Sbom
Package sbom is what is inside a container image: every component, resolvable by digest or image ref.
Package sbom is what is inside a container image: every component, resolvable by digest or image ref.
| Base URL | https://api.hanzo.ai |
| Operations | 3 |
| Auth | Authorization: Bearer $HANZO_API_KEY |
sbom
get_v1_sbom_by_wildcard1
GET /v1/sbom/{wildcard1}
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
wildcard1 | path | string | yes |
Health is a pure liveness probe: the service is up; datastore reflects whether the datastore store is connected.
GET /v1/sbom/health
Health is a pure liveness probe: the service is up; datastore reflects whether the datastore store is connected. Not JWT-gated, always 200 (a disconnected datastore is degraded-but-alive; the data endpoints report that as 503).
Ingest persists a CycloneDX SBOM's components keyed by image digest.
POST /v1/sbom
Ingest persists a CycloneDX SBOM's components keyed by image digest. Gated to a validated SuperAdmin (owner == AdminOrg) — the canonical cloud super-admin check, which the build fleet / CI carries. Re-ingest is idempotent: rows share the (digest, name, version, purl) ORDER BY, so ReplacingMergeTree keeps the latest by ingested_at (and resolve reads FINAL).
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
document | — | Document is the raw CycloneDX bill of materials, any JSON. | |
format | string | — | Format names the document format; "cyclonedx" is the only one parsed. |
gitSha | string | — | GitSha is the commit the image was built from. |
imageDigest | string | — | ImageDigest is the content-addressed digest (sha256:…) the components are keyed under. |
imageRef | string | — | ImageRef is the human-readable image reference the digest was published as. |
sourceRepo | string | — | SourceRepo is the repository the image was built from. |
How is this guide?