Upload a software bill of materials
POST/api/ingest/sbom
Push an inventory for one subject. The body is the raw document. Supported formats: CycloneDX 1.4 to 1.6 JSON, SPDX 2.3 JSON, requirements.txt and package-lock.json (v2 and v3). Gzip is accepted with Content-Encoding: gzip.
Limits: 20 MB (compressed and decompressed) and 30 documents per minute per token.
The call is idempotent by subject and SHA-256: sending the same snapshot again answers 200 with deduplicated: true and changes nothing. The token must be bound to a source of kind imported, sensor or infrastructure, otherwise you get 403 token_not_allowed.
Errors carry a stable machine-readable detail.code such as too_large, rate_limited, subject_not_found or invalid_subject.
Request
Responses
- 200
- 401
- 403
- 404
- 413
- 422
- 429
- 503
Stored, or already stored (deduplicated: true).
The token is missing, malformed, unknown or revoked. Repeated failures for one token prefix are rate limited (30 a minute).
The token is valid but is bound to a telemetry source that may not use this endpoint.
The subject_id does not exist in your tenant (detail.code is subject_not_found).
The body is larger than the endpoint limit. The size is checked before authentication and again while streaming.
The document could not be parsed, or the subject is invalid. detail.code says which.
The per-token rate limit was exceeded. Wait Retry-After seconds.
Response Headers
Seconds to wait before retrying.
The rate limiter or storage is temporarily unavailable. Retry after Retry-After seconds. The call is safe to repeat.
Response Headers
Seconds to wait before retrying.