Skip to main content
The SBOM API provides programmatic access to the software bills of materials (SBOMs) that Anaconda produces for conda packages on the main and main-x channels. Use it to pull compliance artifacts directly into your procurement, audit, and regulatory reporting workflows instead of requesting them manually. Look up a package by its SHA256 hash, or by its name, channel, platform, and version together. The API serves existing SBOMs as SPDX JSON documents. It does not generate, transform, or enrich SBOM content. For more information about SBOMs and how to view them in Anaconda Platform, see SBOMs.
The SBOM API is available to members of organizations with a Business subscription.

​
Authentication

​
Prerequisites

Before you can use the SBOM API, you must:
  • Have a seat in an organization with an active Business plan. If you have not been assigned a seat, contact your organization administrator. For more information, see Members.
  • Have an organization access token installed on your machine, which grants access to the channels containing SBOMs. For more information, see Tokens.

​
Obtaining an API key

The SBOM API authenticates with an API key associated with your user account. You can create an API key in your account settings or at the command line. For more information, see API keys. To create an API key at the command line:
  1. Install the anaconda-auth package:
  2. Log in to Anaconda:
  3. Print your API key:
For more information about the api-key command, see the anaconda auth api-key command reference.

​
Making authenticated requests

Include the key in the Authorization header:

​
Base URL

​
Endpoints

The channel_name path parameter accepts only main and main-x. Requests for any other channel receive a 400 error.

​
Viewing and downloading SBOMs

Both endpoints return the SBOM as JSON in the response body by default. To receive the SBOM as a downloadable file instead, set the mode query parameter to download. The response includes a Content-Disposition header that provides the SBOM’s filename. To download an SBOM with the filename Anaconda has on file, use mode=download with curl’s --remote-name and --remote-header-name options: