Lightrun

Lightrun Dynamic SBOM API

Dynamic SBOM API.

GitHub OpenAPI

Operations 1

GET /api/v1/sbom Get a software bill of materials (SBOM) #

Documentation

📖
Documentation
https://docs.lightrun.com/public-api/introduction/
📖
APIReference
https://docs.lightrun.com/public-api/api-reference/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/authentication/lightrun-authentication.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/openapi/lightrun-dynamic-sbom-api-openapi.yml

Other Resources

🔗
OAuthScopes
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/scopes/lightrun-scopes.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/errors/lightrun-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/data-model/lightrun-data-model.yml
🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/lightrun/refs/heads/main/conventions/lightrun-conventions.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/lightrun-dynamic-sbom-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

lightrun-dynamic-sbom-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  description: Lightrun API documentation
  title: Lightrun Dynamic SBOM API
  version: v1
servers:
- url: http://localhost:8090
  description: Generated server url
tags:
- description: Dynamic SBOM API.
  name: Dynamic SBOM
paths:
  /api/v1/sbom:
    get:
      description: 'Get a software bill of materials (SBOM).


        **Required API permission level:** `SECURITY`'
      operationId: getSBOM
      parameters:
      - description: Agent pool ID, required if multiple agent pools configured.
        in: query
        name: agentPoolId
        required: false
        schema:
          type: string
      - description: Timestamp of when the SBOM was created. Format is <YYYY-MM-DD>. (UTC)
        in: query
        name: creationTime
        required: true
        schema:
          type: string
          format: date
      - description: Get SBOM in the selected data format.
        in: query
        name: format
        required: true
        schema:
          type: string
          enum:
          - SPDX
          - CYCLONE_DX
          - CSV
      - description: Filter SBOM by package name/s.
        in: query
        name: packageNames
        required: false
        schema:
          type: array
          items:
            type: string
      - description: Filter SBOM by package version/s.
        in: query
        name: packageVersions
        required: false
        schema:
          type: array
          items:
            type: string
      - description: Package name.
        in: query
        name: sbomPackageName
        required: true
        schema:
          type: string
      - description: Package supplier.
        in: query
        name: sbomSupplierName
        required: true
        schema:
          type: string
      - description: Package version.
        in: query
        name: sbomVersion
        required: true
        schema:
          type: string
      - description: Filters packages based on a distinct combination of tags assigned to the hosts that loaded them.
        in: query
        name: tags
        required: false
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
                oneOf:
                - $ref: '#/components/schemas/SPDXSbomReportDTO'
                - $ref: '#/components/schemas/CycloneDXSbomReportDTO'
            text/plain: {}
          description: SBOM generated.
        '400':
          description: A required attribute of the API request is missing.
        '401':
          description: Unauthorized.
      security:
      - API Token: []
      summary: Get a software bill of materials (SBOM)
      tags:
      - Dynamic SBOM
components:
  schemas:
    SPDXSbomReportPackageDTO:
      type: object
      properties:
        SPDXID:
          type: string
        copyrightText:
          type: string
        downloadLocation:
          type: string
        externalRefs:
          type: array
          items:
            $ref: '#/components/schemas/SPDXSbomReportExternalRefDTO'
        filesAnalyzed:
          type: boolean
        licenseConcluded:
          type: string
        licenseDeclared:
          type: string
        name:
          type: string
        packageFileName:
          type: string
        supplier:
          type: string
        versionInfo:
          type: string
    SPDXSbomReportExternalRefDTO:
      type: object
      properties:
        referenceCategory:
          type: string
        referenceLocator:
          type: string
        referenceType:
          type: string
    CycloneDXSbomReportServiceDTO:
      type: object
      properties:
        name:
          type: string
        provider:
          $ref: '#/components/schemas/CycloneDXSbomReportProviderDTO'
        version:
          type: string
    CycloneDXSbomReportComponentDTO:
      type: object
      properties:
        bom-ref:
          type: string
        description:
          type: string
        evidence:
          $ref: '#/components/schemas/CycloneDXSbomReportEvidenceDTO'
        group:
          type: string
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/CycloneDXSbomReportHashDTO'
        licenses:
          type: array
          items:
            type: string
        name:
          type: string
        purl:
          type: string
        scope:
          type: string
        type:
          type: string
        version:
          type: string
    SPDXSbomReportRelationshipDTO:
      type: object
      properties:
        comment:
          type: string
        relatedSpdxElement:
          type: string
        relationshipType:
          type: string
          enum:
          - DESCRIBES
          - RUNTIME_DEPENDENCY_OF
        spdxElementId:
          type: string
    CycloneDXSbomReportEvidenceDTO:
      type: object
      properties:
        occurrences:
          type: array
          items:
            $ref: '#/components/schemas/CycloneDXSbomReportOccurrenceDTO'
    SPDXSbomReportDTO:
      type: object
      properties:
        SPDXID:
          type: string
        creationInfo:
          $ref: '#/components/schemas/SPDXSbomReportCreationInfoDTO'
        dataLicense:
          type: string
        documentNamespace:
          type: string
        name:
          type: string
        packages:
          type: array
          items:
            $ref: '#/components/schemas/SPDXSbomReportPackageDTO'
        relationships:
          type: array
          items:
            $ref: '#/components/schemas/SPDXSbomReportRelationshipDTO'
        spdxVersion:
          type: string
    SPDXSbomReportCreationInfoDTO:
      type: object
      properties:
        created:
          type: string
        creators:
          type: array
          items:
            type: string
    CycloneDXSbomReportProviderDTO:
      type: object
      properties:
        name:
          type: string
    CycloneDXSbomReportDependecyDTO:
      type: object
      properties:
        dependsOn:
          type: array
          items:
            type: string
        ref:
          type: string
    CycloneDXSbomReportHashDTO:
      type: object
      properties:
        alg:
          type: string
        content:
          type: string
    CycloneDXSbomReportOccurrenceDTO:
      type: object
      properties:
        location:
          type: string
    CycloneDXSbomReportToolDTO:
      type: object
      properties:
        services:
          type: array
          items:
            $ref: '#/components/schemas/CycloneDXSbomReportServiceDTO'
    CycloneDXSbomReportDTO:
      type: object
      properties:
        bomFormat:
          type: string
        components:
          type: array
          items:
            $ref: '#/components/schemas/CycloneDXSbomReportComponentDTO'
        dependencies:
          type: array
          items:
            $ref: '#/components/schemas/CycloneDXSbomReportDependecyDTO'
        metadata:
          $ref: '#/components/schemas/CycloneDXSbomReportMetadataDTO'
        serialNumber:
          type: string
        specVersion:
          type: string
        version:
          type: integer
          format: int32
    CycloneDXSbomReportMetadataDTO:
      type: object
      properties:
        component:
          $ref: '#/components/schemas/CycloneDXSbomReportComponentDTO'
        timestamp:
          type: string
        tools:
          $ref: '#/components/schemas/CycloneDXSbomReportToolDTO'
  securitySchemes:
    API_Token:
      scheme: bearer
      type: http