> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/api/managing-sboms/download-sbom.md).

# Download an SBOM

Downloading returns one version's SBOM. You need two IDs: the environment ID (`projectId`) and the version ID (`sbomId`). Get them from [List Products and Versions](/api/inventory/list-resources.md).

The SBOM content comes back base64-encoded inside the JSON response. You decode it to get the file.

## The request

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query downloadSbom($projectId: Uuid!, $sbomId: Uuid!) { sbom(projectId: $projectId, sbomId: $sbomId) { download(sbomId: $sbomId) { ready content contentType filename } } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    }
  }'
```

Response:

```json
{
  "data": {
    "sbom": {
      "download": {
        "ready": true,
        "content": "ewogICJib21Gb3JtYXQiOiAiQ3ljbG9uZURYIiwK...",
        "contentType": "application/json",
        "filename": "payments-service.cdx.json"
      }
    }
  }
}
```

| Field         | Meaning                                                        |
| ------------- | -------------------------------------------------------------- |
| `ready`       | `true` when the SBOM is processed and content is included.     |
| `content`     | The SBOM file, base64-encoded.                                 |
| `contentType` | MIME type of the decoded file, for example `application/json`. |
| `filename`    | Suggested filename. May be `null`.                             |

## Decode the content

The `content` field is base64. Pipe the response through `jq` and `base64` to write the SBOM straight to a file:

```bash
curl -s https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query downloadSbom($projectId: Uuid!, $sbomId: Uuid!) { sbom(projectId: $projectId, sbomId: $sbomId) { download(sbomId: $sbomId) { ready content } } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    }
  }' \
  | jq -r '.data.sbom.download.content' | base64 -d > sbom.json
```

`sbom.json` now holds the CycloneDX or SPDX document.

## Download options

Pass extra variables to control format and content. Add them to `variables` and to the `download(...)` arguments.

| Variable               | Type       | Effect                                                                |
| ---------------------- | ---------- | --------------------------------------------------------------------- |
| `spec`                 | `SbomSpec` | Output format: `CycloneDX` or `SPDX`.                                 |
| `specVersion`          | String     | Spec version, for example `1.6` or `2.3`.                             |
| `includeVulns`         | Boolean    | Include known vulnerabilities in the SBOM.                            |
| `original`             | Boolean    | Return the exact file that was uploaded, with no platform processing. |
| `lite`                 | Boolean    | Return a lighter SBOM with reduced metadata.                          |
| `excludeParts`         | Boolean    | Exclude linked or nested part SBOMs.                                  |
| `includeSupportStatus` | Boolean    | Add support-status information to components.                         |

Example, download as SPDX 2.3 with vulnerabilities:

```bash
curl -s https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query downloadSbom($projectId: Uuid!, $sbomId: Uuid!, $spec: SbomSpec, $specVersion: String, $includeVulns: Boolean) { sbom(projectId: $projectId, sbomId: $sbomId) { download(sbomId: $sbomId, spec: $spec, specVersion: $specVersion, includeVulns: $includeVulns) { ready content } } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6",
      "spec": "SPDX",
      "specVersion": "2.3",
      "includeVulns": true
    }
  }' \
  | jq -r '.data.sbom.download.content' | base64 -d > sbom.spdx.json
```

## When the SBOM is not ready

A version is not downloadable until the platform finishes processing it. If you download too soon, `ready` is `false` and `content` is empty.

To make the API wait for processing, pass `requireCompleted` with the stages you need. Ask `download` for `processingStatus` so you can see what is pending.

```graphql
query downloadSbom($projectId: Uuid!, $sbomId: Uuid!,
                   $requireCompleted: [SbomProcessingStageEnum!]) {
  sbom(projectId: $projectId, sbomId: $sbomId) {
    download(sbomId: $sbomId, requireCompleted: $requireCompleted) {
      ready
      content
      processingStatus { automation vulnScan policyScan }
    }
  }
}
```

Valid stages: `AUTOMATION`, `VULN_SCAN`, `POLICY_SCAN`.

If `ready` is still `false`, wait and retry. See [Check Processing Status](/api/managing-sboms/processing-status.md) for the full pattern.