# SPDX REST API The SPDX REST API returns an [SPDX](https://spdx.github.io/spdx-spec/v2.3/) SBOM document (in both XML and JSON formats) containing coordinates, licenses, and dependencies for components in an IQ Server-generated application scan report. This REST API supports all component formats. ## Methods supported: - GET To use SPDX REST API, first retrieve the internal application ID and then pass it as an input parameter. ## Step 1: Get the internal application ID Use the [Application REST API](https://help.sonatype.com/en/application-rest-api.html "Application REST API") with the application’s public ID to retrieve the internal application ID for the application you need to generate the SBOM. ``` GET /api/v2/applications?publicId={YourPublicId} ``` ## Step 2: Generate the SBOM Use the internal application ID from step 1 to generate the SPDX BOM document ``` GET /api/v2/spdx/{applicationInternalId}/reports/{scanId} ``` _scanId_corresponds to the application scan for which an IQ Server report was created. This API can also retrieve the SBOM based on the latest application evaluation stage, by specifying the _stageId_in the GET method. ``` GET /api/v2/spdx/{applicationInternalId}/stages/{stageId} ``` Possible values for _stageId_are **`build` , `stage-release` , `release` , `operate`.** ### Optional Query Parameters Both the endpoints above support these optional query parameters: | Query Parameter | Description | Accepted Values | Default Value | |----------------------|-------------------------------------------|-------------------------------------|---------------| | format | SPDX SBOM file format | json, xml | json | | spdxVersion | SPDX SBOM specification version (planned support for future versions) | 2.2, 2.3 | 2.3 | | generateCycloneDx | If set to "true" the SPDX SBOM file and its CycloneDx SBOM equivalent will be returned together as a **tar.gz** archive | true, false | false | **Example to generate a SPDX SBOM file in XML format** ``` curl -u admin:admin123 -X GET http://localhost:8070/api/v2/spdx/b7b2b2cc9c864ea59eb7fa0fb1d7f9ff/reports/bfdb562fad2443e593357b67eb4095e7?format=xml ``` **Example to generate both SPDX and CycloneDx SBOM files as a tar.gz file, in JSON format** ``` curl -u admin:admin123 -O -J -X GET http://localhost:8070/api/v2/spdx/b7b2b2cc9c864ea59eb7fa0fb1d7f9ff/reports/bfdb562fad2443e593357b67eb4095e7?format=json&generateCycloneDx=true ``` **Response** A file with the filename format {applicationPublicId}-{stage}-{scanId}.spdx.[xml|json] will be created, if you have used the curl command with options -O -J (see example above.) Sample JSON Response ```json { "SPDXID": "SPDXRef-DOCUMENT", "spdxVersion": "SPDX-2.3", "creationInfo": { "created": "2023-07-05T15:19:44Z", "creators": [ "Tool: Sonatype IQ Server - 1.165.0-01" ] }, "documentNamespace": "http://localhost:8070/ui/links/application/local-iq-app/report/d6ffc430f2594d2480c7af837eb2a5b6", "packages": [ { "SPDXID": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-annotations-2.14.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.14.0?type=jar", "referenceType": "purl" } ], "filesAnalyzed": false, "licenseConcluded": "(AGPL-3.0 AND MIT)", "licenseDeclared": "Apache-2.0", "name": "com.fasterxml.jackson.core:jackson-annotations", "versionInfo": "2.14.0" }, { "SPDXID": "SPDXRef-maven-com.sonatype.testing-pr-comment-02-1.0-SNAPSHOT", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/com.sonatype.testing/pr-comment-02@1.0-SNAPSHOT?type=jar", "referenceType": "purl" } ], "filesAnalyzed": false, "licenseConcluded": "(Not-Declared AND No-Sources)", "licenseDeclared": "(Not-Declared AND No-Sources)", "name": "com.sonatype.testing:pr-comment-02", "versionInfo": "1.0-SNAPSHOT" }, { "SPDXID": "SPDXRef-maven-org.apache.logging.log4j-log4j-core-2.16.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/org.apache.logging.log4j/log4j-core@2.16.0?type=jar", "referenceType": "purl" }, { "comment": "source: NVD", "referenceCategory": "SECURITY", "referenceLocator": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105", "referenceType": "advisory" }, { "comment": "source: NVD", "referenceCategory": "SECURITY", "referenceLocator": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832", "referenceType": "advisory" }, { "comment": "source: NVD", "referenceCategory": "SECURITY", "referenceLocator": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228", "referenceType": "advisory" } ], "filesAnalyzed": false, "licenseConcluded": "Apache-2.0", "licenseDeclared": "Apache-2.0", "name": "org.apache.logging.log4j:log4j-core", "versionInfo": "2.16.0" }, { "SPDXID": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-core-2.14.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.0?type=jar", "referenceType": "purl" }, { "comment": "source: SONATYPE", "referenceCategory": "SECURITY", "referenceLocator": "http://localhost:8070/ui/links/vln/sonatype-2022-6438", "referenceType": "advisory" } ], "filesAnalyzed": false, "licenseConcluded": "(Apache-2.0 AND MIT)", "licenseDeclared": "(Apache-2.0 AND MIT)", "name": "com.fasterxml.jackson.core:jackson-core", "versionInfo": "2.14.0" }, { "SPDXID": "SPDXRef-maven-org.apache.logging.log4j-log4j-api-2.16.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/org.apache.logging.log4j/log4j-api@2.16.0?type=jar", "referenceType": "purl" } ], "filesAnalyzed": false, "licenseConcluded": "Apache-2.0", "licenseDeclared": "Apache-2.0", "name": "org.apache.logging.log4j:log4j-api", "versionInfo": "2.16.0" }, { "SPDXID": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-databind-2.14.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", "referenceLocator": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.0?type=jar", "referenceType": "purl" } ], "filesAnalyzed": false, "licenseConcluded": "Apache-2.0", "licenseDeclared": "Apache-2.0", "name": "com.fasterxml.jackson.core:jackson-databind", "versionInfo": "2.14.0" } ], "relationships": [ { "spdxElementId": "SPDXRef-DOCUMENT", "relationshipType": "DESCRIBES", "relatedSpdxElement": "SPDXRef-maven-com.sonatype.testing-pr-comment-02-1.0-SNAPSHOT" }, { "spdxElementId": "SPDXRef-maven-com.sonatype.testing-pr-comment-02-1.0-SNAPSHOT", "relationshipType": "DEPENDS_ON", "relatedSpdxElement": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-databind-2.14.0" }, { "spdxElementId": "SPDXRef-maven-com.sonatype.testing-pr-comment-02-1.0-SNAPSHOT", "relationshipType": "DEPENDS_ON", "relatedSpdxElement": "SPDXRef-maven-org.apache.logging.log4j-log4j-core-2.16.0" }, { "spdxElementId": "SPDXRef-maven-org.apache.logging.log4j-log4j-core-2.16.0", "relationshipType": "DEPENDS_ON", "relatedSpdxElement": "SPDXRef-maven-org.apache.logging.log4j-log4j-api-2.16.0" }, { "spdxElementId": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-databind-2.14.0", "relationshipType": "DEPENDS_ON", "relatedSpdxElement": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-annotations-2.14.0" }, { "spdxElementId": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-databind-2.14.0", "relationshipType": "DEPENDS_ON", "relatedSpdxElement": "SPDXRef-maven-com.fasterxml.jackson.core-jackson-core-2.14.0" } ] } ```