Artifact schemas
SBOMFlow writes plain JSON files into a directory you choose — those files are the system of record. This page is the field-level reference for each documented artifact: its filename, its schema identifier, and the top-level keys it carries. For a plain-English overview of what each file is for and who reads it, see evidence outputs.
Note
This page is generated from the product's artifact schema registry, so it
always matches the artifacts your installed version writes. Explain any schema
offline with sbomflow schema (the whole registry) or `sbomflow schema show
<family>` (one artifact, with its exact top-level keys).
Timestamps. Every generated_at (and any other timestamp an artifact records) is one canonical UTC form — YYYY-MM-DDTHH:MM:SS+00:00, microseconds preserved when supplied. --as-of accepts a trailing Z, any explicit offset, or a bare date, and normalizes it to this form before anything is written, so equivalent inputs always produce byte-identical artifacts (see the E006 error reference).
Every artifact here is an engineering record. A schema documents structure, never a compliance conclusion: an artifact's presence or shape is not a claim of CRA conformity or legal sufficiency, and observed fields are never a substitute for human review.
How to read the table#
- Artifact — the filename written into the output directory.
- Schema — the stable schema identifier. Some artifacts are structural (validated by shape rather than an embedded schema string); that is stated verbatim.
- Shape — whether the top level is a JSON
objector anarray(for an array, the keys listed are the keys of each element). - Stability — the integrator compatibility class. A stable artifact's existing top-level keys will not be removed or renamed without a
schema_versionbump and a migration (new keys may still be added); an experimental artifact may change without notice, so do not hard-depend on it yet. - Top-level keys — the keys present at the top level of the artifact.
Documented artifacts#
| Artifact | Schema | Shape | Stability | Top-level keys |
|---|---|---|---|---|
advisory-reconciliation.json | sbomflow-advisory-reconciliation-v1 | object | experimental | finding_count, findings, generated_at, reviewer_boundary_note, schema, severity_conflict_count, watchlist_sources |
ai-evidence.json | sbomflow-ai-evidence-v1 | object | experimental | adapters, agent_authority, compiled_engines, ai_scan_performed, boundary, counts, datasets, discovery, evaluations, evidence_aging, gpai_integration, graph, lineage, manifest_supplied, mcp_server_cards, multimodal_systems, note, observed_model_artifacts, prompts, provider_declarations, reconciliation, release_id, runtime_reconciliation, serving, shard_sets, scan_warnings, schema, supplier_ai_boms, traversal |
ai-evidence-map.json | sbomflow-ai-evidence-map-v1 | object | experimental | boundary, counts, human_records_note, human_records_supplied, maps, maps_digest, observation_scope_note, probes, schema |
analysis-control-receipt.json | sbomflow-analysis-control-receipt-v1 | object | experimental | advisory_source, boundary_note, control_accounting, control_health, control_health_meaning, controls, corpus, counts, distribution, entry_point, limits, observed_at, observed_at_state, observed_at_state_meaning, runtime, schema_version, total_duration_ms |
artifact-manifest.json | structural (no embedded schema string) | object | stable | artifact_count, artifacts, generated_at, hash_algorithm, product_name, product_version, tool_version |
bsi-tr03183-2-presence.json | sbomflow-bsi-sbom-presence-v1 | object | experimental | component_count, disclaimer, fields, fields_total, guideline_url, guideline_version, reference, sbom_format_floors, schema, status_counts |
codex-security-ingest.json | sbomflow-codex-security-ingest-v1 | object | experimental | boundary_note, counts, coverage, findings, generated_at, origin, release_binding, review_status, scan, schema_version, seal, upstream, warnings, zero_findings_note |
cra-coverage.json | structural (carries graph_version + graph_digest) | object | experimental | declared_product_class, generated_at, graph_digest, graph_retrieved, graph_source_urls, graph_version, regulation, regulation_title, requirements, route_info, summary |
cra-guidance-crosswalk.json | sbomflow-cra-guidance-crosswalk-v1 | object | experimental | boundary_note, counts, disclaimer, guidance, model_version, resource_digest, resource_schema_version, schema_version, topics, topics_not_present_in_this_edition |
