Skip to main content
GET
Get SBOM by SHA256
Use this endpoint when you already have the package’s SHA256 hash. This is the most precise lookup method, as each hash maps to exactly one package artifact.
To find a package’s SHA256 hash, look up the package entry in the channel’s repodata.json. The conda search --info command displays an MD5 hash but does not include the SHA256 value.
A 404 response can mean one of two things: either no package with that SHA256 hash exists on the requested channel, or the package exists but Anaconda does not have an SBOM on file for it. Check the response message field to distinguish between them.

Authorizations

Authorization
string
header
required

Bearer token authentication with your Anaconda API key. Create a key in your account settings or with the anaconda auth api-key command.

See the Getting started page for the full authentication flow.

Path Parameters

channel_name
enum<string>
required

The channel that contains the package. The SBOM API serves the main and main-x channels only.

Available options:
main,
main-x
package_sha256
string
required

The SHA256 hash of the package artifact. You can find this value in the channel's repodata.json under the package entry.

Pattern: ^[0-9a-f]{64}$

Query Parameters

mode
enum<string>
default:view

Use view to receive the SBOM as JSON in the response body. Use download to receive the SBOM as a byte stream with a Content-Disposition header that provides the SBOM's filename.

Available options:
view,
download

Response

The package's SBOM. The response is JSON in view mode and a byte stream in download mode.

An SPDX 2.2.1 JSON document.