getSingleSbomLibrary

Gets detailed information about a specific library in an SBOM.

Examples

GraphQL

query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) {
  getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) {
    id
    references {
      triggerPackage
      location
      locationLink
      dependencyType
      dependencyLevel
      commit {
        commitedAt
        committerName
        committerEmail
      }
      fileName
      declaredConstraint
    }
    language
    libraryName
    libraryVersion
    license
    appName
    location
    dependencyType
    source
    appId
    locationLink
    appLink
    pkgName
    copyWriteInfo
    copyWriteInfoLink
    libLink
    vulnerabilityCounts {
      appox
      critical
      high
      medium
      low
      info
    }
    triggerPackage
    vulnerabilities {
      issueId
      cwe {
        name
        shortName
        description
        url
      }
      cveSeverityFactor {
        sfName
        sfDescription
        sfChangedNumber
        evidences {
          key
          value
          link
          snippet {
            snippetLineNumber
            language
            text
            fileName
          }
          callBranch
        }
      }
      oxSeverity
      severityNumberFromTool
      severityFromTool
      cve
      cveLink
      cvsVer
      cvssVersion
      epss
      percentile
      libName
      dependencyChain
      runtimeStatus
      runtimeContext {
        runtimeStatus
        cloudContexts {
          provider
          accountId
          region
          clusterName
          namespace
          containerRuntime
        }
      }
      libVersion
      chainDepth
      exploitInTheWild
      exploitInTheWildLink
      description
      dateDiscovered
      minorVerWithFix
      majorVerWithFix
      exploitRequirement
      exploitCode
      originalSeverity
    }
    latestVersion
    latestVersionDate
    stars
    forks
    openIssues
    packageManager
    purl
    packageManagerLink
    maintainers
    contributors
    downloads
    sourceLink
    notPopular
    licenseIssue
    malicious
    malwareType
    osVname
    notMaintained
    isDeprecated
    notImported
    notUpdated
    dependencyLevel
    requestId
    licenseLink
    artifactInSbomLibs {
      image
      imageLink
      imageCreatedAt
      sha
      os
      osVersion
      baseImage
      baseImageVersion
      tag
      layer
      registryName
      source
    }
    sha
    maintainersList {
      name
      email
    }
    runtimeStatus
    runtimeContext {
      runtimeStatus
      cloudContexts {
        provider
        accountId
        region
        clusterName
        namespace
        containerRuntime
      }
    }
    usedVersionReleaseDate
    projectDescription
    firstSeenDate
    pinState
    declaredConstraint
    lockfilePresent
    referenceCount
    imageSource
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "getSingleSbomLibraryInput": {
    "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
    "appId": "30966426",
    "library": "example",
    "libraryName": "example",
    "triggerPackage": "example",
    "libId": "example"
  }
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }",
 "variables": {
    "getSingleSbomLibraryInput": {
      "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
      "appId": "30966426",
      "library": "example",
      "libraryName": "example",
      "triggerPackage": "example",
      "libId": "example"
    }
  }
}'

Node.js

const query = 'query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      getSingleSbomLibraryInput: {
        scanId: "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
        appId: "30966426",
        library: "example",
        libraryName: "example",
        triggerPackage: "example",
        libId: "example"
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'query GetSingleSbomLibrary($getSingleSbomLibraryInput: GetSingleSbomLibraryInput) { getSingleSbomLibrary(getSingleSbomLibraryInput: $getSingleSbomLibraryInput) { id references { triggerPackage location locationLink dependencyType dependencyLevel commit { commitedAt committerName committerEmail } fileName declaredConstraint } language libraryName libraryVersion license appName location dependencyType source appId locationLink appLink pkgName copyWriteInfo copyWriteInfoLink libLink vulnerabilityCounts { appox critical high medium low info } triggerPackage vulnerabilities { issueId cwe { name shortName description url } cveSeverityFactor { sfName sfDescription sfChangedNumber evidences { key value link snippet { snippetLineNumber language text fileName } callBranch } } oxSeverity severityNumberFromTool severityFromTool cve cveLink cvsVer cvssVersion epss percentile libName dependencyChain runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } libVersion chainDepth exploitInTheWild exploitInTheWildLink description dateDiscovered minorVerWithFix majorVerWithFix exploitRequirement exploitCode originalSeverity } latestVersion latestVersionDate stars forks openIssues packageManager purl packageManagerLink maintainers contributors downloads sourceLink notPopular licenseIssue malicious malwareType osVname notMaintained isDeprecated notImported notUpdated dependencyLevel requestId licenseLink artifactInSbomLibs { image imageLink imageCreatedAt sha os osVersion baseImage baseImageVersion tag layer registryName source } sha maintainersList { name email } runtimeStatus runtimeContext { runtimeStatus cloudContexts { provider accountId region clusterName namespace containerRuntime } } usedVersionReleaseDate projectDescription firstSeenDate pinState declaredConstraint lockfilePresent referenceCount imageSource } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "getSingleSbomLibraryInput": {
        "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
        "appId": "30966426",
        "library": "example",
        "libraryName": "example",
        "triggerPackage": "example",
        "libId": "example"
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getSingleSbomLibrary query.

