Retrieving AI-BOM Reports

Query the status of an ongoing scan and download the generated AI-BOM report using the task ID.

This feature is in Limited Availability. If you want to enable this feature in your tenant, contact your sales team.

API Endpoint Details

The Report API returns scan status updates and delivers the final CycloneDX JSON manifest once analysis is complete.

• Method: GET
• Path: /api/v2/aibom/reports/{taskId}
• Accept: application/json

Path Parameters

• taskId (Required): The unique task identifier returned when you submitted the skill archive or Git repository.

Request Headers

• Authorization (Required): Bearer <your_api_token>

Fetching the Report

To retrieve your AI-BOM report:

1. Send an HTTP GET request to /api/v2/aibom/reports/{taskId} using the taskId from your submission.
2. Check the HTTP response status:
   • If the response is 202 Accepted, the scan is still running. Wait a few moments and poll the endpoint again.
   • If the response is 200 OK, the scan is complete.
   • If the response is 422 Unprocessable Content, the scan encountered an unrecoverable analysis error.
3. Parse the JSON response body to inspect the component breakdown, vulnerability findings, and risk tier.

Example Request

curl -X GET "https://<tenant-url>/api/v2/aibom/reports/task-80cf4f58-5a6e-4788-b6ce-1ee72a2c9fe7" \
  -H "Authorization: Bearer <your_api_token>"

In-Progress Response (HTTP 202 Accepted)

{
  "status": "in_progress",
  "taskId": "task-80cf4f58-5a6e-4788-b6ce-1ee72a2c9fe7"
}

Completed Response (HTTP 200 OK)

{
  "package": "/input/custom-agent-skill",
  "timestamp": "2026-10-05T12:00:00.000000+00:00",
  "duration_ms": 5296,
  "safe_level": 3,
  "safe_label": "Moderate",
  "safe_color": "#fbbf24",
  "risk_score": 3.38,
  "dimensions": [
    { "name": "vulnerabilities", "score": 4.5, "weight": 0.25 },
    { "name": "secrets", "score": 5.0, "weight": 0.20 },
    { "name": "crypto", "score": 2.0, "weight": 0.15 },
    { "name": "saas", "score": 3.5, "weight": 0.12 },
    { "name": "ml", "score": 4.5, "weight": 0.08 },
    { "name": "skills", "score": 2.5, "weight": 0.20 }
  ],
  "summary": {
    "sbom": 11,
    "saasbom": 11,
    "mlbom": 4,
    "cbom": 1,
    "secrets": 0,
    "skillbom": 1,
    "vulnerabilities": 17
  },
  "sbom": [
    {
      "id": "requests",
      "name": "requests",
      "version": "2.31.0",
      "metadata": {
        "purl": "pkg:pypi/requests@2.31.0",
        "type": "library",
        "source_manifest": "requirements.txt",
        "vulnerabilities": [
          {
            "id": "GHSA-9hjg-9r4m-mvj7",
            "severity": "MEDIUM",
            "source": "ghsa",
            "affected_package": "requests"
          }
        ],
        "vuln_count": 1
      }
    }
  ],
  "saasbom": [],
  "mlbom": [],
  "cbom": [],
  "skillbom": [],
  "vulnerabilities": []
}

Understanding the Report Fields

The AI-BOM report includes the following key structures:

• safe_level: Numeric rating indicating the safety level (1 to 5).
• risk_score: Normalized composite score reflecting the overall risk.
• dimensions: Weighted risk scores across the six security categories.
• summary: Aggregated counts of identified components, secrets, and vulnerabilities.
• sbom / saasbom / mlbom / cbom / skillbom: Component manifests containing package metadata, version details, and mapped execution graphs.

Error Codes

The Report API returns the following error responses:

• 404 Not Found: The requested task ID does not exist or expired.
• 422 Unprocessable Content: The scan failed during processing. The response contains an error_code and a sanitized error_message.