> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SBOM API

export const GCell = ({children, className}) => <div className={`grid-table-cell ${className || ""}`} role="cell">
    {children}
  </div>;

export const GTH = ({children, className}) => <div className={`grid-table-th ${className || ""}`} role="columnheader">
    {children}
  </div>;

export const GRow = ({children}) => <div className="grid-table-row" role="row">{children}</div>;

export const GBody = ({children}) => <div className="grid-table-body" role="rowgroup">{children}</div>;

export const GHead = ({children}) => <div className="grid-table-head" role="rowgroup">{children}</div>;

export const GTable = ({children, className, cols}) => <div className={`grid-table not-prose overflow-hidden rounded-2xl ${className || ""}`} style={{
  "--grid-table-cols": cols
}} role="table">
    {children}
  </div>;

export const Comments = ({children}) => {
  return <div class="my-4 px-5 py-4 overflow-hidden rounded-2xl flex gap-3 border border-zinc-500/20 bg-zinc-50/50 dark:border-zinc-500/30 dark:bg-zinc-500/10" data-callout-type="comments">
      <div class="w-4">
        <svg width="14" height="14" viewBox="0 0 640 640" fill="currentColor" xmlns="http://www.w3.org/2000/svg" class="w-5 h-5" aria-label="Comments">
            <path d="M320 112C434.9 112 528 205.1 528 320C528 434.9 434.9 528 320 528C205.1 528 112 434.9 112 320C112 205.1 205.1 112 320 112zM320 576C461.4 576 576 461.4 576 320C576 178.6 461.4 64 320 64C178.6 64 64 178.6 64 320C64 461.4 178.6 576 320 576zM280 400C266.7 400 256 410.7 256 424C256 437.3 266.7 448 280 448L360 448C373.3 448 384 437.3 384 424C384 410.7 373.3 400 360 400L352 400L352 312C352 298.7 341.3 288 328 288L280 288C266.7 288 256 298.7 256 312C256 325.3 266.7 336 280 336L304 336L304 400L280 400zM320 256C337.7 256 352 241.7 352 224C352 206.3 337.7 192 320 192C302.3 192 288 206.3 288 224C288 241.7 302.3 256 320 256z" />
        </svg>
      </div>
      <div class="text-sm prose min-w-0 w-full">
        {children}
      </div>
    </div>;
};

The SBOM API provides programmatic access to the software bills of materials (SBOMs) that Anaconda produces for conda packages on the `main` and `main-x` channels. Use it to pull compliance artifacts directly into your procurement, audit, and regulatory reporting workflows instead of requesting them manually. Look up a package by its SHA256 hash, or by its name, channel, platform, and version together.

The API serves existing SBOMs as SPDX JSON documents. It does not generate, transform, or enrich SBOM content. For more information about SBOMs and how to view them in Anaconda Platform, see [SBOMs](/docs/anaconda-platform/user/sbom/sboms).

<Note>
  The SBOM API is available to members of organizations with a Business subscription.
</Note>

## Authentication

### Prerequisites

Before you can use the SBOM API, you must:

* Have a seat in an organization with an active Business plan. If you have not been assigned a seat, contact your organization administrator. For more information, see [Members](/docs/anaconda-platform/admin/members#assigning-organization-seats).
* Have an organization access token installed on your machine, which grants access to the channels containing SBOMs. For more information, see [Tokens](/docs/anaconda-platform/user/tokens).

### Obtaining an API key

The SBOM API authenticates with an API key associated with your user account. You can create an API key in your account settings or at the command line. For more information, see [API keys](/docs/anaconda-platform/user/api-keys).

To create an API key at the command line:

1. Install the `anaconda-auth` package:

   ```sh theme={null}
   conda install anaconda-auth
   ```

2. Log in to Anaconda:

   ```sh theme={null}
   anaconda auth login
   ```

3. Print your API key:

   ```sh theme={null}
   anaconda auth api-key
   ```

For more information about the `api-key` command, see the [anaconda auth api-key](/docs/cli-reference/anaconda-auth/commands/api-key) command reference.

### Making authenticated requests

Include the key in the `Authorization` header:

<CodeGroup>
  ```sh Command Prompt theme={null}
  curl --request GET ^
      --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" ^
      --header "Authorization: Bearer <API_KEY>"
  ```

  ```powershell PowerShell theme={null}
  Invoke-WebRequest -Method GET `
      -Uri "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" `
      -Headers @{"Authorization" = "Bearer <API_KEY>"}
  ```

  ```sh Terminal theme={null}
  curl --request GET \
      --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" \
      --header "Authorization: Bearer <API_KEY>"
  ```
</CodeGroup>

<Comments>
  Replace \<PACKAGE\_SHA256> with the SHA256 hash of the package.<br />
  Replace \<API\_KEY> with your API key.
</Comments>

## Base URL

```
https://repo.anaconda.cloud
```

## Endpoints

<GTable cols="12% 55% 33%">
  <GHead>
    <GRow>
      <GTH>Method</GTH>
      <GTH>Path</GTH>
      <GTH>Description</GTH>
    </GRow>
  </GHead>

  <GBody>
    <GRow>
      <GCell>`GET`</GCell>
      <GCell>`/repo/{channel_name}/sboms/sha256/{package_sha256}`</GCell>
      <GCell>Retrieve an SBOM by the package's SHA256 hash</GCell>
    </GRow>

    <GRow>
      <GCell>`GET`</GCell>
      <GCell>`/repo/{channel_name}/sboms/by-properties/{artifact_family}/{common_name}/{platform}/{version}`</GCell>
      <GCell>Retrieve an SBOM by the package's properties</GCell>
    </GRow>
  </GBody>
</GTable>

The `channel_name` path parameter accepts only `main` and `main-x`. Requests for any other channel receive a `400` error.

## Viewing and downloading SBOMs

Both endpoints return the SBOM as JSON in the response body by default. To receive the SBOM as a downloadable file instead, set the `mode` query parameter to `download`. The response includes a `Content-Disposition` header that provides the SBOM's filename.

To download an SBOM with the filename Anaconda has on file, use `mode=download` with curl's `--remote-name` and `--remote-header-name` options:

<CodeGroup>
  ```sh Command Prompt theme={null}
  curl --request GET ^
      --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" ^
      --header "Authorization: Bearer <API_KEY>" ^
      --remote-name --remote-header-name
  ```

  ```powershell PowerShell theme={null}
  $response = Invoke-WebRequest -Method GET `
      -Uri "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" `
      -Headers @{"Authorization" = "Bearer <API_KEY>"}
  $filename = ($response.Headers["Content-Disposition"] -split "filename=")[1].Trim('"')
  [System.IO.File]::WriteAllBytes($filename, $response.Content)
  ```

  ```sh Terminal theme={null}
  curl --request GET \
      --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" \
      --header "Authorization: Bearer <API_KEY>" \
      --remote-name --remote-header-name
  ```
</CodeGroup>

<Comments>
  Replace \<PACKAGE\_SHA256> with the SHA256 hash of the package.<br />
  Replace \<API\_KEY> with your API key.
</Comments>