SBOM Export

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every dependency in your project. SBOMs are now required for US federal software procurement and increasingly demanded by enterprise customers for supply chain risk management.

CodeScan generates SBOMs in two industry-standard formats from any dependency scan result — no extra setup required.

Generating an SBOM — web

Run a dependency scan (upload a manifest file), then click the ↓ CycloneDX or ↓ SPDX button in the Dependencies tab summary bar. The file downloads immediately — no login required for the download itself.

Generating an SBOM — CLI

# Generate CycloneDX (default)
codescan scan package.json --sbom-out sbom.cdx.json

# Generate SPDX
codescan scan package.json --sbom-out sbom.spdx.json --sbom-format spdx

# Include in full scan
codescan scan --dir ./ --gate --sbom-out sbom.cdx.json

SBOM contents

The SBOM includes every parsed dependency with:

• Package URL (purl) — unique identifier in the format pkg:npm/lodash@4.17.21
• Scope — whether the package is a runtime or dev-only dependency
• Vulnerabilities (CycloneDX) — OSV advisory IDs, CVE IDs, CVSS scores, and remediation recommendations for vulnerable packages
• Tool metadata — CodeScan version, generation timestamp, and document namespace

API endpoint

POST https://codesscan.com/api/scan/sbom
Content-Type: application/json

{
  "manifest":  "package.json",
  "ecosystem": "npm",
  "format":    "cyclonedx",    // or "spdx"
  "packages":  [ /* VulnPackage[] from /api/scan/deps */ ],
  "outdated":  [ /* OutdatedPackage[] from /api/scan/deps */ ]
}

# Response: JSON file download (Content-Disposition: attachment)