Group Products with Parts

A version can include other versions as parts. Use this to model an assembly: a top-level product made up of components you track separately, each with its own SBOM.

Parts link versions, not whole products. A part relationship connects one version (sbom) to another version. You attach a specific version of the child product to a specific version of the parent. When the child ships a new version, attach that new version as a part. The link does not move to the latest version on its own.

Every call here needs version IDs (sbomId). Get them from List Products and Versions. You need two: the parent version and the version you want to add as a part.

Add a part

sbomPartCreate attaches one version to another. parentSbomId is the version that will contain the part. partSbomId is the version being added.

curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation AddPart($parent: Uuid!, $part: Uuid!) { sbomPartCreate(input: { parentSbomId: $parent, partSbomId: $part }) { sbomPart { id } errors } }",
    "variables": {
      "parent": "b5c023fe-1def-4204-8d5f-f6d277c6fe2f",
      "part": "e55baffc-5b30-4071-acc2-9792a4a682bc"
    }
  }'

{
  "data": {
    "sbomPartCreate": {
      "sbomPart": { "id": "cbf8c489-d752-46a9-b4ca-a548351f23c5" },
      "errors": null
    }
  }
}

Input	Type	Required
parentSbomId	Uuid	Yes. The version that will contain the part.
partSbomId	Uuid	Yes. The version to add as a part.

Save the returned sbomPart.id. You need it to remove the part later. It is the ID of the link, not the ID of either version.

List the parts on a version

Query the parent version's sbomParts. Each entry has the link id and the part, which is the attached version.

curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query Parts($id: Uuid!) { sbom(sbomId: $id) { id sbomParts { id part { id projectVersion primaryComponent { name version } } } } }",
    "variables": { "id": "b5c023fe-1def-4204-8d5f-f6d277c6fe2f" }
  }'

{
  "data": {
    "sbom": {
      "id": "b5c023fe-1def-4204-8d5f-f6d277c6fe2f",
      "sbomParts": [
        {
          "id": "cbf8c489-d752-46a9-b4ca-a548351f23c5",
          "part": {
            "id": "e55baffc-5b30-4071-acc2-9792a4a682bc",
            "projectVersion": "1.0",
            "primaryComponent": { "name": "alphatron", "version": "1.0" }
          }
        }
      ]
    }
  }
}

sbomParts lists the direct parts only. For the full nested tree, when a part has parts of its own, request deepParts instead.

Remove a part

sbomPartDelete takes the id of the part link, the sbomPart.id returned by sbomPartCreate or listed under sbomParts. It is not a version ID.

curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation RemovePart($id: Uuid!) { sbomPartDelete(input: { id: $id }) { sbomPart { id } errors } }",
    "variables": { "id": "cbf8c489-d752-46a9-b4ca-a548351f23c5" }
  }'

Removing a part deletes the link, not the version. The version you detached still exists on its own product.

Notes

• A version cannot contain the same part twice. Adding a part that is already attached returns an error.

• Both IDs must be versions your token can access, in the same organization.