Query: allSoftwareComponentInstances

If this is set to the value of the _cursor field of an item, only items after that one will be included in the result. The value of the after of this query must match the one where the _cursor value has been retrieved from.

The number of items to include in the result. If omitted, all remaining items will be included (which can cause performance problems on large collections).

Specifies the how this collection should be sorted. If omitted, the result order is not specified. If cursor-based pagination is used (i.e., the after is specified or the _cursor is requested), id_ASC will be implicitly added as last sort criterion so that the sort order is deterministic.

The number of items in the list or collection to skip. Is applied after the after argument if both are specified.

Comments made on this component.

The history of statuses related to this software component instance.

Copyright information that applies to this software component instance. When present, these are to be treated as 'overrides' for the copyrights listed on the underlying SoftwareCompoent.

Provides a value that can be supplied to the after argument for pagination. Depends on the value of the orderBy argument.

The relationships to other components where this component is the "dest"

The external references of this component

Files associated with this software component instance

The findings associated with this software component instance.

Independently reproducible mechanisms for identifying specific contents of a component or package based on the actual files

License exceptions that apply to this software component instance. When present, these are to be treated as 'overrides' for the license exceptions listed on the underlying SoftwareCompoent.

Software licenses that apply to this software component instance. When present, these are to be treated as 'overrides' for the licenses listed on the underlying SoftwareCompoent.

The aggregated list of comments for all component instances that are merged into this component instance

The aggregated list of statuses for all component instances that are merged into this component instance

The aggregated list of all dest relationships for all original component instances that led to the creation of this merged component instance.

The aggregated list of all files for the original component instances that led to the creation of this merged component instance.

If this Finding is a 'merged finding', this list contains the underlying component instances that this component instance represents

The aggregated list of all source relationships for all original component instances that led to the creation of this merged component instance.

The collection of test tools associated with original components that led to the creation of this merged component

Any kind of processing currently occurring on this component instance

The properties associated with this component

An identifier that is updated automatically on each update of this root entity (but not on relation changes)

The relationships to other components where this component is the "source"

Absolute Risk Score

The asset version this component is associated with

The asset version id this component is associated with

The user who is assigned to this component. This is an experimental field and subject to change.

The author of this component. When present, this is to be treated as an 'override' for the author listed on the underlying SoftwareCompoent.

The build date of this component

Comments made on this component.

The history of statuses related to this software component instance.

The confidence value that Finite State analysis has assigned to this component.

Copyright information that applies to this software component instance. When present, these are to be treated as 'overrides' for the copyrights listed on the underlying SoftwareCompoent.

The instant this object has been created

The user who created this component. If is user created.

Context contains fields that are accessible to the permissions profile. This is an internal field related to user permissions.

The current status for this software component instance.

The date the software component was first discovered.

A hash that is used for deduplication against other software component instances.

Timestamp of when this software component instance was deleted

The relationships to other components where this component is the "dest"

The detailed description of this component

The download URL, or a specific location within a version control system (VCS) for the component or package

The external references of this component

The actual file name of the component or package, or path of the directory being treated as a package.

Files associated with this software component instance

Indicated whether the files were analyzed for this package

The findings associated with this software component instance.

First or third party source

The grouping name or identifier associated with this component. When present, this is to be treated as an 'override' for the group listed on the underlying SoftwareCompoent.

Independently reproducible mechanisms for identifying specific contents of a component or package based on the actual files

An auto-generated string that identifies this root entity uniquely among others of the same type

Deprecated. See supportEol for EOL data.

License exceptions that apply to this software component instance. When present, these are to be treated as 'overrides' for the license exceptions listed on the underlying SoftwareCompoent.

Software licenses that apply to this software component instance. When present, these are to be treated as 'overrides' for the licenses listed on the underlying SoftwareCompoent.

If populated, this field points to the 'merged component instance' that represents this component instance. This field is related to deduplicating multiple instances of the same component that may be detected by different tests.

If populated, this field points to the 'merged component id' that represents this component instance. This field is related to deduplicating multiple instances of the same component that may be detected by different tests.

The mime-type of this component. Must match regular expression - ^[-+a-z0-9.]+/[-+a-z0-9.]+$

The name of the software component instance

The origin of this software component instance (e.g. test, user-added, generated by an automated or user merge, etc.)

If this Finding is a 'merged finding', this list contains the underlying component instances that this component instance represents

The aggregated list of comments for all component instances that are merged into this component instance

The aggregated list of statuses for all component instances that are merged into this component instance

The aggregated list of all dest relationships for all original component instances that led to the creation of this merged component instance.

The aggregated list of all files for the original component instances that led to the creation of this merged component instance.

The aggregated list of all source relationships for all original component instances that led to the creation of this merged component instance.

The collection of test tools associated with original components that led to the creation of this merged component

Identifies from where or whom the package originally came. In some cases, a package may be created and originally distributed by a different third part than the Package Supplier of the package

The boolean aggregated patches of all Findings associated with this SoftwareComponentInstance True if there are patches that are not null

Any kind of processing currently occurring on this component instance

The properties associated with this component

The publisher of this component. When present, this is to be treated as an 'override' for the publisher listed on the underlying SoftwareCompoent.

The original tool-specific ID of the component. This ID is specific to the test tool itself, such as a bom-ref from a CycloneDX document or an SPDXRef from an SPDX SBOM.

The release date of this component

The notes associated with the software component release

Specifies the scope of the component. If scope is not specified, 'required' scope SHOULD be assumed by the consumer of the BOM

The Software Component associated with this instance. The Software Component contains common information about the component that is not specific to a particular instance.

The software identifiers associated with this software component instance.

The relationships to other components where this component is the "source"

The summary description of this component

The supplier associated with this component. When present, this is to be treated as an 'override' for the supplier listed on the underlying SoftwareCompoent.

The support end-of-life date for this component. Timestamp '1970-01-01T00:00:00Z' indicates an unknown end-of-life date that has already passed.

The test that detected or reported the presence of this software component instance

The aggregated risk score of all Findings associated with this SoftwareComponentInstance

The type of software component instance (e.g. application, library, framework, etc)

The instant this object has been updated the last time (not including relation updates)

The user who updated the component instance

The URL to the homepage of the provider of the software component instance

The version of the software component instance