Please review the Metadata section for the “List Vulnerabilities” endpoint.
This endpoint requires the appsec_vm_read permission.
Arguments
Query Strings
Name
Type
Description
page[token]
string
Its value must come from the links section of the response of the first request. Do not manually edit it.
page[number]
integer
The page number to be retrieved. It should be equal to or greater than 1.
filter[asset_type]
enum
The type of the assets for the SBOM request. Allowed enum values: Repository, Service, Host, HostImage, Image
filter[asset_name]
string
The name of the asset for the SBOM request.
filter[package_name]
string
The name of the component that is a dependency of an asset.
filter[package_version]
string
The version of the component that is a dependency of an asset.
filter[license_name]
string
The software license name of the component that is a dependency of an asset.
filter[license_type]
enum
The software license type of the component that is a dependency of an asset. Allowed enum values: network_strong_copyleft, non_standard_copyleft, other_non_free, other_non_standard, permissive, public_domain, strong_copyleft, weak_copyleft
The expected response schema when listing assets SBOMs.
Expand All
Field
Type
Description
data [required]
[object]
List of assets SBOMs.
attributes
object
The JSON:API attributes of the SBOM.
bomFormat [required]
string
Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOM do not have a filename convention nor does JSON schema support namespaces. This value MUST be CycloneDX.
components [required]
[object]
A list of software and hardware components.
bom-ref
string
An optional identifier that can be used to reference the component elsewhere in the BOM.
licenses
[object]
The software licenses of the SBOM component.
license [required]
object
The software license of the component of the SBOM.
name [required]
string
The name of the software license of the component of the SBOM.
name [required]
string
The name of the component. This will often be a shortened, single name of the component.
properties
[object]
The custom properties of the component of the SBOM.
name [required]
string
The name of the custom property of the component of the SBOM.
value [required]
string
The value of the custom property of the component of the SBOM.
purl
string
Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification.
supplier [required]
object
The supplier of the component.
name [required]
string
Identifier of the supplier of the component.
type [required]
enum
The SBOM component type
Allowed enum values: application,container,data,device,device-driver,file,firmware,framework,library,machine-learning-modelShow 2 more,operating-system,platform
version [required]
string
The component version.
dependencies [required]
[object]
List of dependencies between components of the SBOM.
dependsOn
[string]
The components that are dependencies of the ref component.
ref
string
The identifier for the related component.
metadata [required]
object
Provides additional information about a BOM.
authors
[object]
List of authors of the SBOM.
name
string
The identifier of the Author of the SBOM.
component
object
The component that the BOM describes.
name
string
The name of the component. This will often be a shortened, single name of the component.
type
string
Specifies the type of the component.
timestamp
string
The timestamp of the SBOM creation.
serialNumber [required]
string
Every BOM generated has a unique serial number, even if the contents of the BOM have not changed overt time. The serial number follows RFC-4122
specVersion [required]
enum
The version of the CycloneDX specification a BOM conforms to.
Allowed enum values: 1.0,1.1,1.2,1.3,1.4,1.5
version [required]
int64
It increments when a BOM is modified. The default value is 1.
id
string
The unique ID for this SBOM (it is equivalent to the asset_name or asset_name@repo_digest (Image)
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* List assets SBOMs returns "OK" response
*/import{client,v2}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv2.SecurityMonitoringApi(configuration);constparams: v2.SecurityMonitoringApiListAssetsSBOMsRequest={filterAssetType:"Service",filterPackageName:"pandas",};apiInstance.listAssetsSBOMs(params).then((data: v2.ListAssetsSBOMsResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));