# 适用于软件物料清单 (SBOM) 的 REST API 终结点

使用 REST API 导出存储库的软件材料清单 (SBOM)。

如果至少具有对存储库的读取访问权限，可以通过 UI 或 GitHub REST API 将存储库的依赖项图导出为 SPDX 兼容的软件材料清单（SBOMGitHub）。 有关详细信息，请参阅“[导出存储库的软件物料清单](/zh/enterprise-server@3.22/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/export-dependencies-as-sbom)”。

本文提供有关 REST API 终结点的详细信息。

> \[!NOTE]
> GitHub Enterprise Server 不检索依赖项的许可信息，也不计算有关依赖项、存储库和依赖于存储库的包的信息。 响应中不会填充这些字段。

> \[!NOTE]
> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.

## Export a software bill of materials (SBOM) for a repository.

```
GET /repos/{owner}/{repo}/dependency-graph/sbom
```

Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

### Parameters

#### Headers

* **`accept`** (string)
  Setting to `application/vnd.github+json` is recommended.

#### Path and query parameters

* **`owner`** (string) (required)
  The account owner of the repository. The name is not case sensitive.

* **`repo`** (string) (required)
  The name of the repository without the .git extension. The name is not case sensitive.

### HTTP response status codes

* **200** - OK

* **403** - Forbidden

* **404** - Resource not found

### Code examples

#### Example

**Request:**

```curl
curl -L \
  -X GET \
  http(s)://HOSTNAME/api/v3/repos/OWNER/REPO/dependency-graph/sbom
```

**Response schema (Status: 200):**

* `sbom`: required, object:
  * `SPDXID`: required, string
  * `spdxVersion`: required, string
  * `comment`: string
  * `creationInfo`: required, object:
    * `created`: required, string
    * `creators`: required, array of string
  * `name`: required, string
  * `dataLicense`: required, string
  * `documentNamespace`: required, string
  * `packages`: required, array of objects:
    * `SPDXID`: string
    * `name`: string
    * `versionInfo`: string
    * `downloadLocation`: string
    * `filesAnalyzed`: boolean
    * `licenseConcluded`: string
    * `licenseDeclared`: string
    * `supplier`: string
    * `copyrightText`: string
    * `externalRefs`: array of objects:
      * `referenceCategory`: required, string
      * `referenceLocator`: required, string
      * `referenceType`: required, string
  * `relationships`: array of objects:
    * `relationshipType`: string
    * `spdxElementId`: string
    * `relatedSpdxElement`: string