Artifact schemas
SBOMFlow writes plain JSON files into a directory you choose — those files are the system of record. This page is the field-level reference for each documented artifact: its filename, its schema identifier, and the top-level keys it carries. For a plain-English overview of what each file is for and who reads it, see evidence outputs.
Note
This page is generated from the product's artifact schema registry, so it
always matches the artifacts your installed version writes. Explain any schema
offline with sbomflow schema (the whole registry) or `sbomflow schema show
<family>` (one artifact, with its exact top-level keys).
Timestamps. Every generated_at (and any other timestamp an artifact records) is one canonical UTC form — YYYY-MM-DDTHH:MM:SS+00:00, microseconds preserved when supplied. --as-of accepts a trailing Z, any explicit offset, or a bare date, and normalizes it to this form before anything is written, so equivalent inputs always produce byte-identical artifacts (see the E006 error reference).
Every artifact here is an engineering record. A schema documents structure, never a compliance conclusion: an artifact's presence or shape is not a claim of CRA conformity or legal sufficiency, and observed fields are never a substitute for human review.
How to read the table#
- Artifact — the filename written into the output directory. An artifact marked printed to stdout is a document a command prints under
--json; it is never written as a file, and its name only labels the document. - Schema — the stable schema identifier. Some artifacts are structural (validated by shape rather than an embedded schema string); that is stated verbatim.
- Shape — whether the top level is a JSON
objector anarray(for an array, the keys listed are the keys of each element). - Stability — the integrator compatibility class. A stable artifact's existing top-level keys will not be removed or renamed without a
schema_versionbump and a migration (new keys may still be added); an experimental artifact may change without notice, so do not hard-depend on it yet. - Top-level keys — the keys present at the top level of the artifact.
Documented artifacts#
| Artifact | Schema | Shape | Stability | Top-level keys |
|---|---|---|---|---|
advisory-reconciliation.json | sbomflow-advisory-reconciliation-v1 | object | experimental | finding_count, findings, generated_at, reviewer_boundary_note, schema, severity_conflict_count, watchlist_sources |
ai-evidence.json | sbomflow-ai-evidence-v1 | object | experimental | adapters, agent_authority, compiled_engines, ai_scan_performed, boundary, container_coverage, counts, datasets, discovery, evaluations, evidence_aging, gpai_integration, graph, lineage, manifest_supplied, mcp_server_cards, multimodal_systems, note, observed_model_artifacts, prompts, provider_declarations, reconciliation, release_id, runtime_reconciliation, serving, shard_sets, scan_warnings, schema, supplier_ai_boms, traversal |
ai-evidence-map.json | sbomflow-ai-evidence-map-v1 | object | experimental | boundary, counts, human_records_note, human_records_supplied, maps, maps_digest, observation_scope_note, probes, schema |
analysis-control-receipt.json | sbomflow-analysis-control-receipt-v1 | object | experimental | advisory_source, boundary_note, control_accounting, control_health, control_health_meaning, controls, corpus, counts, distribution, entry_point, limits, observed_at, observed_at_state, observed_at_state_meaning, runtime, schema_version, total_duration_ms |
artifact-manifest.json | structural (no embedded schema string) | object | stable | artifact_count, artifacts, generated_at, hash_algorithm, product_name, product_version, tool_version |
assessment-findings-ledger.json | sbomflow-assessment-findings-ledger-v1 | object | experimental | affects_release_gate, boundary, carry_forward, decision_states, findings, generated_at, input, review_key_format, schema_version, skipped_entries, source, status_meanings, summary, undeclared_decisions, undeclared_decisions_note, warnings |
bsi-tr03183-2-presence.json | sbomflow-bsi-sbom-presence-v1 | object | experimental | component_count, disclaimer, fields, fields_total, guideline_url, guideline_version, reference, sbom_format_floors, schema, status_counts |
build-applicability.json | sbomflow-build-applicability-v1 | object | experimental | basis, bounds, bounds_hit, bounds_hit_by, build_system, compiled_source_count, compiled_sources, complete, incomplete_reasons, inputs_examined, inputs_read, inputs_unreadable, inputs_without_source, note, observation_basis, paths_refused, schema, tree_digest, warnings |
