Export a software bill of materials
curl --request GET \
--url https://api.coderabbit.ai/v1/security/sbom/export \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/sbom/export"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/sbom/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"filename": "<string>",
"contentType": "<string>",
"content": "<string>"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}Export a software bill of materials
Returns an SBOM document as text in CycloneDX JSON or XML, SPDX JSON or CSV, with a filename and content type. Components and known vulnerabilities come from each selected repository’s latest completed scan, or from one scan when scan_id is set.
GET
/
v1
/
security
/
sbom
/
export
Export a software bill of materials
curl --request GET \
--url https://api.coderabbit.ai/v1/security/sbom/export \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/sbom/export"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/sbom/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"filename": "<string>",
"contentType": "<string>",
"content": "<string>"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}- CLI Tool
- MCP Server
coderabbit api request "/security/sbom/export?format=$FORMAT"
An agent connected to the CodeRabbit MCP server runs this operation as the
export_security_sbom tool. The connection selects the organization, so the arguments have no org_id or org_name.{
"method": "tools/call",
"params": {
"name": "export_security_sbom",
"arguments": {
"format": "cyclonedx-json"
}
}
}
Authorizations
See Authentication for the key types and where to create a key.
Query Parameters
Organization for a workspace key: the Git-provider organization ID (scope.provider_organization_id) or the CodeRabbit organization ID (scope.id, or id from list organizations). Supply either org_id or org_name, never both. Omit for organization keys and MCP connections.
Minimum string length:
1Was this page helpful?