niche · 0.9 market domainindustry

SBOM

Score 19.5 / 100 21 providers +9 via APIs 16 APIs Search apis.io →

Providers using this tag (21)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Strong 4 Solid coverage with minor gaps
SonatypeSoftware Supply ChainSecurityVulnerability Management2 APIs64.8MendApplication SecuritySoftware Composition AnalysisSASTContainer Security2 APIs63.4KonduktoCompanyApplication SecurityASPMVulnerability Management1 API59.03-shakeCompanySREData IntegrationETL1 API57.0
Developing 4 Usable, with meaningful gaps to close
FossaCompanySecuritySoftware Supply ChainOpen Source1 API49.6Root (fka Slim.ai)CompanySecurityVulnerability ManagementContainer Security1 API47.6BinarlyCompanySecurityFirmware SecuritySupply Chain Security1 API44.6SocketCompanySecuritySoftware Supply Chain SecurityDependency Scanning1 API43.6
Thin 6 Limited public surface area
AnchoreContainer SecurityContainersSoftware Supply Chain1 API38.8TideliftCompanyOpen SourceSoftware Supply ChainDependency Management1 API38.0Finite StateProduct SecuritySoftware Supply Chain SecurityFirmware Analysis3 APIs37.8TrivyContainersKubernetesSecurity1 API34.2KetryxCompanyMedical DevicesLife SciencesCompliance1 API33.7Manifest CyberCybersecuritySupply Chain SecurityVulnerability Management1 API26.6
Emerging 3 Early or largely undocumented
KodemCompanyCybersecurityApplication SecurityRuntime Security1 API21.6GrypeContainer ImagesContainersOpen Source1 API15.6EXIGERCompanySupply ChainRisk ManagementThird-Party Risk Management13.9
Minimal 4 Almost no public developer surface
SPDXLicensingLinux FoundationStandards1 API10.6CodeSecureCompanyApplication SecurityStatic AnalysisSAST9.7OligoCompanySecurityApplication SecurityRuntime Security9.2deepfactorCompanyCybersecurityApplication SecurityDevSecOps0.0

APIs with this tag (16)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Exemplar 4 Complete, well-documented, and agent-ready
Harness SBOM APIThe SBOM API from Harness — 2 operation(s) for sbom.90.7Harness Supply Chain Security APIAPIs for SBOM generation, artifact integrity verification, and policy enforcement for software supply chain...90.7Snyk SBOM APIThe SBOM API from Snyk — 4 operation(s) for sbom.80.6Palo Alto Networks SBOM APIThe SBOM API from Palo Alto Networks — 16 operation(s) for sbom.76.9
Developing 4 Usable, with meaningful gaps to close
OrteliusOrtelius is an open source supply chain evidence store that aggregates continuous security intelligence acr...51.6Dependency TrackSBOM upload to the University's Dependency Track instance from external networks. Public and running in the...48.8Sysdig SBOM APISoftware Bill of Materials management46.8TrivyTrivy is a comprehensive open source security scanner for containers, Kubernetes, code repositories, clouds...42.1
Thin 5 Limited public surface area
Anchore SBOM APIThe SBOM API from Anchore — 1 operation(s) for sbom.38.8Finite State GraphQL APIGraphQL API historically documented at https://platform.finitestate.io/api/v1/graphql and still the transpo...37.8Finite State Platform APIToken-authenticated REST API for the Finite State platform, served under /api/public/v0 on the platform hos...37.8GUAC (Graph for Understanding Artifact Composition)GUAC aggregates software supply-chain security metadata (SBOMs, attestations, vulnerabilities, signatures) ...33.2Manifest Cyber APIThe official public API for the Manifest Cyber platform v1. Used by Manifest's frontend apps and internal E...26.6
Emerging 2 Early or largely undocumented
Copa VEX OutputCopa can emit a Vulnerability Exchange (VEX) document describing which CVEs were patched. VEX documents hel...16.5GrypeGrype is an open source vulnerability scanner for container images and filesystems developed by Anchore. It...15.6
Minimal 1 Almost no public developer surface
SPDX APIAPI for accessing SPDX open standard resources for software bill of materials, license compliance, and soft...10.6

Companies reaching this through an API (9)

These companies publish an API, specification or operation carrying “SBOM” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Aqua Security Continuous Delivery Foundation Copa (Project Copacetic) Harness OpenSSF Palo Alto Networks Snyk Sysdig University of Helsinki

Score breakdown

Frequency
43.9
log-scaled weighted occurrences
Breadth
0.5
spread across providers
Quality lift
42.2
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Software Composition Analysis 9 co-occurrences Software Supply Chain 7 co-occurrences DevSecOps 14 co-occurrences Container Security 6 co-occurrences Vulnerability Scanning 6 co-occurrences Vulnerabilities 8 co-occurrences Vulnerability Management 15 co-occurrences

Where this tag comes from

Provider tag21
Api tag16
Openapi tag4
Openapi op tag8

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/sbom"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/sbom"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/sbom/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.