Skip to content
POST/api/v1/ai-sbom/generate

Generate fresh AI-BoM (synchronous)

Generates an AI Bill of Materials synchronously from caller-supplied manifests and lockfiles (package.json, package-lock, pnpm-lock ≤8 MB, poetry.lock/go.sum/pom.xml/gradle.lockfile ≤2 MB, requirements.txt/go.mod/build.gradle ≤500 KB), plus optional evalguardConfig, providerKeys (≤50), prompt/dataset registries and up to 1000 caller-supplied agents. Runs a supply-chain scan: live OSV.dev CVE lookups over the resolved transitive graph (disable with liveCveScan=false — the embedded CVE DB and typosquat detection still run), routed through safeFetch. `format` selects the body: json (default, EvalGuard-AIBOM), cyclonedx (CycloneDX 1.6) or spdx (SPDX 3.0), each returned with detectedComponents + supplyChain {typosquats, scan, dependencyResolution}. An unparseable lockfile is a 400 VALIDATION_ERROR, never a silent manifest-only BOM. Requires projectName. Unrelated to /security/ai-bom, which discovers cloud AI resources.

Authentication

Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.

Request body required

Example

{
  "projectName": "string",
  "projectVersion": "string",
  "format": "json",
  "pythonRequirements": "string",
  "pnpmLock": "string",
  "poetryLock": "string",
  "goSum": "string",
  "goMod": "string",
  "pomXml": "string",
  "buildGradle": "string",
  "gradleLockfile": "string",
  "providerKeys": [
    "string"
  ],
  "agents": [
    {
      "name": "string",
      "model": "string",
      "provider": "string",
      "tools": [
        "string"
      ],
      "guardrails": [
        "string"
      ],
      "source": "string"
    }
  ],
  "liveCveScan": false
}
Schema
{
  "application/json": {
    "schema": {
      "type": "object",
      "properties": {
        "projectName": {
          "type": "string",
          "minLength": 1,
          "maxLength": 200
        },
        "projectVersion": {
          "type": "string",
          "maxLength": 50
        },
        "format": {
          "type": "string",
          "enum": [
            "json",
            "cyclonedx",
            "spdx"
          ]
        },
        "packageJson": {},
        "pythonRequirements": {
          "type": "string",
          "maxLength": 500000
        },
        "packageLockJson": {},
        "pnpmLock": {
          "type": "string",
          "maxLength": 8000000
        },
        "poetryLock": {
          "type": "string",
          "maxLength": 2000000
        },
        "goSum": {
          "type": "string",
          "maxLength": 2000000
        },
        "goMod": {
          "type": "string",
          "maxLength": 500000
        },
        "pomXml": {
          "type": "string",
          "maxLength": 2000000
        },
        "buildGradle": {
          "type": "string",
          "maxLength": 500000
        },
        "gradleLockfile": {
          "type": "string",
          "maxLength": 2000000
        },
        "evalguardConfig": {},
        "providerKeys": {
          "maxItems": 50,
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 200
          }
        },
        "promptRegistry": {},
        "datasetRegistry": {},
        "agents": {
          "maxItems": 1000,
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "minLength": 1,
                "maxLength": 256
              },
              "model": {
                "type": "string",
                "maxLength": 256
              },
              "provider": {
                "type": "string",
                "maxLength": 128
              },
              "tools": {
                "maxItems": 500,
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256
                }
              },
              "guardrails": {
                "maxItems": 500,
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256
                }
              },
              "source": {
                "type": "string",
                "maxLength": 256
              }
            },
            "required": [
              "name",
              "source"
            ],
            "additionalProperties": false
          }
        },
        "liveCveScan": {
          "type": "boolean"
        }
      },
      "required": [
        "projectName"
      ],
      "additionalProperties": false
    }
  }
}

Response

200 example

{}

All status codes

200Generated AI-BoM (CycloneDX).
400(no description)
401(no description)
403Forbidden — insufficient role for this operation.
429(no description)
500Internal Server Error — an unhandled error was converted to the standard error envelope (INTERNAL_ERROR).

Code samples

cURL

curl -X POST \
  https://evalguard.ai/api/v1/ai-sbom/generate \
  -H "Authorization: Bearer $EVALGUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "projectName": "string", "projectVersion": "string", "format": "json", "pythonRequirements": "string", "pnpmLock": "string", "poetryLock": "string", "goSum": "string", "goMod": "string", "pomXml": "string", "buildGradle": "string", "gradleLockfile": "string", "providerKeys": [ "string" ], "agents": [ { "name": "string", "model": "string", "provider": "string", "tools": [ "string" ], "guardrails": [ "string" ], "source": "string" } ], "liveCveScan": false }'

TypeScript

// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:

const res = await fetch("https://evalguard.ai/api/v1/ai-sbom/generate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "projectName": "string",
    "projectVersion": "string",
    "format": "json",
    "pythonRequirements": "string",
    "pnpmLock": "string",
    "poetryLock": "string",
    "goSum": "string",
    "goMod": "string",
    "pomXml": "string",
    "buildGradle": "string",
    "gradleLockfile": "string",
    "providerKeys": [
      "string"
    ],
    "agents": [
      {
        "name": "string",
        "model": "string",
        "provider": "string",
        "tools": [
          "string"
        ],
        "guardrails": [
          "string"
        ],
        "source": "string"
      }
    ],
    "liveCveScan": false
  }),
});
console.log(res.status, await res.json());

Python

# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
headers["Content-Type"] = "application/json"

response = requests.request(
    "POST",
    "https://evalguard.ai/api/v1/ai-sbom/generate",
    headers=headers,
    json={
    "projectName": "string",
    "projectVersion": "string",
    "format": "json",
    "pythonRequirements": "string",
    "pnpmLock": "string",
    "poetryLock": "string",
    "goSum": "string",
    "goMod": "string",
    "pomXml": "string",
    "buildGradle": "string",
    "gradleLockfile": "string",
    "providerKeys": [
        "string"
    ],
    "agents": [
        {
            "name": "string",
            "model": "string",
            "provider": "string",
            "tools": [
                "string"
            ],
            "guardrails": [
                "string"
            ],
            "source": "string"
        }
    ],
    "liveCveScan": False
},
)
print(response.status_code, response.json())

Go

package main

import (
	"context"
	"fmt"
	"net/http"
	"os"
	"strings"
)

func main() {
	body := strings.NewReader(`{"projectName":"string","projectVersion":"string","format":"json","pythonRequirements":"string","pnpmLock":"string","poetryLock":"string","goSum":"string","goMod":"string","pomXml":"string","buildGradle":"string","gradleLockfile":"string","providerKeys":["string"],"agents":[{"name":"string","model":"string","provider":"string","tools":["string"],"guardrails":["string"],"source":"string"}],"liveCveScan":false}`)
	req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/ai-sbom/generate", body)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil { panic(err) }
	defer resp.Body.Close()
	fmt.Println(resp.Status)
}

Errors

400401403429500

Other Security endpoints