> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--sbom/queries/get-single-sbom-library.md). # getSingleSbomLibrary Gets detailed information about a specific library in an SBOM. ### Examples {% tabs %} {% tab title="GraphQL" %} ```graphql query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } } ``` #### Variables This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. ```json { "getSingleSbomLibraryInput": { "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "appId": "30966426", "library": "example", "libraryName": "example", "triggerPackage": "example", "libId": "example" } } ``` {% endtab %} {% tab title="cURL" %} ```shell curl -X POST \ https://api.cloud.ox.security/api/apollo-gateway \ -H 'Content-Type: application/json' \ -H 'Authorization: YOUR_API_TOKEN' \ -d '{ "query": "query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }", "variables": { "getSingleSbomLibraryInput": { "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "appId": "30966426", "library": "example", "libraryName": "example", "triggerPackage": "example", "libId": "example" } } }' ``` {% endtab %} {% tab title="Node.js" %} ```javascript const query = 'query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }'; fetch("https://api.cloud.ox.security/api/apollo-gateway", { method: "POST", headers: { "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, body: JSON.stringify({ query: query, // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. variables: { getSingleSbomLibraryInput: { scanId: "c9da693d-8906-4a32-93c9-2ffdb1cebb99", appId: "30966426", library: "example", libraryName: "example", triggerPackage: "example", libId: "example" } } }) }) .then(response => response.json()) .then(result => console.log(JSON.stringify(result, null, 2))) .catch(error => console.error('Error:', error)); ``` {% endtab %} {% tab title="Python" %} ```python import requests query = 'query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }' response = requests.post( "https://api.cloud.ox.security/api/apollo-gateway", headers={ "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, json={ "query": query, # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. "variables": { "getSingleSbomLibraryInput": { "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "appId": "30966426", "library": "example", "libraryName": "example", "triggerPackage": "example", "libId": "example" } } } ) if response.status_code == 200: result = response.json() print(result) else: print(f"Error: {response.status_code}") print(response.text) ``` {% endtab %} {% endtabs %} ### Arguments You can use the following argument(s) to customize your `getSingleSbomLibrary` query. | Argument | Description | Supported fields | | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | getSingleSbomLibraryInput [`GetSingleSbomLibraryInput`](/api-documentation/api-reference/api--sbom/types/inputs/get-single-sbom-library-input.md) | Parameters identifying which specific library to retrieve |

scanId String
appId String
library String
libraryName String
triggerPackage String
libId String

| ### Fields Return type: [`SbomLib`](/api-documentation/api-reference/api--issue/types/objects/sbom-lib.md) You can use the following field(s) to specify what information your `getSingleSbomLibrary` query will return. Please note that some fields may have their own subfields. | Field | Description | Supported fields | | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | id `String` | Unique identifier of the SBOM library | | | references [`[SbomReference]`](/api-documentation/api-reference/api--issue/types/objects/sbom-reference.md) | List of references associated with this library |

triggerPackage String
location String
locationLink String
dependencyType String
dependencyLevel Int
commit SbomCommit
fileName String
declaredConstraint String

| | ~~appType `String`~~ ⚠️ | **Deprecated**: This field is not used anymore | | | language `String` | Programming language of the library | | | ~~libId `String`~~ ⚠️ | **Deprecated**: This field is not used anymore | | | libraryName `String` | Official name of the library | | | libraryVersion `String` | Version string of the library | | | license `String` | License type(s) of the library | | | appName `String` | Name of the application that uses the library | | | location `String` | Location path where the library is used or referenced | | | dependencyType `String` | Type of dependency | | | source `String` | Source of the library | | | appId `String` | Application identifier using the library | | | locationLink `String` | URL link to the location where the library is used | | | appLink `String` | URL link to the application | | | pkgName `String` | Package name of the library | | | copyWriteInfo `[String]` | List of copyright notices associated with the library | | | copyWriteInfoLink `String` | Link to the copyright information | | | libLink `String` | URL link to the library source or homepage | | | vulnerabilityCounts [`IssuesBySeverity`](/api-documentation/api-reference/api--issue/types/objects/issues-by-severity.md) | Counts of vulnerabilities by severity |

