# Export an SBOM

> Export a unit's CycloneDX SBOM from the UI or the API.

A software bill of materials (SBOM) lists what a unit is made of. BuildTrace produces one for any unit as a `CycloneDX` document, version `1.5`.

You need the `reports:read` permission.

## What it contains

The SBOM reflects the unit's current contents. This is the as-maintained view: if you replaced a sub-assembly, the SBOM shows the new one, not the one the unit was built with. See [Serials](https://buildtrace.eu/docs/concepts/serials.md).

The document has:

- The unit itself, with its part name, revision and serial number.
- The serialized parts currently built into the unit.
- The raw materials and lots that went into it, from its as-built record.
- Its firmware: the latest version recorded for each component type. Firmware reports for component types BuildTrace does not know are not included.
- Its certificate references: the unit's test, conformance, calibration and third-party attachments. Each one is a link with a file name and a SHA-256 checksum. The links stop working after 15 minutes, so download the files soon after you export.
- A dependency list that shows the unit depends on all of these.

## Export from the app

1. Open the unit's serial page.
2. Select **Export SBOM**. The button is missing if you do not have `reports:read`.
3. Read the SBOM viewer. It shows the document's details, the component tree and the certificate links.
4. Select **Download .json**. The file is named `sbom-<serial number>.cdx.json`.

## Export through the API

`GET /api/serials/{id}/sbom`

The `{id}` is the serial's ID, not its serial number. Send a bearer token with the `reports:read` scope. The API base is your BuildTrace app address followed by `/api`.

```bash
curl "https://app.buildtrace.eu/api/serials/$SERIAL_ID/sbom" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -o sbom.cdx.json
```

The response is the raw CycloneDX JSON document, not a wrapper object. It starts like this:

```json
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": { "timestamp": "2026-10-30T09:00:00Z", "component": { "type": "device" } },
  "components": [],
  "dependencies": []
}
```

This route is not in the generated API reference. It returns a ready-made document instead of a typed object, so it is documented here.

An ID that is not a valid UUID gets `400`. A unit that does not exist in your workspace gets `404`.