Development
SBOM SPDX CycloneDX License Policy Auditor
Audit SPDX 2.3 or CycloneDX 1.5 component licenses and emit SARIF with failing dependency paths
text· Text resultOpen tool
Quick start
Call this tool from your code in three languages.
cURL
# 1) Request a presigned URL → returns { uploadUrl, storageKey }
curl -X POST 'https://api.elysiatools.com/api/upload/presign/sbom-spdx-cyclonedx-license-policy-auditor' \
-H 'Content-Type: application/json' \
-d '{"filename":"sbomFile.ext","contentType":"application/octet-stream","size":12345}'
# 2) PUT the file bytes directly to the presigned uploadUrl
curl -X PUT '<presigned uploadUrl>' \
--data-binary @/path/to/file.ext
# 3) Call the tool, passing the returned storageKey for each file field
curl -X POST 'https://api.elysiatools.com/en/api/tools/sbom-spdx-cyclonedx-license-policy-auditor' \
-F 'sbomInput={"spdxVersion":"SPDX-2.3","SPDXID":"SPDXRef-DOCUMENT","documentDescribes":["SPDXRef-App"],"packages":[{"SPDXID":"SPDXRef-App","name":"app","versionInfo":"1.0","licenseConcluded":"MIT"},{"SPDXID":"SPDXRef-Lib","name":"server-lib","versionInfo":"2.0","licenseDeclared":"AGPL-3.0-only"}],"relationships":[{"spdxElementId":"SPDXRef-App","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Lib"}]}' \
-F 'sbomFile=uploads/2026/01/01/your-tool-1700000000000-abc123.ext' \
-F 'sbomFormat=auto' \
-F 'policyPreset=balanced' \
-F 'copyleftTolerance=weak' \
-F 'allowedLicenses=' \
-F 'deniedLicenses=AGPL-3.0-only' \
-F 'failOnUnknown=true' \
-F 'reportFormat=sarif'