niche · 0.0

SBOM

Score 19.5 / 100 22 providers +10 via APIs 27 APIs Search apis.io →

Providers using this tag (22)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Strong 2 Solid coverage with minor gaps
KonduktoCompanyApplication SecurityASPMVulnerability Management1 API57.83-shakeCompanySREData IntegrationETL1 API56.7
Developing 7 Usable, with meaningful gaps to close
SocketSupply Chain SecurityOpen Source SecuritySoftware Composition AnalysisSCA15 APIs52.5FossaCompanySecuritySoftware Supply ChainOpen-Source1 API48.5Root (fka Slim.ai)CompanySecurityVulnerability ManagementContainer Security1 API46.6MendApplication SecuritySoftware Composition AnalysisSASTContainer Security2 APIs46.1BinarlyCompanySecurityFirmware SecuritySupply Chain Security1 API44.7SocketCompanySecuritySoftware Supply Chain SecurityDependency Scanning1 API42.5AnchoreContainer SecurityContainersSoftware Supply Chain1 API40.7
Thin 6 Limited public surface area
TideliftCompanyOpen-SourceSoftware Supply ChainDependency Management1 API38.6SonatypeSoftware Supply ChainSecurityVulnerability Management1 API36.8Finite StateProduct SecuritySoftware Supply Chain SecurityFirmware Analysis3 APIs36.7KetryxCompanyMedical DevicesLife SciencesCompliance1 API35.5TrivyContainersKubernetesSecurity1 API35.3Manifest CyberCybersecuritySupply Chain SecurityVulnerability Management1 API28.5
Emerging 5 Early or largely undocumented
KodemCompanyCybersecurityApplication SecurityRuntime Security1 API20.4GrypeContainer ImagesContainersOpen-Source1 API17.3EXIGERCompanySupply ChainRisk ManagementThird-Party Risk13.8SPDXLicensingLinux FoundationStandards1 API12.3CodeSecureCompanyApplication SecurityStatic AnalysisSAST11.3
Minimal 2 Almost no public developer surface
OligoCompanySecurityApplication SecurityRuntime Security9.7deepfactorCompanyCybersecurityApplication SecurityDevSecOps5.0

APIs with this tag (27)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Exemplar 3 Complete, well-documented, and agent-ready
Harness Supply Chain Security APIAPIs for SBOM generation, artifact integrity verification, and policy enforcement for software supply chain...76.1Snyk SBOM APIThe SBOM API from Snyk — 4 operation(s) for sbom.71.3Palo Alto Networks SBOM APIThe SBOM API from Palo Alto Networks — 16 operation(s) for sbom.71.1
Developing 17 Usable, with meaningful gaps to close
Dependency TrackSBOM upload to the University's Dependency Track instance from external networks. Public and running in the...54.1CloudGuard Identity APIIAM Safe identity protection - lease-based elevation of IAM entities and the identity surface CloudGuard us...53.7CloudGuard Inventory - AWS Application Integration APIAWS application-integration inventory - SNS topics, SQS queues and related messaging services.53.7CloudGuard Inventory - AWS Global APIGlobal AWS inventory entities - organizational units, regions and account-wide objects CloudGuard fetches f...53.7CloudGuard Inventory - AWS IAM APIAWS IAM inventory - users, roles, policies, virtual MFA devices and credential objects CloudGuard fetches f...53.7CloudGuard Inventory - AWS Machine Learning APIAWS machine-learning inventory - SageMaker resources CloudGuard tracks as protected assets.53.7CloudGuard Inventory - AWS Management Tools APIAWS management-tooling inventory - AWS Config settings, CloudTrail and related governance services.53.7CloudGuard Inventory - AWS Networking and Content Delivery APIAWS networking inventory - VPCs, subnets, route tables, load balancers, Route 53 domains and CloudFront dis...53.7CloudGuard Inventory - AWS Security, Identity and Compliance APIAWS security-service inventory - KMS keys, Secrets Manager and related security services as CloudGuard prot...53.7CloudGuard Inventory - AWS Storage APIAWS storage inventory - S3 buckets, EBS volumes and backup vaults as CloudGuard protected assets.53.7CloudGuard Inventory - GCP APIGoogle Cloud inventory - networks, Pub/Sub topics, compute, storage and IAM objects CloudGuard fetches from...53.7CloudGuard Inventory - OCI APIOracle Cloud Infrastructure inventory - compartments and OCI resources CloudGuard fetches from onboarded OC...53.7CloudGuard Inventory APICross-cloud protected-asset inventory - entity reports and the generic inventory surface CloudGuard exposes...53.7OrteliusOrtelius is an open source supply chain evidence store that aggregates continuous security intelligence acr...53.5Sysdig SBOM APISoftware Bill of Materials management49.0TrivyTrivy is a comprehensive open source security scanner for containers, Kubernetes, code repositories, clouds...41.6Anchore SBOM APIThe SBOM API from Anchore — 1 operation(s) for sbom.40.7
Thin 4 Limited public surface area
Finite State GraphQL APIGraphQL API historically documented at https://platform.finitestate.io/api/v1/graphql and still the transpo...36.7Finite State Platform APIToken-authenticated REST API for the Finite State platform, served under /api/public/v0 on the platform hos...36.7GUAC (Graph for Understanding Artifact Composition)GUAC aggregates software supply-chain security metadata (SBOMs, attestations, vulnerabilities, signatures) ...35.6Manifest Cyber APIThe official public API for the Manifest Cyber platform v1. Used by Manifest's frontend apps and internal E...28.5
Emerging 3 Early or largely undocumented
Copa VEX OutputCopa can emit a Vulnerability Exchange (VEX) document describing which CVEs were patched. VEX documents hel...19.2GrypeGrype is an open source vulnerability scanner for container images and filesystems developed by Anchore. It...17.3SPDX APIAPI for accessing SPDX open standard resources for software bill of materials, license compliance, and soft...12.3

Companies reaching this through an API (10)

These companies publish an API, specification or operation carrying “SBOM” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Aqua Security CloudGuard Continuous Delivery Foundation Copa (Project Copacetic) Harness OpenSSF Palo Alto Networks Snyk Sysdig University of Helsinki

Score breakdown

Frequency
47.0
log-scaled weighted occurrences
Breadth
0.6
spread across providers
Quality lift
38.0
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Software Composition Analysis 10 co-occurrences Software Supply Chain 7 co-occurrences Container Security 7 co-occurrences DevSecOps 14 co-occurrences Vulnerabilities 8 co-occurrences Vulnerability Scanning 6 co-occurrences Vulnerability Management 15 co-occurrences Supply Chain Security 5 co-occurrences

Where this tag comes from

Provider tag22
Api tag15
Openapi tag16
Openapi op tag22

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/sbom"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/sbom"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/sbom/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.