API reference
Endpoints
Five endpoints. Health is public; everything else requires Authorization: Bearer qb_….
Base URL:
https://api.qorbom.com. All endpoints are HTTPS-only; HTTP is hard-redirected via HSTS.Service health + spec versions advertised
GET
/api/v1/cbom/healthPublicPublic endpoint — handy for sanity-checking your network reach before adding the API key.
Enqueue a CBOM scan for a public GitHub repo
POST
/api/v1/cbom/scansAuth requiredRequest body
{
"repo_url": "https://github.com/owner/repo",
"project_name": "my-project", // optional
"project_version": "1.2.3" // optional, defaults to "1.0.0"
}201 response
{
"id": "cbom_a1b2c3d4e5f6g7h8",
"status": "queued",
"tenant_id": "tnt_...",
"tenant_kind": "partner",
"methodology_version": "qortrace-cbom-method-v0.1"
}List your tenant's recent scans (most recent first)
GET
/api/v1/cbom/scans?limit=50Auth required200 response
{
"scans": [ { "id": "cbom_...", "status": "completed", "score": 78, ... } ],
"count": 4
}Retrieve a scan's status, findings summary, and metadata
GET
/api/v1/cbom/scans/{scan_id}Auth requiredStatus progresses queued → downloading → scanning → completed (or failed). Findings + components arrays are included; BOMs are NOT (use bom.json for those).
Download the CycloneDX 1.6 or SPDX 3.0.1 BOM
GET
/api/v1/cbom/scans/{scan_id}/bom.json?format=cyclonedxAuth requiredPass ?format=spdx for SPDX 3.0.1 output. Returns 409 if status is not completed.