decision-migration.json | sbomflow-decision-migration-v1 | object | experimental | generated_at, identity_version, reviewer_boundary_note, reviews, schema, summary, waivers |
diagnostic-corpus/manifest.json | sbomflow-diagnostic-corpus-manifest-v1 | object | experimental | boundary_note, controls, corpus_version, fixtures, immutability, reserved_namespace, schema_version |
evidence-pack.json | v3 (structural; no embedded schema string; upgrade with sbomflow upgrade) | object | stable | alias_reconciliation_version, finding_identity_version, annex_i_evidence_inputs, artifacts, build_provenance, component_ambiguities, components, dependency_edges, evidence_gaps, evidence_items, evidence_signals, generated_at, graph, imported_sbom_quality, license_evidence, ntia_minimum_elements, product_class, product_identity, product_name, product_version, purl_normalization_version, reachability, reachability_evidence_inputs, release_drift, release_metadata, requirement_assessments, requirement_graph, route_info, scan_accounting, scan_warnings, schema_registry_posture, unknown_input_candidates, support_policy_evidence, supplier_intake, due_diligence, owner_labels, target_path, technical_documentation_inputs, test_results, tool_version, vulnerabilities, vulnerability_scan |
issues.json | structural (array of issue objects; see the CSV column contract) | array | stable | current_release_id, drift_source, epss_score, evidence_needed, finding_key, gap_id, introduced_in_release, issue_key, issue_type, known_exploited, last_seen_release, lifecycle_status, match_basis, match_confidence, missing_signal, owner_label, previous_release_id, product_name, product_version, reachability_evidence_refs, reachability_status, recommendation, requirement_id, severity, ssvc_outcome, ssvc_outcome_label, suggested_owner, suppression, title, vulnerability_id |
observation-coverage.json | sbomflow-observation-coverage-v1 | object | experimental | dispositions, false_clean, generated_at, limitations, no_aggregate_score_note, ratios, reviewer_boundary_note, schema_version, signals, status, summary, target_path, tool_version |
portable-reissue-plan.json | sbomflow-portable-reissue-plan-v1 | object | experimental | boundary_note, counts, generated_at, inspected_classes, reissue_needed, releases, schema_version, source_store, terminal_state_note, tool_preflight_schema |
preserved-artifact.json | sbomflow-preserved-artifact-v1 | object | experimental | affects_release_gate, artifact, associations, boundary, capture_notes, captured_as_of_meaning, missing, missing_meaning, origin, review_status, review_status_meaning, schema_version, warnings, warnings_meaning |
psirt-case.json | sbomflow-psirt-case-v1 | object | experimental | schema_version, case, vulnerability_report, actors, products, product_families, releases, deployed_versions, affected_components, exposure_assessments, evidence_references, provenance, boundary_note |
reachability.json | sbomflow-reachability-v1 | object | experimental | components, generated_at, reviewer_boundary_note, schema_version, status_vocabulary, summary, target_path, tier_vocabulary, vulnerabilities |
regime-profile-manifest.json | sbomflow-regime-profile-manifest-v1 | object | experimental | authored_by, boundary_note, contains_evidence, content_digest, file_sha256, generated_at, legal_review, member, note, profile_id, profile_version, schema_version, supplier |
regime-profile-validation.json | sbomflow-regime-profile-validation-v1 | object | experimental | boundary_note, content_digest, generated_at, legal_review, legal_review_is_recorded_not_assessed, problem_count, problems, profile_id, schema_version, source, supplier, usable |
regime-view.json | sbomflow-regime-view-v1 | object | experimental | asks, boundary_note, counts, generated_at, profile, schema_version, source_pack |
