Documentation

Specification version

Property	Value
Format	CycloneDX
Specification version	1.6
`bomFormat`	`CycloneDX`
`serialNumber`	`urn:uuid:` followed by the document's discovery identifier
Encoding	JSON, UTF-8

The internal data model was designed against the CycloneDX 1.6 schema so that material could be exported without a lossy intermediate representation. It is close to, rather than identical with, CycloneDX: the internal record carries discovery and deployment context that has no CycloneDX equivalent, and that context is exported as named properties rather than dropped.

Export endpoints

All export endpoints are GET, return the standard response envelope with the BOM content in data, and require the administrator role.

Endpoint	Exports
`/cyclonedx/export/certificates`	Certificate documents
`/cyclonedx/export/keys`	Key documents
`/cyclonedx/export/protocols`	Protocol endpoints — TLS and SSH
`/cyclonedx/export/binary`	Binary artefacts and their dependencies
`/cyclonedx/export/sourcecode`	Source-code findings, with call-graph dependencies
`/cyclonedx/export`	Every type in one call

Filters

Filters are query-string parameters. A parameter accepting a list takes comma-separated values and matches any of them.

Common to every endpoint

Parameter	Type	Meaning
`discoverTimeFrom`	ISO 8601	Lower bound on discovery time
`discoverTimeTo`	ISO 8601	Upper bound on discovery time
`scanHost`	list	Restrict to material found by these scanning hosts

Certificates

Parameter	Type	Meaning
`algorithm`	list	Algorithm family
`algorithmRef`	list	Compound algorithm reference
`certSha256`	list	Specific certificates by hash

Keys

Parameter	Type	Meaning
`keyType`	list	`secret_key`, `private_key`, `public_key`
`algorithm`	list	Algorithm family
`algorithmRef`	list	Compound algorithm reference
`state`	list	Key lifecycle state
`securedBy`	list	Protection mechanism
`publicKeySha256`	list	Specific keys by public-key hash

Protocols

Parameter	Type	Meaning
`port`	list	Endpoint port
`cipherSuite`	list	Cipher suite present at the endpoint
`host`	list	Endpoint host
`url`	list	Endpoint URL

Binary

Parameter	Type	Meaning
`family`	list	Binary format family
`minConfidence`	number	Minimum detection confidence
`cryptoSymbol`	list	Cryptographic symbol referenced
`importedLibrary`	list	Imported library
`dependency`	list	Declared dependency

The combined /cyclonedx/export endpoint requires a time bound. At least one of discoverTimeFrom or discoverTimeTo must be supplied; a request with neither is rejected with a 400 rather than exporting the whole inventory. The bound is applied to discoverTime or scanProperties.scanTime, so material whose discovery time predates the window is still included when it was seen by a scan inside it.

Field mapping — certificates

CycloneDX path	Internal field
`bom-ref`	`discoverID`
`type`	Constant `data`
`name`	`subject`
`description`	Constant `X.509 Certificate`
`hashes[].alg` / `.content`	`SHA-256` / `certSha256`
`cryptoProperties.assetType`	Constant `certificate`
`cryptoProperties.algorithm`	`algorithm`
`cryptoProperties.algorithmRef`	`algorithmRef`
`cryptoProperties.keySize`	`size`
`cryptoProperties.serialNumber`	`serialNumber`
`cryptoProperties.validFrom`	`validFrom`
`cryptoProperties.validUntil`	`validTo`
`cryptoProperties.keyUsage`	`keyUsage`
`properties[name=issuer]`	`issuer`
`properties[name=source.host]`	`sourceProperties.host`
`properties[name=source.library]`	`sourceProperties.lib`
`properties[name=source.manufacturer]`	`sourceProperties.Manufactory`
`properties[name=source.cka_id]`	`sourceProperties.CKA_ID`
`properties[name=source.label]`	`sourceProperties.CKA_LABEL`
`properties[name=scan.extension]`	`scanProperties.extension`
`properties[name=scan.host]`	`scanProperties.scanHost`
`properties[name=scan.time]`	`scanProperties.scanTime`

Key and protocol components follow the same pattern: the cryptographic attributes map into cryptoProperties, and the discovery context — where it was found, which sensor found it, when — maps into named properties entries, because CycloneDX has no field for it.

Field mapping — source code

The source-code export produces a complete BOM per scanned file rather than a component fragment, because it carries a dependency graph.

CycloneDX path	Internal field
`serialNumber`	`urn:uuid:` + `discoverID`
`metadata.timestamp`	`scanProperties.scanTime`
`metadata.component.type`	Constant `file`
`metadata.component.name`	Base name of `fileProperties.path`
`metadata.component.version`	`sourceProperties.branch`
`metadata.component.hashes`	`fileProperties.checksum`
`metadata.component.properties[cbom:file:path]`	`fileProperties.path`
`metadata.component.properties[cbom:file:language]`	`fileProperties.language`
`metadata.component.properties[cbom:file:encoding]`	`fileProperties.encoding`
`metadata.component.properties[cbom:file:lines]`	`fileProperties.lineCount`
`metadata.properties[cbom:discoverID]`	`discoverID`
`metadata.properties[cbom:scan:id]`	`scanID`
`metadata.properties[cbom:scan:host]`	`scanProperties.scanHost`
`metadata.properties[cbom:scan:time]`	`scanProperties.scanTime`
`metadata.properties[cbom:scan:template]`	`scanProperties.template`
`metadata.properties[cbom:scan:version]`	`scanProperties.scannerVersion`
`metadata.properties[cbom:source:origin]`	`sourceProperties.origin`
`metadata.properties[cbom:source:branch]`	`sourceProperties.branch`
`metadata.properties[cbom:source:host]`	`sourceProperties.host`
`metadata.properties[cbom:callgraph:linked]`	Whether a call graph was matched to this scan
`components`	One component per cryptographic finding
`dependencies`	Derived from the scan's call graph

Every CBOM Secure-specific property is namespaced cbom:, so a consumer can distinguish extension data from standard CycloneDX fields.

Tooling metadata

Each BOM names the tools that produced it under metadata.tools.components: the discovery scanner and the CycloneDX generator, each with its version and Encryption Consulting LLC as manufacturer. A consumer can therefore tell which scanner version produced a finding without consulting CBOM Secure.

What the export does and does not carry

Carries

Algorithm identity, key size, and the compound algorithm reference.
Certificate subject, issuer, serial, validity window and key usage.
Cipher suites and protocol algorithms for endpoints.
Content hashes: certificate hash, public-key hash, file checksum.
Full discovery context — host, path, cloud resource, sensor, scan time — as namespaced properties.
For source code, the call-graph dependencies between findings.

Does not carry

Private key material. CBOM Secure never extracts or stores it, so it cannot appear in an export.
Credentials for any scanned system.
Analysis results. Criticality scores, policy Pass/Fail outcomes and PQC classification are CBOM Secure's own assessments rather than facts about the material, and CycloneDX has no standard representation for them. Use the reporting endpoints for those.
Change history. An export is a point-in-time statement of what exists, not of how it got there.

Limits and behaviour

Aspect	Behaviour
Result size	Bounded by the filters supplied. The combined endpoint's mandatory time bound exists to stop an unbounded whole-inventory export.
Empty result	A successful response with an empty list, not an error.
Authorisation	Administrator role required on every export endpoint.
Field absent on the source record	The mapped CycloneDX field is emitted empty rather than omitted, so the document shape stays constant across records.
Source-code call graph missing	The BOM is still produced; `cbom:callgraph:linked` is `false` and `dependencies` is empty.

CBOM Secure

CycloneDX Export Specification