SbomArtifact

No description

type SbomArtifact {
  asset: Asset!
  branch: Branch
  childDependencies(
    limit: Int = 50
  ): [SbomArtifact!]!
  createdAt: ISO8601DateTime!
  dependencyGraphAvailable: Boolean!
  dependencyKind: SbomDependencyKind!
  dependencyPaths(
    maxPaths: Int = 3
  ): [[SbomArtifact!]!]!
  depth: Int
  id: ID!
  issuesBySeverity: JSON
  license: String
  name: String!
  packageManager: String
  parentDependencies: [SbomArtifact!]!
  parentDependency: SbomArtifact
  scopeId: ID!
  technology: String
  updatedAt: ISO8601DateTime!
  version: String
}

Fields

SbomArtifact.asset ● Asset! non-null object

The associated asset

SbomArtifact.branch ● Branch object

The branch this artifact belongs to; the asset's default branch for a repository artifact predating branch stamping; null for a branch-agnostic (legacy/cloud) artifact

SbomArtifact.childDependencies ● [SbomArtifact!]! non-null object

Components this one pulls in, ordered by (name, version)

SbomArtifact.childDependencies.limit ● Int scalar

Maximum children to return (capped at 200)

SbomArtifact.createdAt ● ISO8601DateTime! non-null scalar

Date when the SBOM was created

SbomArtifact.dependencyGraphAvailable ● Boolean! non-null scalar

Whether this component is positioned by its SBOM's dependency graph. False when the generating tool supplied no graph, or supplied one that never mentions this component — in both cases dependencyKind is UNKNOWN

SbomArtifact.dependencyKind ● SbomDependencyKind! non-null enum

DIRECT, TRANSITIVE, or UNKNOWN when the SBOM carried no dependency graph

SbomArtifact.dependencyPaths ● [[SbomArtifact!]!]! non-null object

Routes from a root down to this component, root first and self last, shortest first. A DIRECT component returns a single path holding only itself; an UNKNOWN one returns nothing

SbomArtifact.dependencyPaths.maxPaths ● Int scalar

Maximum paths to return (capped at 10)

SbomArtifact.depth ● Int scalar

Length of the primary path to a root: 0 for DIRECT, >= 1 for TRANSITIVE, null for UNKNOWN or for a component in a dependency cycle with no route to a root

SbomArtifact.id ● ID! non-null scalar

SbomArtifact.issuesBySeverity ● JSON scalar

Returns a JSON object containing vulnerabilities grouped by severity.

The structure of the returned JSON is as follows: { "severity": { "count": Integer, # The number of vulnerabilities with this severity "issue_ids": [Integer], # A list of vulnerability IDs associated with this severity "cve": String # The CVE associated with these vulnerabilities, if available } }

SbomArtifact.license ● String scalar

The license associated with the package

SbomArtifact.name ● String! non-null scalar

The name of the package

SbomArtifact.packageManager ● String scalar

The package manager used (e.g., npm, pip)

SbomArtifact.parentDependencies ● [SbomArtifact!]! non-null object

Every component that pulls this one in. Empty for both DIRECT and UNKNOWN — read dependencyKind to tell them apart

SbomArtifact.parentDependency ● SbomArtifact object

The parent on this component's primary path. One parent only — a component can have several; use parentDependencies for the full set

SbomArtifact.scopeId ● ID! non-null scalar

The ID of the associated company

SbomArtifact.technology ● String scalar

The technology or framework used for the package

SbomArtifact.updatedAt ● ISO8601DateTime! non-null scalar

Date when the SBOM was last updated

SbomArtifact.version ● String scalar

The version of the package

Member Of

SbomArtifact object ● SbomComponentsPaginatedResponse object ● SbomDependencyGraph object ● ScaFindingDetail object