> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # The fleet's software bill of materials > Every package the scanner found in the fleet's container images, grouped by name, version and ecosystem, with how many images, workloads and clusters carry it and the findings that name that exact package and version on those images. The coverage block says how many scanned clusters publish a bill of materials; the rest have SBOM generation switched off. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /org/security/sbom openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. paths: /org/security/sbom: get: tags: - Security summary: The fleet's software bill of materials description: >- Every package the scanner found in the fleet's container images, grouped by name, version and ecosystem, with how many images, workloads and clusters carry it and the findings that name that exact package and version on those images. The coverage block says how many scanned clusters publish a bill of materials; the rest have SBOM generation switched off. operationId: list_security_sbom_components parameters: - in: query name: page required: false schema: default: 1 maximum: 10000 minimum: 1 type: integer - description: Values above 100 are clamped to 100. in: query name: page_size required: false schema: default: 50 minimum: 1 type: integer - in: query name: search required: false schema: type: string - description: >- Ecosystem filter, repeatable (deb, apk, rpm, npm, pypi, golang, maven, ...). in: query name: package_type required: false schema: items: type: string type: array - description: >- Only components in these licence tiers (network_copyleft, source_available, copyleft, weak_copyleft, permissive, unknown); repeat or comma-separate to combine. in: query name: license_risk required: false schema: items: type: string type: array - in: query name: cluster_id required: false schema: format: uuid type: string - in: query name: namespace required: false schema: type: string - description: >- Only images running in workloads of this kind (Deployment, StatefulSet, DaemonSet, CronJob, ...); case-insensitive. in: query name: workload_kind required: false schema: type: string - description: >- Only images running in the workload with this name; case-insensitive. Combine with workload_kind to pin one workload. in: query name: workload_name required: false schema: type: string - description: >- Only components inside one image (digest or repository:tag identity). in: query name: image required: false schema: type: string - description: true keeps components a finding names, false the ones nothing names. in: query name: vulnerable required: false schema: type: boolean - in: query name: sort required: false schema: default: images enum: - name - version - package_type - images - workloads - clusters - vulnerable - actionable type: string - in: query name: order required: false schema: default: desc enum: - asc - desc type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecuritySbomComponentListResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Business validation error '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Permission denied '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Organization-scoped resource not found '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Validation Error components: schemas: SecuritySbomComponentListResponse: properties: result: items: $ref: '#/components/schemas/SecuritySbomComponentSummary' type: array pagination: $ref: '#/components/schemas/SecurityPagination' facets: $ref: '#/components/schemas/SecuritySbomComponentFacets' coverage: $ref: '#/components/schemas/SecuritySbomCoverage' required: - result - pagination - facets - coverage title: SecuritySbomComponentListResponse type: object SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecuritySbomComponentSummary: properties: name: type: string version: type: string package_type: type: string component_type: type: string purl: anyOf: - type: string - type: 'null' licenses: items: type: string type: array license_risk: type: string enum: - network_copyleft - source_available - copyleft - weak_copyleft - permissive - unknown description: >- The most consequential licence tier across the component's licences: network_copyleft (AGPL, SSPL, EUPL, OSL) obliges publishing the source of a service that links it; source_available (BUSL, Elastic, Redis Source Available, Commons Clause) needs a commercial licence to host as a service; copyleft (GPL) is safe on a private backend but must be open-sourced when shipped to users; weak_copyleft (LGPL, MPL, EPL, CDDL) reaches only modifications of the component; permissive (MIT, Apache-2.0, BSD, ISC) obliges nothing; unknown is unrecognised or not yet classified. images: type: integer workloads: type: integer clusters: type: integer vulnerable_findings: type: integer actionable_findings: type: integer known_exploited: type: integer required: - name - version - package_type - component_type - purl - licenses - license_risk - images - workloads - clusters - vulnerable_findings - actionable_findings - known_exploited title: SecuritySbomComponentSummary type: object SecurityPagination: properties: page: type: integer page_size: type: integer total_count: type: integer total_pages: type: integer required: - page - page_size - total_pages - total_count type: object SecuritySbomComponentFacets: properties: package_type: items: $ref: '#/components/schemas/SecurityFacetCount' type: array license_risk: items: $ref: '#/components/schemas/SecurityFacetCount' type: array description: Tiers present under the other filters, most consequential first. required: - package_type - license_risk title: SecuritySbomComponentFacets type: object SecuritySbomCoverage: properties: scanned_clusters: type: integer clusters_with_sbom: description: >- Below scanned_clusters means the remaining clusters have SBOM generation switched off, not that they run nothing. type: integer images: type: integer components: type: integer workloads: type: integer latest_generated_at: anyOf: - format: date-time type: string - type: 'null' required: - scanned_clusters - clusters_with_sbom - images - components - workloads - latest_generated_at title: SecuritySbomCoverage type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecurityFacetCount: properties: count: type: integer value: type: string required: - value - count type: object ````