Skip to main content
GET
Get SBOM by package properties
Use this endpoint when you do not have the package’s SHA256 hash and want to look it up by its name, platform, and version instead.
This endpoint currently only works for conda packages (artifact_family = conda) which includes .conda and .tar.bz2 artifacts, and is only enabled on the main and main-x channels.
.tar.bz2 and .conda versions of the package are treated as the same package for SBOM purposes if all other properties (including build) are identical.
A channel can contain multiple builds of the same package version. For example, a package might have separate builds for different Python versions. When the provided properties match more than one package, the API returns a 404 response asking you to narrow your query. Add the build query parameter with the package’s build string to resolve the ambiguity.You can find the build string in the package’s filename. For example, the build string of numpy-1.21.2-py39hd8d4704_0.tar.bz2 is py39hd8d4704_0.
If no packages were found that match the provided properties, the API returns a 404. In these cases, try using the Get SBOM by SHA256 endpoint instead.

Authorizations

Authorization
string
header
required

Bearer token authentication with your Anaconda API key. Create a key in your account settings or with the anaconda auth api-key command.

See the Getting started page for the full authentication flow.

Path Parameters

channel_name
enum<string>
required

The channel that contains the package. The SBOM API serves the main and main-x channels only.

Available options:
main,
main-x
artifact_family
enum<string>
required

The package's artifact family. For conda packages, this is conda.

Available options:
conda
common_name
string
required

The package's name, for example numpy or _py-xgboost-mutex.

platform
string
required

The package's platform subdirectory, for example linux-64, win-64, or noarch.

version
string
required

The package's version, for example 1.21.2.

Query Parameters

build
string

The package's build string, for example py39hd8d4704_0. The build string is part of the package's filename. For example, the build string of numpy-1.21.2-py39hd8d4704_0.tar.bz2 is py39hd8d4704_0.

Required when the package's other properties match more than one package.

mode
enum<string>
default:view

Use view to receive the SBOM as JSON in the response body. Use download to receive the SBOM as a byte stream with a Content-Disposition header that provides the SBOM's filename.

Available options:
view,
download

Response

The package's SBOM. The response is JSON in view mode and a byte stream in download mode.

An SPDX 2.2.1 JSON document.