build-cve-report-ingest.json | sbomflow-build-cve-report-ingest-v1 | object | experimental | beside_findings, format, note, observation_count, observations, pass, producer_release, producer_release_basis, report_file, rows_capped, schema, status_counts, statuses_outside_vocabulary, tool_recorded, truncated_fields, unknown_key_occurrences, unknown_keys, unreadable_rows |
cle-export-receipt.json | sbomflow-cle-export-receipt-v1 | object | experimental | document, event_id_order, events, input, meaning, not_emitted, product, releases, schema_version, tool_version |
codex-security-ingest.json | sbomflow-codex-security-ingest-v1 | object | experimental | boundary_note, counts, coverage, findings, generated_at, origin, release_binding, review_status, scan, schema_version, seal, upstream, warnings, zero_findings_note |
component-support.json | sbomflow-component-support-v1 | object | experimental | affects_release_gate, boundary, component_support_changes, components, config_key, declaration_files, generated_at, schema_version, snapshot_files, stale_after_days, summary, support_gap, support_gap_basis, unmatched_declarations, unmatched_snapshot_records, warnings |
covered-software.json | sbomflow-covered-software-v1 | object | experimental | affects_release_gate, boundary, config_key, entries, generated_at, schema_version, summary |
cpe-candidates.json | sbomflow-cpe-candidates-v1 | object | experimental | boundary, candidates, carry_forward, config_key, coverage, dispositions_not_honoured, dispositions_without_candidate, false_positive_caveat, generated_at, incompleteness_caveat, match_basis, match_confidence, schema_version, snapshot, summary, tool_version, vendored_header_table, warnings |
cra-coverage.json | structural (carries graph_version + graph_digest) | object | experimental | declared_product_class, generated_at, graph_digest, graph_retrieved, graph_source_urls, graph_version, regulation, regulation_title, requirements, route_info, summary |
cra-guidance-crosswalk.json | sbomflow-cra-guidance-crosswalk-v1 | object | experimental | boundary_note, counts, disclaimer, guidance, model_version, resource_digest, resource_schema_version, schema_version, topics, topics_not_present_in_this_edition |
csaf-provider-tree-receipt.json | sbomflow-csaf-provider-tree-v1 | object | experimental | boundary, document_count, documents, files, mandatory_test_outcome_meanings, provider_metadata_note, publisher_namespace, requirements, schema_version, security_txt_line |
custody-comparison.json printed to stdout by custody compare --json | sbomflow-custody-comparison-v1 | object | experimental | added, affects_release_gate, boundary, changes_total, comparable, decision_changed, generated_at, left, original_state_changed, reason, record_changed, removed, right, schema_version |
custody-export.json | sbomflow-custody-export-v1 | object | experimental | affects_release_gate, archive, audit_chain, boundary, decisions, declared_release, generated_at, index, index_sha256, issuing_party, issuing_party_note, member_count, members, originals_carried, originals_note, readable_index, recipient, recipient_note, schema_version, seal, selection, selection_seal, set_id, signature, stated_retention, stated_retention_meaning, verification |
custody-export.sig.json | sbomflow-custody-export-signature-v1 | object | experimental | artifact, key_id, key_type, note, schema_version, sha256, signature, signed_at |
custody-hold.json | sbomflow-custody-hold-v1 | object | experimental | affects_release_gate, audit_event, boundary, generated_at, operation, outcome, preservation_hold, schema_version, set_id |
custody-operation.json printed to stdout by custody init --json, custody add --json | sbomflow-custody-operation-v1 | object | experimental | affects_release_gate, boundary, generated_at, intake, operation, outcome, row, schema_version, set_id, stated_retention, warnings |
custody-review-result.json printed to stdout by custody review --json | sbomflow-custody-review-result-v1 | object | experimental | boundary, converged, decision_file, key, operation_id, reviewed_at, reviewer, schema_version, status |
custody-set.json | sbomflow-custody-set-v1 | object | experimental | affects_release_gate, audit_event_count, boundary, capture_sessions, capture_sessions_meaning, declared_release, entry_count, generated_at, issuing_party, missing, rows, schema_version, seal, set_id, stated_retention, stated_retention_meaning |
custody-show.json printed to stdout by custody show --json | sbomflow-custody-show-v1 | object | experimental | affects_release_gate, boundary, decisions, generated_at, records, row, schema_version, set_id |
