> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Download Scan SBOM

> Download the CycloneDX JSON SBOM for a completed scan. Requires `heeler.view_sastscan` (the **View SAST Scan** permission) and access to the scan’s project when Project Access Control is enabled. An empty dependency inventory returns a document with an empty components array.



## OpenAPI

````yaml /api-reference/openapi.json get /scan/{scan_id}/sbom
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
  - url: https://eu.corgea.app/api/v1
    description: EU production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /scan/{scan_id}/sbom:
    get:
      tags:
        - Dependencies
      summary: Download Scan SBOM
      description: >-
        Download the CycloneDX JSON SBOM for a completed scan. Requires
        `heeler.view_sastscan` (the **View SAST Scan** permission) and access to
        the scan’s project when Project Access Control is enabled. An empty
        dependency inventory returns a document with an empty components array.
      operationId: getScanSbom
      parameters:
        - name: scan_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: CycloneDX SBOM JSON document
          headers:
            Content-Disposition:
              schema:
                type: string
              example: attachment; filename="sbom_<scan_id>.json"
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '400':
          description: Scan has not completed
        '401':
          description: Missing or invalid API key
        '403':
          description: Permission denied
        '404':
          description: Scan not found, inaccessible, or SBOM data unavailable
components:
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: >-
        API key for authentication API tokens belonging to inactive users are
        rejected.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.