GitHub Software API

openapi: 3.2.0
info:
  version: 1.1.4
  title: github-repos-api Software API
  description: 'Use the REST API to create, manage and control the workflow of public and

    private GitHub repositories.'
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact
servers:
- url: '{protocol}://{hostname}'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: api.github.com
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: https
tags:
- name: Software
paths:
  /repos/{owner}/{repo}/dependency-graph/sbom:
    get:
      summary: GitHub Export Software Bill of Materials (sbom) for Repository.
      description: Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.
      tags:
      - Software
      operationId: exportSoftwareBillOfMaterialsSbomForRepository
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/dependency-graph/sboms#export-a-software-bill-of-materials-sbom-for-a-repository
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - in: header
        name: Authorization
        schema:
          type: string
        example: example_value
      - in: header
        name: X-GitHub-Api-Version
        schema:
          type: string
          default: '2022-11-28'
        example: example_value
      - in: header
        name: Accept
        schema:
          type: string
          default: application/vnd.github+json
        example: example_value
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dependency-graph-spdx-sbom'
              examples:
                default:
                  $ref: '#/components/examples/dependency-graph-export-sbom-response'
          headers:
            Link:
              $ref: '#/components/headers/link'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
      x-github:
        githubCloudOnly: false
        category: dependency-graph
        subcategory: sboms
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
  headers:
    link:
      example: <https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"
      schema:
        type: string
  examples:
    dependency-graph-export-sbom-response:
      value:
        sbom:
          SPDXID: SPDXRef-DOCUMENT
          spdxVersion: SPDX-2.3
          creationInfo:
            created: '2021-09-01T00:00:00Z'
            creators:
            - 'Tool: GitHub.com-Dependency-Graph'
          name: github/example
          dataLicense: CC0-1.0
          documentDescribes:
          - github/example
          documentNamespace: https://github.com/github/example/dependency_graph/sbom-abcdef123456
          packages:
          - SPDXID: SPDXRef-Package
            name: rubygems:rails
            versionInfo: 1.0.0
            downloadLocation: NOASSERTION
            filesAnalyzed: false
            licenseConcluded: NOASSERTION
            licenseDeclared: NOASSERTION
  schemas:
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
    dependency-graph-spdx-sbom:
      title: Dependency Graph SPDX SBOM
      description: schema for the SPDX JSON format returned by the Dependency Graph.
      type: object
      properties:
        sbom:
          type: object
          properties:
            SPDXID:
              type: string
              example: SPDXRef-DOCUMENT
              description: The SPDX identifier for the SPDX document.
            spdxVersion:
              type: string
              example: SPDX-2.3
              description: The version of the SPDX specification that this document conforms to.
            creationInfo:
              type: object
              properties:
                created:
                  type: string
                  example: '2021-11-03T00:00:00Z'
                  description: The date and time the SPDX document was created.
                creators:
                  type: array
                  items:
                    type: string
                    example: GitHub
                  description: The tools that were used to generate the SPDX document.
              required:
              - created
              - creators
            name:
              type: string
              example: github/github
              description: The name of the SPDX document.
            dataLicense:
              type: string
              example: CC0-1.0
              description: The license under which the SPDX document is licensed.
            documentDescribes:
              type: array
              items:
                type: string
                example: github/github
              description: The name of the repository that the SPDX document describes.
            documentNamespace:
              type: string
              example: https://github.com/example/dependency_graph/sbom-123
              description: The namespace for the SPDX document.
            packages:
              type: array
              items:
                type: object
                properties:
                  SPDXID:
                    type: string
                    example: SPDXRef-Package
                    description: unique SPDX identifier for the package.
                  name:
                    type: string
                    example: rubygems:github/github
                    description: The name of the package.
                  versionInfo:
                    type: string
                    example: 1.0.0
                    description: 'The version of the package. If the package does not have an exact version specified,

                      a version range is given.'
                  downloadLocation:
                    type: string
                    example: NOASSERTION
                    description: 'The location where the package can be downloaded,

                      or NOASSERTION if this has not been determined.'
                  filesAnalyzed:
                    type: boolean
                    example: false
                    description: 'Whether the package''s file content has been subjected to

                      analysis during the creation of the SPDX document.'
                  licenseConcluded:
                    type: string
                    example: MIT
                    description: The license of the package as determined while creating the SPDX document.
                  licenseDeclared:
                    type: string
                    example: NOASSERTION
                    description: 'The license of the package as declared by its author, or NOASSERTION if this information

                      was not available when the SPDX document was created.'
                  supplier:
                    type: string
                    example: NOASSERTION
                    description: The distribution source of this package, or NOASSERTION if this was not determined.
                  copyrightText:
                    type: string
                    example: Copyright (c) 1985 GitHub.com
                    description: The copyright holders of the package, and any dates present with those notices, if available.
                  externalRefs:
                    type: array
                    items:
                      type: object
                      properties:
                        referenceCategory:
                          type: string
                          example: PACKAGE-MANAGER
                          description: The category of reference to an external resource this reference refers to.
                        referenceLocator:
                          type: string
                          example: pkg:gem/rails@6.0.1
                          description: locator for the particular external resource this reference refers to.
                        referenceType:
                          type: string
                          example: purl
                          description: The category of reference to an external resource this reference refers to.
                      required:
                      - referenceCategory
                      - referenceLocator
                      - referenceType
              required:
              - SPDXID
              - name
              - versionInfo
              - downloadLocation
              - filesAnalyzed
              - licenseConcluded
              - licenseDeclared
              - supplier
          required:
          - SPDXID
          - spdxVersion
          - creationInfo
          - name
          - dataLicense
          - documentDescribes
          - documentNamespace
          - packages
      required:
      - sbom
  parameters:
    owner:
      name: owner
      description: The account owner of the repository. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
    repo:
      name: repo
      description: The name of the repository without the `.git` extension. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/