Get started · 5 minutes
Quickstart
Submit a scan, poll for completion, download the BOM. Five lines of code, two SDKs, zero setup.
Prerequisites
You need a QorBOM™ Partner API key. New partners get a sandbox key (prefix qb_test_) within two business days of applying. See Authentication for the full key format + storage guidance.
Three calls, three minutes
Pick a language. Every snippet below shows the exact same flow: submit a public GitHub URL, poll until done, fetch the BOM.
# 1. Submit a scan
curl -X POST "https://qortrace.com/api/v1/cbom/scans" \
-H "Authorization: Bearer $QORBOM_KEY" \
-H "Content-Type: application/json" \
-d '{"repo_url": "https://github.com/octocat/Hello-World"}'
# 2. Poll (response status: queued → scanning → completed)
curl "https://qortrace.com/api/v1/cbom/scans/cbom_xxxxxxxxxxxxxxxx" \
-H "Authorization: Bearer $QORBOM_KEY"
# 3. Download CycloneDX BOM (or ?format=spdx)
curl "https://qortrace.com/api/v1/cbom/scans/cbom_xxxxxxxxxxxxxxxx/bom.json" \
-H "Authorization: Bearer $QORBOM_KEY" > bom.jsonAsync scans. Scans run on a worker pool. Most public-repo scans take 20–30 seconds. Use webhooks (see Webhooks) to skip polling on production integrations.
Try it now — no signup
Paste any public GitHub repo URL. We'll run a real QorBOM™ scan and show you the readiness summary. One scan per IP per 24 hours.
Where to next
- Authentication — key format, header, rotation, scopes
- Endpoints — every route + request/response schema
- Webhooks — push-style scan-complete notifications