Exports component details to various formats. Returns a ZIP file containing the exported data. Requires Read permission.

Request structure: content selectors vs. format settings

Request fields fall into two independent groups, plus the identifying fields (package_type, component_name, path).

Content selectors — at least one must be true. These say what to include in the export:

• vulnerabilities, violations, license, operational_risk, sast — generate a single rendered report covering the selected content (rendered with output_format)

• spdx — generate an SPDX SBOM document (rendered with spdx_format; SPDX version controlled by spdx_version)

• cyclonedx — generate a CycloneDX SBOM document (rendered with cyclonedx_format)

• any of secrets, services, applications, iac, malicious_code — include the corresponding exposure category

Calling the endpoint without any content selector returns 400 Non of the export options were selected.

Format settings — required only when their companion content is selected, ignored otherwise:

• output_format (e.g., pdf, json, csv) — required when any of vulnerabilities, violations, license, operational_risk, sast is true

• spdx_format (json, tag-value) — required when spdx: true

• spdx_version (2.3 default, 3.0) — optional, only meaningful when spdx: true

• cyclonedx_format (json, xml) — required when cyclonedx: true

The three format dimensions are independent — a single call can combine, for example, a PDF vulnerabilities report with an SPDX SBOM (see the combinedReportAndSbom example).