1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
---
stage: Govern
group: Threat Insights
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
---
# Dependency list export API
DETAILS:
**Tier:** Ultimate
**Offering:** GitLab.com, Self-managed, GitLab Dedicated
Every call to this endpoint requires authentication.
## Create a pipeline-level dependency list export
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/333463) in GitLab 16.4 [with a flag](../administration/feature_flags.md) named `merge_sbom_api`. Enabled by default.
> - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/425312) in GitLab 16.7. Feature flag `merge_sbom_api` removed.
Create a new CycloneDX JSON export for all the project dependencies detected in a pipeline.
If an authenticated user does not have permission to [read_dependency](../user/custom_roles.md#available-permissions),
this request returns a `403 Forbidden` status code.
SBOM exports can be only accessed by the export's author.
```plaintext
POST /pipelines/:id/dependency_list_exports
```
| Attribute | Type | Required | Description |
| ------------------- | ----------------- | ---------- | -----------------------------------------------------------------------------------------------------------------------------|
| `id` | integer | yes | The ID of the pipeline which the authenticated user has access to. |
| `export_type` | string | yes | This must be set to `sbom`. |
```shell
curl --request POST --header "PRIVATE-TOKEN: <private_token>" "https://gitlab.example.com/api/v4/pipelines/1/dependency_list_exports" --data "export_type=sbom"
```
The created dependency list export is automatically deleted after 1 hour.
Example response:
```json
{
"id": 2,
"has_finished": false,
"self": "http://gitlab.example.com/api/v4/dependency_list_exports/2",
"download": "http://gitlab.example.com/api/v4/dependency_list_exports/2/download"
}
```
## Get single dependency list export
Get a single dependency list export.
```plaintext
GET /dependency_list_exports/:id
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer | yes | The ID of the dependency list export. |
```shell
curl --header "PRIVATE-TOKEN: <private_token>" "https://gitlab.example.com/api/v4/dependency_list_exports/2"
```
The status code is `202 Accepted` when the dependency list export is being generated, and `200 OK` when it's ready.
Example response:
```json
{
"id": 4,
"has_finished": true,
"self": "http://gitlab.example.com/api/v4/dependency_list_exports/4",
"download": "http://gitlab.example.com/api/v4/dependency_list_exports/4/download"
}
```
## Download dependency list export
Download a single dependency list export.
```plaintext
GET /dependency_list_exports/:id/download
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer | yes | The ID of the dependency list export. |
```shell
curl --header "PRIVATE-TOKEN: <private_token>" "https://gitlab.example.com/api/v4/dependency_list_exports/2/download"
```
The response is `404 Not Found` if the dependency list export is not finished yet or was not found.
Example response:
```json
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"serialNumber": "urn:uuid:aec33827-20ae-40d0-ae83-18ee846364d2",
"version": 1,
"metadata": {
"tools": [
{
"vendor": "Gitlab",
"name": "Gemnasium",
"version": "2.34.0"
}
],
"authors": [
{
"name": "Gitlab",
"email": "support@gitlab.com"
}
],
"properties": [
{
"name": "gitlab:dependency_scanning:input_file",
"value": "package-lock.json"
}
]
},
"components": [
{
"name": "com.fasterxml.jackson.core/jackson-core",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.9.2",
"version": "2.9.2",
"type": "library",
"licenses": [
{
"license": {
"id": "MIT",
"url": "https://spdx.org/licenses/MIT.html"
}
},
{
"license": {
"id": "BSD-3-Clause",
"url": "https://spdx.org/licenses/BSD-3-Clause.html"
}
}
]
}
]
}
```
|
