> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/api/managing-sboms/edit-sbom-metadata.md).

# Edit SBOM Metadata

You can change a version's metadata through the API: who authored the SBOM, who supplies it, and the license that governs the document itself. This guide covers SBOM authors, suppliers, and the data license.

{% hint style="info" %}
**Author of the SBOM vs author of a component.** An SBOM has authors, the people or tools that produced the document. This maps to `metadata.authors` in CycloneDX. A *component* inside the SBOM also has an `author` field, but that one is read-only through the API: it is set when the SBOM is ingested and cannot be changed with a mutation. To edit component-level fields you can change, see [Edit a Component](/api/inventory/edit-component.md).
{% endhint %}

Every call here needs the version ID (`sbomId`). Get it from [List Products and Versions](/api/inventory/list-resources.md).

## Add an author

`authorCreate` adds an author to a version.

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation AddAuthor($sbomId: Uuid!, $name: String!, $email: String, $phone: String) { authorCreate(input: { sbomId: $sbomId, name: $name, email: $email, phone: $phone }) { author { id name email phone } errors } }",
    "variables": {
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6",
      "name": "Jane Doe",
      "email": "jane@example.com"
    }
  }'
```

```json
{
  "data": {
    "authorCreate": {
      "author": {
        "id": "b1c2d3e4-0000-0000-0000-000000000001",
        "name": "Jane Doe",
        "email": "jane@example.com",
        "phone": null
      },
      "errors": []
    }
  }
}
```

| Input    | Type   | Required                               |
| -------- | ------ | -------------------------------------- |
| `sbomId` | Uuid   | Yes. The version to add the author to. |
| `name`   | String | Yes.                                   |
| `email`  | String | No.                                    |
| `phone`  | String | No.                                    |

Save the returned `author.id`. You need it to update or delete the author.

## List the authors on a version

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query Authors($projectId: Uuid!, $sbomId: Uuid!) { sbom(projectId: $projectId, sbomId: $sbomId) { authors { id name email phone } } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    }
  }'
```

## Update an author

`authorUpdate` changes an existing author. Pass the `authorId` and only the fields you want to change.

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation UpdateAuthor($authorId: Uuid!, $sbomId: Uuid!, $email: String) { authorUpdate(input: { authorId: $authorId, sbomId: $sbomId, email: $email }) { author { id name email } errors } }",
    "variables": {
      "authorId": "b1c2d3e4-0000-0000-0000-000000000001",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6",
      "email": "jane.doe@example.com"
    }
  }'
```

## Delete an author

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation DeleteAuthor($authorId: Uuid!, $sbomId: Uuid!) { authorDelete(input: { authorId: $authorId, sbomId: $sbomId }) { errors } }",
    "variables": {
      "authorId": "b1c2d3e4-0000-0000-0000-000000000001",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    }
  }'
```

## Suppliers

A version also has suppliers. The mutations work the same way as authors:

| Mutation             | Purpose                      |
| -------------------- | ---------------------------- |
| `sbomSupplierCreate` | Add a supplier to a version. |
| `sbomSupplierUpdate` | Change an existing supplier. |
| `sbomSupplierDelete` | Remove a supplier.           |

To set a supplier on an individual component instead of the whole SBOM, see [Edit a Component](/api/inventory/edit-component.md).

## Set the data license

The data license is the license that governs the SBOM document itself, not the software it describes. In SPDX this is the `dataLicense` field (it defaults to `CC0-1.0`). In the dashboard it shows on the version as the **Data License**.

This is a property of the whole version, so you set it with `sbomUpdate`, not `componentUpdate`. `sbomUpdate` takes the version ID as `id` and a `licenses` object holding an SPDX expression in `licensesExp`:

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation SetDataLicense($id: Uuid!, $licenses: LicenseInput) { sbomUpdate(input: { id: $id, licenses: $licenses }) { sbom { id licensesExp } errors } }",
    "variables": {
      "id": "4e423fe0-d089-4025-b1e4-8fe9608138d6",
      "licenses": { "licensesExp": "CC0-1.0" }
    }
  }'
```

```json
{
  "data": {
    "sbomUpdate": {
      "sbom": {
        "id": "4e423fe0-d089-4025-b1e4-8fe9608138d6",
        "licensesExp": "CC0-1.0"
      },
      "errors": []
    }
  }
}
```

{% hint style="info" %}
**Data license vs component license.** `sbomUpdate` with `licenses` sets the license on the SBOM document (the version). The `licenses` field on `componentUpdate` sets the license on a single component inside the SBOM. They use the same `LicenseInputType` and the same `licensesExp` SPDX expression, but they apply at different levels (`LicenseInput`). See [Edit a Component](/api/inventory/edit-component.md).
{% endhint %}

## Errors

Mutation failures come back in the `errors` list rather than as an HTTP error:

```json
{
  "data": {
    "authorCreate": {
      "author": null,
      "errors": ["Sbom not found"]
    }
  }
}
```

`Sbom not found` means the `sbomId` is wrong or the token cannot access it. See [Errors](/api/reference/errors.md).