Operations

A reference list of the queries and mutations these docs cover. The API schema is larger than this. These are the operations relevant to uploading, downloading, and managing SBOMs.

The production endpoint does not support introspection, so use this page as the operation reference.

Queries

Query	Returns	Guide
organization	Your organization, its products, environments, and versions.	List Products and Versions
sbom(projectId, sbomId)	A single version: metadata, authors, suppliers, components, download, vulns.	Download
vexStatuses	Valid VEX status IDs and names.	Vulnerabilities and VEX
vexJustifications	Valid VEX justification IDs and names.	Vulnerabilities and VEX
cdxResponses	Valid VEX response IDs and names.	Vulnerabilities and VEX
organization { organizationRoles }	Roles in the organization and their permissions.	Manage Users and Roles
organization { users }	Members, their roles, and invitation status.	Manage Users and Roles
organization { samlConfig }	The organization's SSO (SAML) configuration.	Manage Users and Roles

Key fields on sbom

The sbom query resolves a version. Useful fields on it:

Field	Description
id	The version ID (sbomId).
projectVersion	The version string, for example 3.0.2.
vulnRunStatus	Vulnerability scan status. FINISHED when done.
primaryComponent { name version }	The component the SBOM describes.
sbomParts { id part { ... } }	The versions attached as direct parts. See Group Products with Parts.
deepParts { ... }	The full nested tree of parts.
authors { id name email phone }	SBOM authors.
suppliers { ... }	SBOM suppliers.
components(sbomId, first, after, search)	Paginated components in the SBOM.
vulns(sbomId, first, after)	Paginated vulnerabilities.
download(sbomId, ...)	The SBOM file. See Download.

The sbom query also accepts projectName, projectGroupName, and versionName as an alternative to projectId and sbomId.

Mutations

Mutation	Purpose	Guide
sbomUpload	Upload an SBOM file as a new version.	Upload an SBOM
authorCreate	Add an author to a version.	Edit SBOM Metadata
authorUpdate	Change an existing author.	Edit SBOM Metadata
authorDelete	Remove an author.	Edit SBOM Metadata
sbomSupplierCreate	Add a supplier to a version.	Edit SBOM Metadata
sbomSupplierUpdate	Change an existing supplier.	Edit SBOM Metadata
sbomSupplierDelete	Remove a supplier.	Edit SBOM Metadata
sbomPartCreate	Attach a version to another version as a part.	Group Products with Parts
sbomPartDelete	Remove a part from a version.	Group Products with Parts
componentUpdate	Change a component's fields.	Edit a Component
compSupplierCreate	Add a supplier to a component.	Edit a Component
componentVexUpdate	Set VEX on one component vulnerability.	Vulnerabilities and VEX
componentVexBulkUpdate	Set VEX on many vulnerabilities at once.	Vulnerabilities and VEX
organizationUserInvite	Invite a user and assign a role.	Manage Users and Roles
organizationUserUpdate	Change the role a user holds.	Manage Users and Roles
organizationUserRemove	Remove a user from the organization.	Manage Users and Roles
organizationRoleCreate	Create a custom role (Enterprise).	Manage Users and Roles
organizationRoleUpdate	Change a role's permissions (Enterprise).	Manage Users and Roles
organizationRoleBulkApply	Assign a role to many users at once (Enterprise).	Manage Users and Roles
organizationRoleDelete	Delete a custom role (Enterprise).	Manage Users and Roles
samlConfigCreate	Set up SSO from IdP metadata (Enterprise).	Manage Users and Roles
samlConfigUpdate	Change or disable SSO (Enterprise).	Manage Users and Roles
samlConfigDelete	Remove the SSO configuration (Enterprise).	Manage Users and Roles

Mutation response pattern

Every mutation returns an errors list. An empty list means success. Most also return the object they changed. Always request errors and check it. See Errors.

mutation {
  authorCreate(input: { sbomId: "...", name: "..." }) {
    author { id name }
    errors
  }
}

Looking for the rest of the schema?

These docs cover SBOM lifecycle operations. The platform exposes more, for example policies, automation rules, and integrations. If you need an operation that is not listed here, contact [e-mail].