SBOM import and export

Every repository’s inventory comes from its lockfiles, read as soon as the repository is enabled. SBOMs cover everything else: repositories without a supported lockfile, container images, vendor deliveries, binaries and build outputs.

Import

Under Vulnerabilities → Inventory → SBOMs, choose Import SBOM and attach it to a repository or a service. Accepted formats:

• CycloneDX JSON 1.4, 1.5 and 1.6
• SPDX JSON 2.2 and 2.3

Upload the file as is or gzip-compressed (up to 64 MB uncompressed). Components need a package URL (purl) to be matched; components without one are counted and skipped. Dependency relationships in the document set direct and transitive dependencies and their paths.

Importing an SBOM with the same name again replaces the previous one: findings for packages that are gone close, new ones open. Deleting an imported SBOM closes its findings.

From CI, import with the API and an API key:

curl -X POST "https://app.mergeharbor.com/api/v1/orgs/acme/vulnerabilities/sboms?service_id=42&name=api-image" \
  -H "Authorization: Bearer $MERGEHARBOR_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @sbom.cdx.json

The file is stored and imported in the background: the answer is 202 with an operation. Poll GET /api/v1/orgs/acme/operations/{id} until its status is succeeded (its result has the package and finding counts) or failed (its error says why, for example a file that is not CycloneDX or SPDX JSON).

Export

Each inventory can be exported from Vulnerabilities → Inventory → SBOMs:

• CycloneDX 1.6 with components, dependency relationships, licenses and, by default, the vulnerabilities that affect them with their status (the same data as a VEX document).
• SPDX 2.3 with packages, package URLs, declared licenses and dependency relationships.