> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Get SBOM by Package Properties
> Returns the SBOM that Anaconda has on file for the package identified by its channel, artifact family, name, platform, and version.
Use this endpoint when you do not have the package's SHA256 hash and want to look it up by its name, platform, and version instead.
This endpoint currently only works for conda packages (`artifact_family = conda`) which includes `.conda` and `.tar.bz2` artifacts, and is only enabled on the `main` and `main-x` channels.
***
`.tar.bz2` and `.conda` versions of the package are treated as the same package for SBOM purposes if all other properties (including build) are identical.
***
A channel can contain multiple builds of the same package version. For example, a package might have separate builds for different Python versions. When the provided properties match more than one package, the API returns a `404` response asking you to narrow your query. Add the `build` query parameter with the package's build string to resolve the ambiguity.
You can find the build string in the package's filename. For example, the build string of `numpy-1.21.2-py39hd8d4704_0.tar.bz2` is `py39hd8d4704_0`.
If no packages were found that match the provided properties, the API returns a `404`. In these cases, try using the [Get SBOM by SHA256](/docs/anaconda-platform/user/sbom/get-sbom-by-sha256) endpoint instead.
## OpenAPI
````yaml anaconda-platform/user/sbom/sbom_api.json GET /repo/{channel_name}/sboms/by-properties/{artifact_family}/{common_name}/{platform}/{version}
openapi: 3.1.0
info:
title: SBOM API
version: 0.1.0
servers:
- url: https://repo.anaconda.cloud
description: Anaconda Cloud repository
security: []
paths:
/repo/{channel_name}/sboms/by-properties/{artifact_family}/{common_name}/{platform}/{version}:
get:
tags:
- sboms
summary: Get SBOM by package properties
description: >-
Returns the SBOM that Anaconda has on file for the package identified by
its channel, artifact family, name, platform, and version.
operationId: get_sbom_by_properties
parameters:
- in: path
name: channel_name
required: true
schema:
type: string
enum:
- main
- main-x
description: >-
The channel that contains the package. The SBOM API serves the
`main` and `main-x` channels only.
- in: path
name: artifact_family
required: true
schema:
type: string
enum:
- conda
description: The package's artifact family. For conda packages, this is `conda`.
- in: path
name: common_name
required: true
schema:
type: string
description: The package's name, for example `numpy` or `_py-xgboost-mutex`.
- in: path
name: platform
required: true
schema:
type: string
description: >-
The package's platform subdirectory, for example `linux-64`,
`win-64`, or `noarch`.
- in: path
name: version
required: true
schema:
type: string
description: The package's version, for example `1.21.2`.
- in: query
name: build
required: false
schema:
type: string
description: >-
The package's build string, for example `py39hd8d4704_0`. The build
string is part of the package's filename. For example, the build
string of `numpy-1.21.2-py39hd8d4704_0.tar.bz2` is `py39hd8d4704_0`.
Required when the package's other properties match more than one
package.
- in: query
name: mode
required: false
schema:
type: string
enum:
- view
- download
default: view
description: >-
Use `view` to receive the SBOM as JSON in the response body. Use
`download` to receive the SBOM as a byte stream with a
`Content-Disposition` header that provides the SBOM's filename.
responses:
'200':
description: >-
The package's SBOM. The response is JSON in `view` mode and a byte
stream in `download` mode.
content:
application/json:
schema:
$ref: '#/components/schemas/SBOM'
application/octet-stream:
schema:
type: string
format: binary
'400':
description: The channel is not `main` or `main-x`.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
status: 400
code: bad-request
message: Invalid channel name. Only 'main' and 'main-x' are supported.
'401':
description: No API key was provided, or the API key is invalid or expired.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
status: 401
code: unauthorized
message: Authentication required.
'403':
description: Your account does not have an active Business subscription.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
status: 403
code: forbidden
message: User does not have an active premium subscription!
'404':
description: >-
No package matches the requested properties, the properties match
more than one package, or no SBOM is on file for the matching
package.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
status: 404
code: artifact-not-found
message: >-
Artifact not found in main with properties name = numpy,
platform = linux-64, version = 1.21.3
security:
- API Key: []
components:
schemas:
SBOM:
type: object
description: An SPDX 2.2.1 JSON document.
example:
spdxVersion: SPDX-2.2
dataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
name: numpy-1.21.2-py39hd8d4704_0.conda
documentNamespace: >-
https://repo.anaconda.com/spdx/main/linux-64/numpy-1.21.2-py39hd8d4704_0.conda
creationInfo:
creators:
- 'Organization: Anaconda, Inc.'
created: '2024-05-07T20:09:26Z'
packages:
- ...
files:
- ...
relationships:
- ...
ErrorResponse:
type: object
description: The metadata contained in an error response.
properties:
status:
type: integer
description: The HTTP status code.
code:
type: string
description: A machine-readable error code.
message:
type: string
description: A human-readable description of the error.
securitySchemes:
API Key:
bearerFormat: API Key
description: >-
Bearer token authentication with your Anaconda API key. Create a key in
your account settings or with the `anaconda auth api-key` command.
See the [Getting started](/anaconda-platform/user/sbom/sbom-api) page
for the full authentication flow.
scheme: bearer
type: http
````