Quickstart

Submit a scan, poll for completion, download the BOM. Five lines of code, two SDKs, zero setup.

Prerequisites

You need a QorBOM™ Partner API key. New partners get a sandbox key (prefix qb_test_) within two business days of applying. See Authentication for the full key format + storage guidance.

Three calls, three minutes

Pick a language. Every snippet below shows the exact same flow: submit a public GitHub URL, poll until done, fetch the BOM.

# 1. Submit a scan
curl -X POST "https://qortrace.com/api/v1/cbom/scans" \
  -H "Authorization: Bearer $QORBOM_KEY" \
  -H "Content-Type: application/json" \
  -d '{"repo_url": "https://github.com/octocat/Hello-World"}'

# 2. Poll (response status: queued → scanning → completed)
curl "https://qortrace.com/api/v1/cbom/scans/cbom_xxxxxxxxxxxxxxxx" \
  -H "Authorization: Bearer $QORBOM_KEY"

# 3. Download CycloneDX BOM (or ?format=spdx)
curl "https://qortrace.com/api/v1/cbom/scans/cbom_xxxxxxxxxxxxxxxx/bom.json" \
  -H "Authorization: Bearer $QORBOM_KEY" > bom.json

Try it now — no signup

Paste any public GitHub repo URL. We'll run a real QorBOM™ scan and show you the readiness summary. One scan per IP per 24 hours.

Where to next

• Authentication — key format, header, rotation, scopes
• Endpoints — every route + request/response schema
• Webhooks — push-style scan-complete notifications