{"meta":{"title":"适用于软件物料清单 (SBOM) 的 REST API 终结点","intro":"使用 REST API 导出存储库的软件材料清单 (SBOM)。","product":"REST API","breadcrumbs":[{"href":"/zh/enterprise-cloud@latest/rest","title":"REST API"},{"href":"/zh/enterprise-cloud@latest/rest/dependency-graph","title":"依赖项关系图"},{"href":"/zh/enterprise-cloud@latest/rest/dependency-graph/sboms","title":"软件材料清单 (SBOM)"}],"documentType":"article"},"body":"# 适用于软件物料清单 (SBOM) 的 REST API 终结点\n\n使用 REST API 导出存储库的软件材料清单 (SBOM)。\n\n如果至少具有对存储库的读取访问权限，可以通过 UI 或 GitHub REST API 将存储库的依赖项图导出为 SPDX 兼容的软件材料清单（SBOMGitHub）。 有关详细信息，请参阅“[导出存储库的软件物料清单](/zh/enterprise-cloud@latest/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/export-dependencies-as-sbom)”。\n\n本文提供有关 REST API 终结点的详细信息。\n\n> \\[!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## Export a software bill of materials (SBOM) for a repository.\n\n```\nGET /repos/{owner}/{repo}/dependency-graph/sbom\n```\n\nWarning\n\nClosing down notice: This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use \"Request generation of a software bill of materials (SBOM) for a repository\" to trigger the report, then \"Fetch a software bill of materials (SBOM) for a repository\" to retrieve it. For more information, see the changelog.\n\nExports the software bill of materials (SBOM) for a repository in SPDX JSON format.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n* **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n### HTTP response status codes\n\n* **200** - OK\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom\n```\n\n**Response schema (Status: 200):**\n\n* `sbom`: required, object:\n  * `SPDXID`: required, string\n  * `spdxVersion`: required, string\n  * `comment`: string\n  * `creationInfo`: required, object:\n    * `created`: required, string\n    * `creators`: required, array of string\n  * `name`: required, string\n  * `dataLicense`: required, string\n  * `documentNamespace`: required, string\n  * `packages`: required, array of objects:\n    * `SPDXID`: string\n    * `name`: string\n    * `versionInfo`: string\n    * `downloadLocation`: string\n    * `filesAnalyzed`: boolean\n    * `licenseConcluded`: string\n    * `licenseDeclared`: string\n    * `supplier`: string\n    * `copyrightText`: string\n    * `externalRefs`: array of objects:\n      * `referenceCategory`: required, string\n      * `referenceLocator`: required, string\n      * `referenceType`: required, string\n  * `relationships`: array of objects:\n    * `relationshipType`: string\n    * `spdxElementId`: string\n    * `relatedSpdxElement`: string\n\n## Fetch a software bill of materials (SBOM) for a repository.\n\n```\nGET /repos/{owner}/{repo}/dependency-graph/sbom/fetch-report/{sbom_uuid}\n```\n\nFetches a previously generated software bill of materials (SBOM) for a repository.\nWhen the SBOM is ready, the response is a 302 redirect to a temporary download URL for the SBOM in SPDX JSON format.\nThe generated SBOM report may be retained for up to one week from the original request.\nThe temporary download URL returned by this endpoint expires separately, and its expiry is set when the fetch request is made.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n* **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n* **`sbom_uuid`** (string) (required)\n  The unique identifier of the SBOM export.\n\n### HTTP response status codes\n\n* **202** - SBOM is still being processed, no content is returned.\n\n* **302** - Redirects to a temporary download URL for the completed SBOM.\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom/fetch-report/SBOM_UUID\n```\n\n**Response schema (Status: 202):**\n\n## Request generation of a software bill of materials (SBOM) for a repository.\n\n```\nGET /repos/{owner}/{repo}/dependency-graph/sbom/generate-report\n```\n\nTriggers a job to generate a software bill of materials (SBOM) for a repository in SPDX JSON format.\n\n### Parameters\n\n#### Headers\n\n* **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n* **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n* **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n### HTTP response status codes\n\n* **201** - Created\n\n* **403** - Forbidden\n\n* **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/dependency-graph/sbom/generate-report\n```\n\n**Response schema (Status: 201):**\n\n* `sbom_url`: string"}