custody-verify.json printed to stdout by custody verify --json | sbomflow-custody-verify-v1 | object | experimental | affects_release_gate, audit_chain, boundary, decisions, generated_at, integrity_ok, orphans, originals, originals_refused, problems, rows, schema_version, seal, set_id, strict, warnings |
cyclonedx-vdr-ingest.json | sbomflow-cyclonedx-vdr-ingest-v1 | object | experimental | beside_findings, document_recorded, note, observation_count, observations, ref_resolution_counts, report_file, rows_capped, schema, supplier_vex_conflict_checked, tool, tool_analysis_state_counts, tool_analysis_states_outside_vocabulary, truncated_fields, unknown_key_occurrences, unknown_keys, unreadable_rows, unresolved_affects_refs |
decision-migration.json | sbomflow-decision-migration-v1 | object | experimental | generated_at, identity_version, reviewer_boundary_note, reviews, schema, summary, waivers |
deployed-environment.json | sbomflow-deployed-environment-v1 | object | experimental | boundary, comparison_state, config_key, declaration, entries, environment, flags, generated_at, is_monitoring, provenance, release, sbomflow_contacted_nothing, schema_version, source, summary, summary_line, taken_at, taken_at_later_than_run, warnings |
device-advisory-context.json | sbomflow-device-advisory-context-v1 | object | experimental | boundary, config_key, coverage, declared_devices, devices_without_observation, documents, generated_at, match_rules, near_misses, observations, schema_version, sources, summary_line, unmatched_names_under_declared_vendor, vers |
diagnostic-corpus/manifest.json | sbomflow-diagnostic-corpus-manifest-v1 | object | experimental | boundary_note, controls, corpus_version, fixtures, immutability, reserved_namespace, schema_version |
evidence-pack.json | v3 (structural; no embedded schema string; upgrade with sbomflow upgrade) | object | stable | alias_reconciliation_version, finding_identity_version, annex_i_evidence_inputs, artifacts, build_provenance, component_ambiguities, components, dependency_edges, evidence_gaps, evidence_items, evidence_signals, generated_at, graph, imported_sbom_quality, license_evidence, ntia_minimum_elements, product_class, product_identity, product_name, product_version, purl_normalization_version, reachability, reachability_evidence_inputs, release_drift, release_metadata, requirement_assessments, requirement_graph, route_info, scan_accounting, scan_warnings, schema_registry_posture, unknown_input_candidates, support_policy_evidence, supplier_declared_crypto, supplier_intake, due_diligence, owner_labels, target_path, technical_documentation_inputs, test_results, tool_version, vulnerabilities, vulnerability_scan |
exploitation-delta.json | sbomflow-exploitation-delta-v1 | object | experimental | added_id_summary, added_ids, counts, cpe_candidate_note, cpe_candidates_not_consulted, examined_releases, exposures, from, meaning, removed_ids, removed_ids_note, schema_version, scope, snapshot_order, support_lifecycle_note, support_state_evaluated_at, support_state_note, to, tool, unexaminable_releases, vulndb_store |
goals.json | sbomflow-goals-v1 | object | experimental | exclusions, goals, placeholders, positioning, schema_version |
issues.json | structural (array of issue objects; see the CSV column contract) | array | stable | current_release_id, drift_source, epss_score, evidence_needed, finding_key, gap_id, introduced_in_release, issue_key, issue_type, known_exploited, last_seen_release, lifecycle_status, match_basis, match_confidence, missing_signal, owner_label, previous_release_id, product_name, product_version, reachability_evidence_refs, reachability_status, recommendation, requirement_id, severity, ssvc_outcome, ssvc_outcome_label, suggested_owner, suppression, title, vulnerability_id |
observation-coverage.json | sbomflow-observation-coverage-v1 | object | experimental | dispositions, false_clean, generated_at, limitations, no_aggregate_score_note, ratios, reviewer_boundary_note, schema_version, signals, status, summary, target_path, tool_version |
oci-layout-evidence.json | sbomflow-oci-layout-release-evidence-v1 | object | experimental | boundary, comparison_with_previous, config_key, generated_at, images, schema_version, summary |
portable-reissue-plan.json | sbomflow-portable-reissue-plan-v1 | object | experimental | boundary_note, counts, generated_at, inspected_classes, reissue_needed, releases, schema_version, source_store, terminal_state_note, tool_preflight_schema |
preserved-artifact.json | sbomflow-preserved-artifact-v1 | object | experimental | affects_release_gate, artifact, associations, boundary, capture_notes, captured_as_of_meaning, missing, missing_meaning, origin, review_status, review_status_meaning, schema_version, warnings, warnings_meaning |
