Get sbom

Returns everything inside one container image, addressed by its digest or by its image ref.

GET /v1/sbom/{wildcard1}

SBOM → · All API references → · Get started →

Address	`https://api.hanzo.ai/v1/sbom/{wildcard1}`
Method	`GET`
Operation	`get_sbom_by_wildcard1`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Returns everything inside one container image, addressed by its digest or by its image ref.

Each component comes back with its name, version, type, package URL and license.

This read is GLOBAL, not tenant-scoped, and deliberately so: a bill of materials belongs to a content-addressed digest rather than to an org, so every caller deploying the same image resolves the same components, and nothing tenant-owned is exposed by it. It still requires an attested caller — global is not public — and answers 401 without one. Ingest is the closed half of the pair.

A miss is not the end of the lookup. The registry is the source of truth, so an unmaterialized ref is pulled from the SBOM attached to that image, persisted, and answered from the store — the first read of a freshly built image pays for the pull, later ones do not. The pull reads OUR registries and nothing else, which is what makes one shared answer trustworthy for every tenant: an attached document is whoever controls that repository speaking, so a ref outside them answers 404 rather than a stranger's account of what is in their image. A bare digest with no repository is not pullable and answers an honest 404, as does a ref with no attached document. Repeated ingests collapse to the latest, components come back ordered by type then name, and a result over 5000 components is capped with truncated set. When the datastore is not connected the answer is 503 rather than a fabricated empty image.

Request

1 field.

Field	In	Type	Required	Description
`wildcard1`	path	string	yes	Ref is the image to resolve, either its content-addressed digest (`sha256:…`) or its full reference (`oci.hanzo.ai/hanzo/cloud:v1`).

Response

Status	Body	Meaning
`200`	sbom.SbomView	ok
`default`	problem-details	refused

200 body — 13 fields.

Field	In	Type	Always	Description
`componentCount`	body	integer (int64)	—	ComponentCount is how many components this response carries — after the cap, so it matches components exactly rather than the image's true total.
`components`	body	sbom.SbomComponent[]	—	Components is the flattened dependency set, ordered by type then name.
`components[].license`	body	string	—	License is the FIRST license fact found for the component: its SPDX id, else its name, else the expression.
`components[].name`	body	string	—	Name is the dependency's package name as CycloneDX records it.
`components[].purl`	body	string	—	Purl is the package URL — the ecosystem-qualified identity a vulnerability feed can be joined on.
`components[].type`	body	string	—	Type is the CycloneDX component type: library, application, framework, etc.
`components[].version`	body	string	—	Version is the resolved version of that package.
`gitSha`	body	string	—	GitSha is the commit the image was built from.
`imageDigest`	body	string	—	ImageDigest is the content-addressed digest the components are keyed under, and is what identifies this bill of materials however it was asked for.
`imageRef`	body	string	—	ImageRef is the image reference recorded alongside the digest.
`ingestedAt`	body	string	—	IngestedAt is when the bill of materials was recorded, RFC 3339.
`sourceRepo`	body	string	—	SourceRepo is the repository the image was built from.
`truncated`	body	boolean	—	Truncated is true when the image has MORE components than the cap returns.

Failure carries the platform error shape — see Errors.

Examples

CLI

SDK

HTTP

MCP

hanzo sbom get <wildcard1>

.ts

.py

.go

.rs

.java

import { Configuration, SbomApi } from 'hanzoai';

const api = new SbomApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getSbomByWildcard1({ wildcard1: 'wildcard1' });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import SbomApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = SbomApi(client).get_sbom_by_wildcard1(wildcard1='wildcard1')

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.SbomAPI.GetSbomByWildcard1(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, sbom_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = sbom_api::get_sbom_by_wildcard1(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.SbomApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new SbomApi(client).getSbomByWildcard1();

The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →

curl https://api.hanzo.ai/v1/sbom/<wildcard1> \
  -H "Authorization: Bearer $HANZO_API_KEY"

MCP reaches sbom through the sbom tool, which names its 2 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_sbom"
         }
       }
     }'

SBOM API · All Hanzo APIs · Interactive reference

Was this page useful?

Broken link or missing step? Drop it in #docs on Discord or open a PR.

PreviousCreate write NextList health