> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SBOM API

The SBOM API provides programmatic access to the software bills of materials (SBOMs) that Anaconda produces for conda packages on the `main` and `main-x` channels. Use it to pull compliance artifacts directly into your procurement, audit, and regulatory reporting workflows instead of requesting them manually. Look up a package by its SHA256 hash, or by its name, channel, platform, and version together.

The API serves existing SBOMs as SPDX JSON documents. It does not generate, transform, or enrich SBOM content. For more information about SBOMs and how to view them in Anaconda Platform, see [SBOMs](https://anaconda.com/docs/anaconda-platform/user/sbom/sboms).

> [!NOTE]
>
> The SBOM API is available to members of organizations with a Business subscription.

## Authentication

### Prerequisites

Before you can use the SBOM API, you must:

* Have a seat in an organization with an active Business plan. If you have not been assigned a seat, contact your organization administrator. For more information, see [Members](https://anaconda.com/docs/anaconda-platform/admin/members.md#assigning-organization-seats).
* Have an organization access token installed on your machine, which grants access to the channels containing SBOMs. For more information, see [Tokens](https://anaconda.com/docs/anaconda-platform/user/tokens.md).

### Obtaining an API key

The SBOM API authenticates with an API key associated with your user account. You can create an API key in your account settings or at the command line. For more information, see [API keys](https://anaconda.com/docs/anaconda-platform/user/api-keys.md).

To create an API key at the command line:

1. Install the `anaconda-auth` package:

   ```sh theme={null}
   conda install anaconda-auth
   ```

2. Log in to Anaconda:

   ```sh theme={null}
   anaconda auth login
   ```

3. Print your API key:

   ```sh theme={null}
   anaconda auth api-key
   ```

For more information about the `api-key` command, see the [anaconda auth api-key](https://anaconda.com/docs/cli-reference/anaconda-auth/commands/api-key.md) command reference.

### Making authenticated requests

Include the key in the `Authorization` header:

```sh Command Prompt theme={null}
curl --request GET ^
    --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" ^
    --header "Authorization: Bearer <API_KEY>"
```

```powershell PowerShell theme={null}
Invoke-WebRequest -Method GET `
    -Uri "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" `
    -Headers @{"Authorization" = "Bearer <API_KEY>"}
```

```sh Terminal theme={null}
curl --request GET \
    --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>" \
    --header "Authorization: Bearer <API_KEY>"
```

Comments

Replace \<PACKAGE\_SHA256> with the SHA256 hash of the package.\\

Replace \<API\_KEY> with your API key.

## Base URL

```
https://repo.anaconda.cloud
```

## Endpoints

Method

Path

Description

`GET`

`/repo/{channel_name}/sboms/sha256/{package_sha256}`

Retrieve an SBOM by the package's SHA256 hash

`GET`

`/repo/{channel_name}/sboms/by-properties/{artifact_family}/{common_name}/{platform}/{version}`

Retrieve an SBOM by the package's properties

The `channel_name` path parameter accepts only `main` and `main-x`. Requests for any other channel receive a `400` error.

## Viewing and downloading SBOMs

Both endpoints return the SBOM as JSON in the response body by default. To receive the SBOM as a downloadable file instead, set the `mode` query parameter to `download`. The response includes a `Content-Disposition` header that provides the SBOM's filename.

To download an SBOM with the filename Anaconda has on file, use `mode=download` with curl's `--remote-name` and `--remote-header-name` options:

```sh Command Prompt theme={null}
curl --request GET ^
    --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" ^
    --header "Authorization: Bearer <API_KEY>" ^
    --remote-name --remote-header-name
```

```powershell PowerShell theme={null}
$response = Invoke-WebRequest -Method GET `
    -Uri "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" `
    -Headers @{"Authorization" = "Bearer <API_KEY>"}
$filename = ($response.Headers["Content-Disposition"] -split "filename=")[1].Trim('"')
[System.IO.File]::WriteAllBytes($filename, $response.Content)
```

```sh Terminal theme={null}
curl --request GET \
    --url "https://repo.anaconda.cloud/repo/main/sboms/sha256/<PACKAGE_SHA256>?mode=download" \
    --header "Authorization: Bearer <API_KEY>" \
    --remote-name --remote-header-name
```

Comments

Replace \<PACKAGE\_SHA256> with the SHA256 hash of the package.\\

Replace \<API\_KEY> with your API key.