# SBOM(소프트웨어 자료 청구서)에 대한 REST API 엔드포인트

REST API를 사용하여 리포지토리에 대한 SBOM(소프트웨어 제품 구성 정보)을 내보냅니다.

리포지토리에 대한 읽기 권한이 있는 경우 UI 또는 GitHub REST API를 통해 GitHub 리포지토리에 대한 종속성 그래프를 SPDX 호환 SBOM(Software Bill of Materials)으로 내보낼 수 있습니다. 자세한 내용은 [리포지토리에 대한 소프트웨어 자료 청구서 내보내기](/ko/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/export-dependencies-as-sbom)을(를) 참조하세요.

이 문서에서는 REST API 엔드포인트에 대한 세부 정보를 제공합니다.

> \[!NOTE]
> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.

## Export a software bill of materials (SBOM) for a repository.

```
GET /repos/{owner}/{repo}/dependency-graph/sbom
```

Warning

Closing down notice: This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use "Request generation of a software bill of materials (SBOM) for a repository" to trigger the report, then "Fetch a software bill of materials (SBOM) for a repository" to retrieve it. For more information, see the changelog.

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

### Parameters

#### Headers

* **`accept`** (string)
  Setting to `application/vnd.github+json` is recommended.

#### Path and query parameters

* **`owner`** (string) (required)
  The account owner of the repository. The name is not case sensitive.

* **`repo`** (string) (required)
  The name of the repository without the .git extension. The name is not case sensitive.

### HTTP response status codes

* **200** - OK

* **403** - Forbidden

* **404** - Resource not found

### Code examples

#### Example

**Request:**

```curl
curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom
```

**Response schema (Status: 200):**

* `sbom`: required, object:
  * `SPDXID`: required, string
  * `spdxVersion`: required, string
  * `comment`: string
  * `creationInfo`: required, object:
    * `created`: required, string
    * `creators`: required, array of string
  * `name`: required, string
  * `dataLicense`: required, string
  * `documentNamespace`: required, string
  * `packages`: required, array of objects:
    * `SPDXID`: string
    * `name`: string
    * `versionInfo`: string
    * `downloadLocation`: string
    * `filesAnalyzed`: boolean
    * `licenseConcluded`: string
    * `licenseDeclared`: string
    * `supplier`: string
    * `copyrightText`: string
    * `externalRefs`: array of objects:
      * `referenceCategory`: required, string
      * `referenceLocator`: required, string
      * `referenceType`: required, string
  * `relationships`: array of objects:
    * `relationshipType`: string
    * `spdxElementId`: string
    * `relatedSpdxElement`: string

## Fetch a software bill of materials (SBOM) for a repository.

```
GET /repos/{owner}/{repo}/dependency-graph/sbom/fetch-report/{sbom_uuid}
```

Fetches a previously generated software bill of materials (SBOM) for a repository.
When the SBOM is ready, the response is a 302 redirect to a temporary download URL for the SBOM in SPDX JSON format.
The generated SBOM report may be retained for up to one week from the original request.
The temporary download URL returned by this endpoint expires separately, and its expiry is set when the fetch request is made.

### Parameters

#### Headers

* **`accept`** (string)
  Setting to `application/vnd.github+json` is recommended.

#### Path and query parameters

* **`owner`** (string) (required)
  The account owner of the repository. The name is not case sensitive.

* **`repo`** (string) (required)
  The name of the repository without the .git extension. The name is not case sensitive.

* **`sbom_uuid`** (string) (required)
  The unique identifier of the SBOM export.

### HTTP response status codes

* **202** - SBOM is still being processed, no content is returned.

* **302** - Redirects to a temporary download URL for the completed SBOM.

* **403** - Forbidden

* **404** - Resource not found

### Code examples

#### Example

**Request:**

```curl
curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom/fetch-report/SBOM_UUID
```

**Response schema (Status: 202):**

## Request generation of a software bill of materials (SBOM) for a repository.

```
GET /repos/{owner}/{repo}/dependency-graph/sbom/generate-report
```

Triggers a job to generate a software bill of materials (SBOM) for a repository in SPDX JSON format.

### Parameters

#### Headers

* **`accept`** (string)
  Setting to `application/vnd.github+json` is recommended.

#### Path and query parameters

* **`owner`** (string) (required)
  The account owner of the repository. The name is not case sensitive.

* **`repo`** (string) (required)
  The name of the repository without the .git extension. The name is not case sensitive.

### HTTP response status codes

* **201** - Created

* **403** - Forbidden

* **404** - Resource not found

### Code examples

#### Example

**Request:**

```curl
curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom/generate-report
```

**Response schema (Status: 201):**

* `sbom_url`: string