GitHub: Export a software bill of materials (SBOM) for a repository

← Dependency graph operations · Get started

Operation github.dependency_graph_export_sbom

Provider route: GET /repos/{owner}/{repo}/dependency-graph/sbom. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["dependencyGraph"]["dependencyGraphExportSbom"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.dependencyGraph.dependencyGraphExportSbom(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.dependency_graph.dependency_graph_export_sbom(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Export a software bill of materials (SBOM) for a repository — response body

Referenced models: Export a software bill of materials (SBOM) for a repository — response body

Schemas

Export a software bill of materials (SBOM) for a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root	A schema for the SPDX JSON format returned by the Dependency Graph.
sbom	object	Required within parent
sbom.SPDXID	string	Required within parent	The SPDX identifier for the SPDX document.
sbom.comment	string	Optional	An optional comment about the SPDX document.
sbom.creationInfo	object	Required within parent
sbom.creationInfo.created	string	Required within parent	The date and time the SPDX document was created.
sbom.creationInfo.creators	array	Required within parent	The tools that were used to generate the SPDX document.
sbom.creationInfo.creators[]	string	Each item
sbom.dataLicense	string	Required within parent	The license under which the SPDX document is licensed.
sbom.documentNamespace	string	Required within parent	The namespace for the SPDX document.
sbom.name	string	Required within parent	The name of the SPDX document.
sbom.packages	array	Required within parent
sbom.packages[]	object	Each item
sbom.packages[].SPDXID	string	Optional	A unique SPDX identifier for the package.
sbom.packages[].copyrightText	string	Optional	The copyright holders of the package, and any dates present with those notices, if available.
sbom.packages[].downloadLocation	string	Optional	The location where the package can be downloaded, or NOASSERTION if this has not been determined.
sbom.packages[].externalRefs	array	Optional
sbom.packages[].externalRefs[]	object	Each item
sbom.packages[].externalRefs[].referenceCategory	string	Required within parent	The category of reference to an external resource this reference refers to.
sbom.packages[].externalRefs[].referenceLocator	string	Required within parent	A locator for the particular external resource this reference refers to.
sbom.packages[].externalRefs[].referenceType	string	Required within parent	The category of reference to an external resource this reference refers to.
sbom.packages[].filesAnalyzed	boolean	Optional	Whether the package's file content has been subjected to analysis during the creation of the SPDX document.
sbom.packages[].licenseConcluded	string	Optional	The license of the package as determined while creating the SPDX document.
sbom.packages[].licenseDeclared	string	Optional	The license of the package as declared by its author, or NOASSERTION if this information was not available when the SPDX document was created.
sbom.packages[].name	string	Optional	The name of the package.
sbom.packages[].supplier	string	Optional	The distribution source of this package, or NOASSERTION if this was not determined.
sbom.packages[].versionInfo	string	Optional	The version of the package. If the package does not have an exact version specified, a version range is given.
sbom.relationships	array	Optional
sbom.relationships[]	object	Each item
sbom.relationships[].relatedSpdxElement	string	Optional	The SPDX identifier of the package that is the target of the relationship.
sbom.relationships[].relationshipType	string	Optional	The type of relationship between the two SPDX elements.
sbom.relationships[].spdxElementId	string	Optional	The SPDX identifier of the package that is the source of the relationship.
sbom.spdxVersion	string	Required within parent	The version of the SPDX specification that this document conforms to.

Policy, approvals and errors

SDK function policy ID: github.dependency_graph_export_sbom. Catalog operation: dependency-graph/export-sbom. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source