appox Int
critical Int
high Int
medium Int
low Int
info Int

| | triggerPackage `String` | Package that triggered this library in the dependency graph | | | vulnerabilities [`[SCAVulnerability]`](/api-documentation/api-reference/api--issue/types/objects/sca-vulnerability.md) | List of software composition analysis vulnerabilities associated |

issueId String
cwe \[CweObject]
cveSeverityFactor \[CveSeverityFactor]
oxSeverity String
severityNumberFromTool String
severityFromTool String
cve String
cveLink String
cvsVer String
cvssVersion Float
epss Float
percentile Float
libName String
dependencyChain String
runtimeStatus String
runtimeContext RuntimeInfo
libVersion String
chainDepth Int
exploitInTheWild Boolean
exploitInTheWildLink String
description String
dateDiscovered String
minorVerWithFix String
majorVerWithFix String
exploitRequirement String
exploitCode String
originalSeverity String

| | latestVersion `String` | Latest available version of the library | | | latestVersionDate `String` | Release date of the latest version | | | stars `Int` | Number of stars (popularity metric) on the repository | | | forks `Int` | Number of forks on the repository | | | openIssues `Int` | Number of open issues in the repository | | | packageManager `String` | Package manager name | | | purl `String` | Package URL (PURL) identifier for this library, e.g. pkg:npm/lodash\@4.17.21 | | | packageManagerLink `String` | URL link to the package manager page | | | maintainers `Int` | Number of maintainers of the library | | | contributors `Int` | Number of contributors to the library | | | downloads `Int` | Number of downloads for the library | | | sourceLink `String` | Source code link | | | notPopular `Boolean` | Indicates if the library is considered not popular | | | licenseIssue `Boolean` | Indicates if the library has license compliance issues | | | malicious `Boolean` | Indicates if the library is malicious | | | malwareType `String` | Malware type | | | osVname `String` | Operating system | | | notMaintained `Boolean` | Indicates if the library is not actively maintained | | | isDeprecated `Boolean` | Indicates if the library is deprecated | | | notImported `Boolean` | Deprecated: Indicates if the library is not imported (use other fields) | | | ~~notUsed `Boolean`~~ ⚠️ | **Deprecated**: No longer supported | | | notUpdated `Boolean` | Indicates if the library version is not up-to-date | | | dependencyLevel `Int` | Dependency level in the graph | | | requestId `String` | Request identifier associated with the data fetch | | | licenseLink `String` | Link to the license details | | | artifactInSbomLibs [`[ArtifactInSbomLibs]`](/api-documentation/api-reference/api--issue/types/objects/artifact-in-sbom-libs.md) | List of artifacts that include this library |

image String
imageLink String
imageCreatedAt String
sha String
os String
osVersion String
baseImage String
baseImageVersion String
tag String
layer String
registryName String
source String

| | sha `String` | SHA hash associated with the library | | | maintainersList [`[Maintainer]`](/api-documentation/api-reference/api--issue/types/objects/maintainer.md) | List of maintainers with detailed info |

name String
email String

| | runtimeStatus `String` | Runtime status of the library indicating eBPF loading state | | | runtimeContext [`RuntimeInfo`](/api-documentation/api-reference/api--issue/types/objects/runtime-info.md) | Runtime information including status and cloud contexts |

runtimeStatus String
cloudContexts \[RuntimeContext]

| | usedVersionReleaseDate `String` | Used version release date | | | projectDescription `String` | Project description | | | firstSeenDate `String` | Date when this library was first seen by the scanner | | | pinState `String` | Pin state of the dependency derived from the declared version constraint and lockfile presence. Possible values are PinnedExact, PinnedByLock, RangeNoLock, FloatingNoLock, and Unknown. A null value means the pin state was not evaluated for the library, which applies to container image components and to scans performed before pin state collection was enabled. | | | declaredConstraint `String` | Version constraint declared for the dependency in the package manager manifest, exactly as written by the developer. A null value means no declared constraint was resolved for the library. | | | lockfilePresent `Boolean` | Indicates whether a non-empty lockfile pins the resolved version of the dependency. A null value means lockfile presence was not evaluated for the library. | | | referenceCount `Int` | Total number of references associated with the library. | | | imageSource `String` | Source of the container image associated with the library, indicating whether the image came from a public or a connected registry. | | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ox.security/api-documentation/api-reference/api--sbom/queries/get-single-sbom-library.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.