Export an SBOM

A software bill of materials (SBOM) lists what a unit is made of. BuildTrace produces one for any unit as a CycloneDX document, version 1.5.

You need the reports:read permission.

What it contains

The SBOM reflects the unit’s current contents. This is the as-maintained view: if you replaced a sub-assembly, the SBOM shows the new one, not the one the unit was built with. See Serials.

The document has:

• The unit itself, with its part name, revision and serial number.
• The serialized parts currently built into the unit.
• The raw materials and lots that went into it, from its as-built record.
• Its firmware: the latest version recorded for each component type. Firmware reports for component types BuildTrace does not know are not included.
• Its certificate references: the unit’s test, conformance, calibration and third-party attachments. Each one is a link with a file name and a SHA-256 checksum. The links stop working after 15 minutes, so download the files soon after you export.
• A dependency list that shows the unit depends on all of these.

Export from the app

1. Open the unit’s serial page.
2. Select Export SBOM. The button is missing if you do not have reports:read.
3. Read the SBOM viewer. It shows the document’s details, the component tree and the certificate links.
4. Select Download .json. The file is named sbom-<serial number>.cdx.json.

Export through the API

GET /api/serials/{id}/sbom

The {id} is the serial’s ID, not its serial number. Send a bearer token with the reports:read scope. The API base is your BuildTrace app address followed by /api.

curl "https://app.buildtrace.eu/api/serials/$SERIAL_ID/sbom" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -o sbom.cdx.json

The response is the raw CycloneDX JSON document, not a wrapper object. It starts like this:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": { "timestamp": "2026-10-30T09:00:00Z", "component": { "type": "device" } },
  "components": [],
  "dependencies": []
}

This route is not in the generated API reference. It returns a ready-made document instead of a typed object, so it is documented here.

An ID that is not a valid UUID gets 400. A unit that does not exist in your workspace gets 404.