release-gate.json | structural (no embedded schema string) | object | stable | ai_control_status, approval_status, blocking_epss_ids, blocking_gap_ids, blocking_kev_ids, blocking_license_ids, blocking_reachable_vulnerability_ids, blocking_undetermined_severity_ids, blocking_uninterpretable_epss_ids, blocking_vulnerability_ids, dev_dependency_exempt_ids, dev_exempt_known_exploited_ids, disputed_matches, drift_violation_ids, drift_violations, enforced, epss_threshold, evidence_pack_sha256, evidence_regression_ids, exit_code, finding_suppressions, gap_ids, known_exploited_ids, license_policy_matches, license_policy_note, license_policy_unevaluated, manual_evidence_supplied_vulnerability_ids, needs_review_reachability_vulnerability_ids, new_critical_or_high_ids, new_known_exploited_ids, new_source_referenced_vulnerability_ids, new_vulnerability_ids, not_observed_vulnerability_ids, passed, policy_hash, policy_identity, policy_name, policy_outcomes, policy_source, policy_version, reason, recheck_needed_vulnerability_ids, release_drift_available, severity_threshold, source_referenced_vulnerability_ids, stale_accepted_evidence_ids, support_period_missing_ids, suppressed_vulnerabilities, undetermined_severity_gap_ids, undetermined_severity_vulnerability_ids, uninterpretable_epss_vulnerability_ids, unknown_reachability_vulnerability_ids, unattributed_evidence_ids, unreviewed_evidence_ids, violations, vulnerability_ids, waived_gap_ids, waived_license_ids, waived_vulnerability_ids, waiver_status |
release-record.json | sbomflow-release-record-v1 | object | experimental | artifact_refs, build_provenance_ref, disclaimers, evidence_pack_ref, gate_ref, generated_at, incident_report_ref, product, reachability_ref, release, sbom_refs, schema_version, support_policy_evidence_ref, technical_documentation_ref, tool_version |
run-completion.json | sbomflow-run-completion-v1 | object | experimental | manifest_sha256, produced_artifacts, requested_artifacts, requested_missing, run_completeness, run_id, schema_version |
scan-warnings.json | structural (no embedded schema string) | object | stable | warning_count, warnings |
source-change-impact.json | sbomflow-source-change-impact-v1 | object | experimental | boundary_note, candidate_state_meanings, compared_at, counts, event_vocabulary, header, records, refusals, release_candidates, release_index, releases, schema_version, sources |
index.json | sbomflow-store-v1 | object | experimental | entries, entry_count, generated_at, schema_version, store_root |
unknown-input-candidates.json | sbomflow-unknown-input-candidates-v1 | object | experimental | candidates, confidence_vocabulary, generated_at, promotion_rule, reviewer_boundary_note, ruleset_digest, ruleset_version, sampling_note, schema_version, summary, target_path, tool_version, truncated |
vulnerability-link-candidates.json | sbomflow-vuln-link-candidates-v1 | object | experimental | schema_version, generated_by, authority, method, corpus, bounds, discovery_outcome, examined, candidates |
vuln-source-health.json | sbomflow-vuln-source-health-v1 | object | experimental | findings, generated_at, intelligence_provenance_note, no_real_source_configured, no_source_configured, real_intelligence_available, reviewer_boundary_note, schema, source_set, sources, synthetic_intelligence_used, usable_intelligence |
vulnerability-replay-verification.json | sbomflow-vulnerability-replay-verification-v1 | object | experimental | advisory, generated_at, note, purpose_contrast, releases, schema, store_root, summary, verdict_semantics, vulndb_root |
Every artifact above is produced by analyze / audit unless its sbomflow schema show detail says otherwise.
External SBOM formats#
SBOMFlow also emits standard SBOM documents that follow their own published schemas rather than an SBOMFlow one:
cyclonedx-sbom.json — CycloneDX 1.6 (owasp.org/cyclonedx)cyclonedx-vex.json — CycloneDX 1.6 VEX (opt-in: --emit-vex)cyclonedx-vdr.json — CycloneDX 1.6 VDR (opt-in: --emit-vdr)spdx-sbom.json — SPDX 2.3 (spdx.dev)spdx3-sbom.json — SPDX 3.0.1 JSON-LD (opt-in: --emit-spdx3)cyclonedx-mlbom.json — CycloneDX 1.6 ML-BOM (opt-in: --emit-mlbom)spdx3-aibom.json — SPDX 3.0.1 AI + Dataset profiles (opt-in: --emit-aibom)findings.sarif — SARIF 2.1.0, OASIS (opt-in: --emit-sarif)csaf-vex.json — CSAF 2.0, OASIS (written whenever VEX is emitted;auditalways emits)vex.json — OpenVEX 0.2.0 (opt-in: --emit-vex)engineering-release-notes.cdx.json — CycloneDX 1.7 release notes (opt-in: compare-releases --release-notes-format cyclonedx\|both)
These are validated structurally against the upstream specification.
If the page looks wrong#
This reference is generated from the running product, so a mismatch between it and an artifact your version wrote is a bug we want to know about. Include the artifact name and your SBOMFlow version. See the FAQ for how to get support.