requests

url = "https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms"

querystring = {"workspace_id":"710995","repository_name":"<repository_name>"}

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())
```

```javascript
const url = 'https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.ibee.ai/v1/container-registry/registries/registry_123/security/sboms?workspace_id=710995&repository_name=%3Crepository_name%3E")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```