> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Export a software bill of materials

> Returns an SBOM document as text in CycloneDX JSON or XML, SPDX JSON or CSV, with a filename and content type. Components and known vulnerabilities come from each selected repository's latest completed scan, or from one scan when scan_id is set.

> [tab] CLI Tool
>
> ```bash
> coderabbit api request "/security/sbom/export?format=$FORMAT"
> ```
>
> To install and sign in to the CLI, see [Call from the CLI](https://docs.coderabbit.ai/api/cli.md).

> [tab] MCP Server
>
> An agent connected to the [CodeRabbit MCP server](https://docs.coderabbit.ai/api/mcp.md) runs this operation as the `export_security_sbom` tool. The connection selects the organization, so the arguments have no `org_id` or `org_name`.
>
> ```json
> {
>   "method": "tools/call",
>   "params": {
>     "name": "export_security_sbom",
>     "arguments": {
>       "format": "cyclonedx-json"
>     }
>   }
> }
> ```


## OpenAPI

````yaml /openapi.json get /v1/security/sbom/export
openapi: 3.0.0
info:
  title: CodeRabbit API
  version: 1.0.0
  description: >-
    Read and manage CodeRabbit reviews, coding tasks, Verify, Triage, security
    findings, Knowledge Base, configuration, and users for your organization.
servers:
  - url: https://api.coderabbit.ai
    description: US region
  - url: https://api.eu.coderabbit.ai
    description: EU region
security:
  - ApiKeyAuth: []
tags:
  - name: Organizations and repositories
  - name: Pull requests and reviews
  - name: Coding Agent
  - name: Coding environments
  - name: Verify
  - name: Triage
  - name: Security
  - name: Knowledge Base
  - name: Automations
  - name: Reports
  - name: Configuration
  - name: Connections
  - name: Users and roles
  - name: Usage and metrics
paths:
  /v1/security/sbom/export:
    get:
      tags:
        - Security
      summary: Export a software bill of materials
      description: >-
        Returns an SBOM document as text in CycloneDX JSON or XML, SPDX JSON or
        CSV, with a filename and content type. Components and known
        vulnerabilities come from each selected repository's latest completed
        scan, or from one scan when scan_id is set.
      operationId: export_security_sbom
      parameters:
        - name: org_id
          in: query
          required: false
          schema:
            type: string
            minLength: 1
            description: >-
              Organization for a workspace key: the Git-provider organization ID
              (scope.provider_organization_id) or the CodeRabbit organization ID
              (scope.id, or id from list organizations). Supply either org_id or
              org_name, never both. Omit for organization keys and MCP
              connections.
          allowEmptyValue: true
          allowReserved: true
        - name: org_name
          in: query
          required: false
          schema:
            type: string
            pattern: ^[A-Za-z0-9][A-Za-z0-9-]{0,38}$
            description: >-
              GitHub organization login, such as coderabbitai, not its display
              name. Matched case-insensitively within the authenticated
              workspace. Supply either org_name or org_id, never both; omit for
              organization keys and MCP connections.
          allowEmptyValue: true
          allowReserved: true
        - name: repository_ids
          in: query
          required: false
          schema:
            type: array
            minItems: 1
            maxItems: 1000
            items:
              type: string
              minLength: 1
              maxLength: 255
          style: form
          explode: true
          allowEmptyValue: true
          allowReserved: true
        - name: scan_id
          in: query
          required: false
          schema:
            type: string
            format: uuid
          allowEmptyValue: true
          allowReserved: true
        - name: format
          in: query
          required: true
          schema:
            enum:
              - cyclonedx-json
              - cyclonedx-xml
              - spdx-json
              - csv
            type: string
          allowEmptyValue: true
          allowReserved: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  filename:
                    type: string
                  contentType:
                    type: string
                  content:
                    type: string
                required:
                  - filename
                  - contentType
                  - content
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - invalid_request
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - unauthenticated
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - forbidden
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '404':
          description: Not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - not_found
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - head_changed
                          - conflict
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '412':
          description: Precondition failed
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - precondition_failed
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '413':
          description: Content too large
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - payload_too_large
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - rate_limit_exceeded
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - internal_error
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                          - unavailable
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-coderabbitai-api-key
      description: >-
        See [Authentication](/api/authentication) for the key types and where to
        create a key.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.