# SBOM import and export

> Import CycloneDX or SPDX SBOMs for repositories and services, and export each inventory as CycloneDX 1.6 or SPDX 2.3, with vulnerabilities and their status.

Every repository's inventory comes from its lockfiles, read as soon as the repository is enabled. SBOMs cover everything else: repositories without a supported lockfile, container images, vendor deliveries, binaries and build outputs.

## Import

Under **Vulnerabilities → Inventory → SBOMs**, choose **Import SBOM** and attach it to a repository or a [service](https://mergeharbor.com/docs/vulnerability-management#ownership). Accepted formats:

- CycloneDX JSON 1.4, 1.5 and 1.6
- SPDX JSON 2.2 and 2.3

Upload the file as is or gzip-compressed (up to 64 MB uncompressed). Components need a package URL (purl) to be matched; components without one are counted and skipped. Dependency relationships in the document set direct and transitive dependencies and their paths.

Importing an SBOM with the same name again replaces the previous one: findings for packages that are gone close, new ones open. Deleting an imported SBOM closes its findings.

From CI, import with the API and an API key:

```sh
curl -X POST "https://app.mergeharbor.com/api/v1/orgs/acme/vulnerabilities/sboms?service_id=42&name=api-image" \
  -H "Authorization: Bearer $MERGEHARBOR_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @sbom.cdx.json
```

The file is stored and imported in the background: the answer is `202` with an operation. Poll `GET /api/v1/orgs/acme/operations/{id}` until its `status` is `succeeded` (its `result` has the package and finding counts) or `failed` (its `error` says why, for example a file that is not CycloneDX or SPDX JSON).

## Export

Each inventory can be exported from **Vulnerabilities → Inventory → SBOMs**:

- **CycloneDX 1.6** with components, dependency relationships, licenses and, by default, the vulnerabilities that affect them with their status (the same data as a [VEX](https://mergeharbor.com/docs/vex) document).
- **SPDX 2.3** with packages, package URLs, declared licenses and dependency relationships.