preserved-artifact-changes.json | sbomflow-preserved-artifact-changes-v1 | object | experimental | affects_release_gate, boundary, comparison_with_previous, schema_version |
preserved-artifacts.json | sbomflow-preserved-artifact-index-v1 | object | experimental | affects_release_gate, boundary, capture_sessions, capture_sessions_meaning, decisions_meaning, declared_count, originals_meaning, refused, review_key_format, rows, schema_version, state, state_meaning, summary, undeclared_decisions, warnings |
psirt-case.json | sbomflow-psirt-case-v1 | object | experimental | schema_version, case, vulnerability_report, actors, products, product_families, releases, deployed_versions, affected_components, exposure_assessments, evidence_references, provenance, boundary_note |
reachability.json | sbomflow-reachability-v1 | object | experimental | components, generated_at, reviewer_boundary_note, schema_version, status_vocabulary, summary, target_path, tier_vocabulary, vulnerabilities |
regime-profile-manifest.json | sbomflow-regime-profile-manifest-v1 | object | experimental | authored_by, boundary_note, contains_evidence, content_digest, file_sha256, generated_at, legal_review, member, note, profile_id, profile_version, schema_version, supplier |
regime-profile-validation.json | sbomflow-regime-profile-validation-v1 | object | experimental | boundary_note, content_digest, generated_at, legal_review, legal_review_is_recorded_not_assessed, problem_count, problems, profile_id, schema_version, source, supplier, usable |
regime-view.json | sbomflow-regime-view-v1 | object | experimental | asks, boundary_note, counts, generated_at, profile, schema_version, source_pack |
release-gate.json | structural (no embedded schema string) | object | stable | ai_control_status, approval_status, blocking_epss_ids, blocking_gap_ids, blocking_kev_ids, blocking_license_ids, blocking_reachable_vulnerability_ids, blocking_undetermined_severity_ids, blocking_uninterpretable_epss_ids, blocking_vulnerability_ids, dev_dependency_exempt_ids, dev_exempt_known_exploited_ids, disputed_matches, drift_violation_ids, drift_violations, enforced, epss_threshold, evidence_pack_sha256, evidence_regression_ids, exit_code, finding_suppressions, gap_ids, known_exploited_ids, license_policy_matches, license_policy_note, license_policy_unevaluated, manual_evidence_supplied_vulnerability_ids, needs_review_reachability_vulnerability_ids, new_critical_or_high_ids, new_known_exploited_ids, new_source_referenced_vulnerability_ids, new_vulnerability_ids, not_observed_vulnerability_ids, passed, policy_hash, policy_identity, policy_name, policy_outcomes, policy_source, policy_version, reason, recheck_needed_vulnerability_ids, release_drift_available, severity_threshold, source_referenced_vulnerability_ids, stale_accepted_evidence_ids, support_period_missing_ids, suppressed_vulnerabilities, undetermined_severity_gap_ids, undetermined_severity_vulnerability_ids, uninterpretable_epss_vulnerability_ids, unknown_reachability_vulnerability_ids, unattributed_evidence_ids, unreviewed_evidence_ids, violations, vulnerability_ids, waived_gap_ids, waived_license_ids, waived_vulnerability_ids, waiver_status |
release-record.json | sbomflow-release-record-v1 | object | experimental | artifact_refs, build_provenance_ref, disclaimers, evidence_pack_ref, gate_ref, generated_at, incident_report_ref, preserved_artifact_refs, product, reachability_ref, release, sbom_refs, schema_version, support_policy_evidence_ref, technical_documentation_ref, tool_version |
reqif-export-receipt.json | sbomflow-reqif-export-receipt-v1 | object | experimental | counts, document, elements, exploitation_delta, identifier_rule, last_change, meaning, not_exported, schema_version, source, tool_version |
requirement-catalog-view.json | sbomflow-requirement-catalog-view-v1 | object | experimental | boundary, catalogs, config_key, generated_at, is_gate_input, meaning, provenance, requirement_regime, schema_version, state_meanings, summary, supplier, warnings |
run-completion.json | sbomflow-run-completion-v1 | object | experimental | declared_not_applicable, manifest_sha256, produced_artifacts, requested_artifacts, requested_missing, run_completeness, run_id, schema_version |
sbom-concordance.json | sbomflow-sbom-concordance-v1 | object | experimental | boundary, changes_no_canonical_inventory, dimensions, elects_no_winner, input_count, inputs, parser, reasons, schema_version, state, state_meaning, subject_binding, subject_binding_meaning, subject_binding_verified, subject_digest_measured, supported_input_count, unsupported_input_count, warnings |
