> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get SBOM by SHA256

> Returns the SBOM that Anaconda has on file for the package with the given SHA256 hash.

Use this endpoint when you already have the package's SHA256 hash. This is the most precise lookup method, as each hash maps to exactly one package artifact.

<Tip>
  To find a package's SHA256 hash, look up the package entry in the channel's `repodata.json`. The `conda search --info` command displays an MD5 hash but does not include the SHA256 value.
</Tip>

<Note>
  A `404` response can mean one of two things: either no package with that SHA256 hash exists on the requested channel, or the package exists but Anaconda does not have an SBOM on file for it. Check the response `message` field to distinguish between them.
</Note>


## OpenAPI

````yaml anaconda-platform/user/sbom/sbom_api.json GET /repo/{channel_name}/sboms/sha256/{package_sha256}
openapi: 3.1.0
info:
  title: SBOM API
  version: 0.1.0
servers:
  - url: https://repo.anaconda.cloud
    description: Anaconda Cloud repository
security: []
paths:
  /repo/{channel_name}/sboms/sha256/{package_sha256}:
    get:
      tags:
        - sboms
      summary: Get SBOM by SHA256
      description: >-
        Returns the SBOM that Anaconda has on file for the package with the
        given SHA256 hash.
      operationId: get_sbom_by_sha256
      parameters:
        - in: path
          name: channel_name
          required: true
          schema:
            type: string
            enum:
              - main
              - main-x
          description: >-
            The channel that contains the package. The SBOM API serves the
            `main` and `main-x` channels only.
        - in: path
          name: package_sha256
          required: true
          schema:
            type: string
            pattern: ^[0-9a-f]{64}$
          description: >-
            The SHA256 hash of the package artifact. You can find this value in
            the channel's `repodata.json` under the package entry.
        - in: query
          name: mode
          required: false
          schema:
            type: string
            enum:
              - view
              - download
            default: view
          description: >-
            Use `view` to receive the SBOM as JSON in the response body. Use
            `download` to receive the SBOM as a byte stream with a
            `Content-Disposition` header that provides the SBOM's filename.
      responses:
        '200':
          description: >-
            The package's SBOM. The response is JSON in `view` mode and a byte
            stream in `download` mode.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SBOM'
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: >-
            The channel is not `main` or `main-x`, or the SHA256 value is
            malformed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: 400
                code: bad-request
                message: Invalid channel name. Only 'main' and 'main-x' are supported.
        '401':
          description: No API key was provided, or the API key is invalid or expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: 401
                code: unauthorized
                message: Authentication required.
        '403':
          description: Your account does not have an active Business subscription.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: 403
                code: forbidden
                message: User does not have an active premium subscription!
        '404':
          description: >-
            No package exists with the requested SHA256 hash, or the package
            exists but Anaconda has no SBOM on file for it.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: 404
                code: artifact-not-found-by-sha256
                message: No artifact found with the given SHA256 hash.
      security:
        - API Key: []
components:
  schemas:
    SBOM:
      type: object
      description: An SPDX 2.2.1 JSON document.
      example:
        spdxVersion: SPDX-2.2
        dataLicense: CC0-1.0
        SPDXID: SPDXRef-DOCUMENT
        name: numpy-1.21.2-py39hd8d4704_0.conda
        documentNamespace: >-
          https://repo.anaconda.com/spdx/main/linux-64/numpy-1.21.2-py39hd8d4704_0.conda
        creationInfo:
          creators:
            - 'Organization: Anaconda, Inc.'
          created: '2024-05-07T20:09:26Z'
        packages:
          - ...
        files:
          - ...
        relationships:
          - ...
    ErrorResponse:
      type: object
      description: The metadata contained in an error response.
      properties:
        status:
          type: integer
          description: The HTTP status code.
        code:
          type: string
          description: A machine-readable error code.
        message:
          type: string
          description: A human-readable description of the error.
  securitySchemes:
    API Key:
      bearerFormat: API Key
      description: >-
        Bearer token authentication with your Anaconda API key. Create a key in
        your account settings or with the `anaconda auth api-key` command.


        See the [Getting started](/anaconda-platform/user/sbom/sbom-api) page
        for the full authentication flow.
      scheme: bearer
      type: http

````