CVEium
Sign Up

SBOM Download API

Download the original SBOM file for a release via the authenticated API.

The SBOM download endpoint provides programmatic access to the original SBOM files uploaded for your releases. For the full SBOM API including upload, scanning, and vulnerability listing, see SBOMs & Scanning.

Download an SBOM

GET /api/sboms/{id}/download

Scope: sboms:read

curl -H "Authorization: Bearer cvk_YOUR_KEY" \
  https://cis.cveium.com/api/sboms/{sbomId}/download

Access is controlled by Row Level Security — you can only download SBOMs for releases belonging to your team.

Response headers

HeaderDescription
Content-Typeapplication/vnd.cyclonedx+json or application/spdx+json
Content-Dispositionattachment; filename="original-filename.json"
X-Content-HashSHA-256 hash for integrity verification (if available)

Integrity verification

To verify the downloaded SBOM has not been modified:

  1. Download the file using this endpoint
  2. Compute the SHA-256 hash of the downloaded content
  3. Compare it with the X-Content-Hash response header

If the hashes match, the file is identical to what was originally uploaded.