scan-warnings.json | structural (no embedded schema string) | object | stable | warning_count, warnings |
source-change-impact.json | sbomflow-source-change-impact-v1 | object | experimental | boundary_note, candidate_state_meanings, compared_at, counts, event_vocabulary, header, records, refusals, release_candidates, release_index, releases, schema_version, sources |
index.json | sbomflow-store-v1 | object | experimental | entries, entry_count, generated_at, schema_version, store_root |
supplier-sbom-correspondence.json | sbomflow-supplier-sbom-correspondence-v1 | object | experimental | affects_acceptance, affects_release_gate, boundary, counts, merges_nothing, rows, schema_version, warnings |
supplier-sbom-field-presence.json | sbomflow-supplier-sbom-presence-v1 | object | experimental | boundary, carriers, documents, presence_reader, schema_version, status_meanings, summary, warnings |
unknown-input-candidates.json | sbomflow-unknown-input-candidates-v1 | object | experimental | candidates, confidence_vocabulary, generated_at, promotion_rule, reviewer_boundary_note, ruleset_digest, ruleset_version, sampling_note, schema_version, summary, target_path, tool_version, truncated |
update-payload-binding.json | sbomflow-update-payload-binding-v1 | object | experimental | boundary, draft_snippets, generated_at, hash_algorithms, meaning, payloads, release, schema_version, summary, warnings |
vulnerability-link-candidates.json | sbomflow-vuln-link-candidates-v1 | object | experimental | schema_version, generated_by, authority, method, corpus, bounds, discovery_outcome, examined, candidates |
vuln-source-health.json | sbomflow-vuln-source-health-v1 | object | experimental | findings, generated_at, intelligence_provenance_note, no_real_source_configured, no_source_configured, real_intelligence_available, reviewer_boundary_note, schema, source_set, sources, synthetic_intelligence_used, usable_intelligence |
vulnerability-replay-verification.json | sbomflow-vulnerability-replay-verification-v1 | object | experimental | advisory, generated_at, note, purpose_contrast, releases, schema, schema_version, store_root, summary, verdict_semantics, vulndb_root |
Every artifact above is produced by analyze / audit unless its sbomflow schema show detail says otherwise.
Input formats you write#
Formats SBOMFlow reads and never writes. Each ships a JSON Schema in the installed package (sbomflow/data/schemas/sbomflow/) and is listed by sbomflow schema list.
| Format | JSON Schema | Stability | Read by | What it is |
|---|---|---|---|---|
sbomflow-assessment-findings v1 | assessment-findings-v1.schema.json | experimental | analyze/audit --assessment-findings | Assessment findings — the findings one assessment report listed, as the operator restates them |
sbomflow-custody-intake v1 | custody-intake-v1.schema.json | experimental | custody add --intake-manifest | Custody intake manifest — the files one custody add admits, all or none |
sbomflow-custom-manifest v1 | custom-manifest-v1.schema.json | experimental | analyze/audit --import-custom-manifest | Custom manifest — explicit manufacturer component + dependency handoff |
sbomflow-deployed-environment-declaration v1 | deployed-environment-declaration-v1.schema.json | experimental | analyze/audit (release.deployed_environment) | Deployed-environment declaration — what one environment runs, as the operator states it |
External SBOM formats#
SBOMFlow also emits standard SBOM documents that follow their own published schemas rather than an SBOMFlow one:
cyclonedx-sbom.json — CycloneDX 1.6 (owasp.org/cyclonedx)cyclonedx-vex.json — CycloneDX 1.6 VEX (opt-in: --emit-vex)cyclonedx-vdr.json — CycloneDX 1.6 VDR (opt-in: --emit-vdr)spdx-sbom.json — SPDX 2.3 (spdx.dev)spdx3-sbom.json — SPDX 3.0.1 JSON-LD (opt-in: --emit-spdx3)cyclonedx-mlbom.json — CycloneDX 1.6 ML-BOM (opt-in: --emit-mlbom)spdx3-aibom.json — SPDX 3.0.1 AI + Dataset profiles (opt-in: --emit-aibom)findings.sarif — SARIF 2.1.0, OASIS (opt-in: --emit-sarif)csaf-vex.json — CSAF 2.0, OASIS (written whenever VEX is emitted and a vulnerability is to be stated;auditalways emits VEX)vex.json — OpenVEX 0.2.0 (written whenever VEX is emitted and a statement is to be made;auditalways emits VEX)engineering-release-notes.cdx.json — CycloneDX 1.7 release notes (opt-in: compare-releases --release-notes-format cyclonedx\|both)
These are validated structurally against the upstream specification.
If the page looks wrong#
This reference is generated from the running product, so a mismatch between it and an artifact your version wrote is a bug we want to know about. Include the artifact name and your SBOMFlow version. See the FAQ for how to get support.