Argument	Description	Supported fields
getSingleSbomLibraryInput GetSingleSbomLibraryInput	Parameters identifying which specific library to retrieve	scanId String appId String library String libraryName String triggerPackage String libId String

Fields

Return type: SbomLib

You can use the following field(s) to specify what information your getSingleSbomLibrary query will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
id String	Unique identifier of the SBOM library
references [SbomReference]	List of references associated with this library	triggerPackage String location String locationLink String dependencyType String dependencyLevel Int commit SbomCommit fileName String declaredConstraint String
appType String ⚠️	Deprecated: This field is not used anymore
language String	Programming language of the library
libId String ⚠️	Deprecated: This field is not used anymore
libraryName String	Official name of the library
libraryVersion String	Version string of the library
license String	License type(s) of the library
appName String	Name of the application that uses the library
location String	Location path where the library is used or referenced
dependencyType String	Type of dependency
source String	Source of the library
appId String	Application identifier using the library
locationLink String	URL link to the location where the library is used
appLink String	URL link to the application
pkgName String	Package name of the library
copyWriteInfo [String]	List of copyright notices associated with the library
copyWriteInfoLink String	Link to the copyright information
libLink String	URL link to the library source or homepage
vulnerabilityCounts IssuesBySeverity	Counts of vulnerabilities by severity	appox Int critical Int high Int medium Int low Int info Int
triggerPackage String	Package that triggered this library in the dependency graph
vulnerabilities [SCAVulnerability]	List of software composition analysis vulnerabilities associated	issueId String cwe [CweObject] cveSeverityFactor [CveSeverityFactor] oxSeverity String severityNumberFromTool String severityFromTool String cve String cveLink String cvsVer String cvssVersion Float epss Float percentile Float libName String dependencyChain String runtimeStatus String runtimeContext RuntimeInfo libVersion String chainDepth Int exploitInTheWild Boolean exploitInTheWildLink String description String dateDiscovered String minorVerWithFix String majorVerWithFix String exploitRequirement String exploitCode String originalSeverity String
latestVersion String	Latest available version of the library
latestVersionDate String	Release date of the latest version
stars Int	Number of stars (popularity metric) on the repository
forks Int	Number of forks on the repository
openIssues Int	Number of open issues in the repository
packageManager String	Package manager name
purl String	Package URL (PURL) identifier for this library, e.g. pkg:npm/lodash@4.17.21
packageManagerLink String	URL link to the package manager page
maintainers Int	Number of maintainers of the library
contributors Int	Number of contributors to the library
downloads Int	Number of downloads for the library
sourceLink String	Source code link
notPopular Boolean	Indicates if the library is considered not popular
licenseIssue Boolean	Indicates if the library has license compliance issues
malicious Boolean	Indicates if the library is malicious
malwareType String	Malware type
osVname String	Operating system
notMaintained Boolean	Indicates if the library is not actively maintained
isDeprecated Boolean	Indicates if the library is deprecated
notImported Boolean	Deprecated: Indicates if the library is not imported (use other fields)
notUsed Boolean ⚠️	Deprecated: No longer supported
notUpdated Boolean	Indicates if the library version is not up-to-date
dependencyLevel Int	Dependency level in the graph
requestId String	Request identifier associated with the data fetch
licenseLink String	Link to the license details
artifactInSbomLibs [ArtifactInSbomLibs]	List of artifacts that include this library	image String imageLink String imageCreatedAt String sha String os String osVersion String baseImage String baseImageVersion String tag String layer String registryName String source String
sha String	SHA hash associated with the library
maintainersList [Maintainer]	List of maintainers with detailed info	name String email String
runtimeStatus String	Runtime status of the library indicating eBPF loading state
runtimeContext RuntimeInfo	Runtime information including status and cloud contexts	runtimeStatus String cloudContexts [RuntimeContext]
usedVersionReleaseDate String	Used version release date
projectDescription String	Project description
firstSeenDate String	Date when this library was first seen by the scanner
pinState String	Pin state of the dependency derived from the declared version constraint and lockfile presence. Possible values are PinnedExact, PinnedByLock, RangeNoLock, FloatingNoLock, and Unknown. A null value means the pin state was not evaluated for the library, which applies to container image components and to scans performed before pin state collection was enabled.
declaredConstraint String	Version constraint declared for the dependency in the package manager manifest, exactly as written by the developer. A null value means no declared constraint was resolved for the library.
lockfilePresent Boolean	Indicates whether a non-empty lockfile pins the resolved version of the dependency. A null value means lockfile presence was not evaluated for the library.
referenceCount Int	Total number of references associated with the library.
imageSource String	Source of the container image associated with the library, indicating whether the image came from a public or a connected registry.