# SbomManifestDto

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

Expanded view of one SBOM build: the build summary plus every
CycloneDX component document available for download.

## Fields
- `build` ([SbomBuildDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SbomBuildDto.md)): Summary record for one build in the SBOM evidence store. A build is one release: a version and commit of the instance's own distribution, with one CycloneDX document per deployable component (for example the web application or a background worker).
  Fields:
  - `buildId` (string): Opaque key for the build. Take it from the build list and pass it back to read the build or download one of its documents; do not compose it. (nullable)
  - `createdUtc` (string(date-time)): UTC time the pipeline filed the build's first document in the evidence store.
  - `commitSha` (string): Git commit SHA that produced the build. (nullable)
  - `branch` (string): Branch the build was produced from (e.g. `refs/heads/develop`). (nullable)
  - `environment` (string): Environment label associated with the build. Always null: a build is not built for an environment, and which environment runs which build is recorded at deploy time. (nullable)
  - `componentCount` (integer(int32)): Number of deployable components with a CycloneDX document in this build.
  - `distribution` (string): The distribution the build belongs to: `core`, or `fork-{slug}` for a build of a licensed source fork. (nullable)
  - `version` (string): The build number the release pipeline assigned. (nullable)
  - `pipelineRunId` (string): The pipeline run that produced the build. (nullable)
  - `isRunningBuild` (boolean): True when this is the build this instance is running, confirmed by the digest it was deployed from; false when the running build is identified and this is a different one; null when the running build is not identified, so no build can be called the running one. (nullable)
- `components` (array<[SbomComponentDto](https://devportal.signapay-sbx.winkpg.io/docs/api/models/SbomComponentDto.md)>): One entry per deployable, ordered by name. (nullable)
  Fields of each item:
  - `name` (string): The deployable's service name (e.g. `blazor`, `trxmanager`, `dbmigrator`), used as the component name in the download path. Filename of the download is `{Name}.cdx.json`. (nullable)
  - `description` (string): Human-readable description. Always null: the SBOM evidence store records none. (nullable)
  - `specVersion` (string): CycloneDX specification version used to generate this document. (nullable)
  - `sizeBytes` (integer(int64)): Size of the CycloneDX JSON document in bytes.
  - `digest` (string): `sha256:{hex}` digest of the image or artifact the document describes. (nullable)
  - `digestKind` (string): `image` for a container image digest, `artifact` for the sha256 of a deployed file. (nullable)
  - `matchesThisInstance` (boolean): True when this is this instance's own deployable and the document's digest is the digest the instance was deployed from; null for every other deployable, whose deployed digest this instance does not know. (nullable)

## See also

- [All documentation](https://devportal.signapay-sbx.winkpg.io/llms.txt): the machine-readable index of every public page on this site.