# A CycloneDX or SPDX SBOM, without adding anything to your CI.

Source: https://libwatch.com/en/features/sbom-export

Feature · SBOM

LibWatch already knows every dependency of your projects. It turns them into a machine-readable software bill of materials, validated against the official schemas, ready to download in one click.

[Generate an SBOM](https://app.libwatch.com/users/sign_up)

orders-api-cyclonedx-sbom.json

```
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "type": "library",
      "name": "symfony/http-kernel",
      "version": "6.4.1",
      "purl": "pkg:composer/symfony/http-kernel@6.4.1"
    }
  ]
}
```

Two formats

## CycloneDX for security, SPDX for licenses

JSON
### CycloneDX 1.5

— The format most requested by security tools.

— Can be imported into OWASP Dependency-Track.

— Name, version, registry and purl identifier of each component.

JSON
### SPDX 2.3

— The Linux Foundation standard, focused on licenses.

— Useful for open source compliance.

— The same components, in a different structure.

In practice

## From analysis to file

The SBOM always follows the project's latest analysis.

### Open the project

The SBOM uses its latest completed analysis, or a specific analysis.

### Choose the format

CycloneDX or SPDX, in JSON.

### Download it, or query it over MCP

The SBOM summary is also available to your AI assistants.

Other exports

## For your clients and your audits

PDF

### Printable report

One page per project, to save as a PDF for a report.

CSV and JSON

### Raw data

For your spreadsheets and scripts.

Link

### Public sharing

The project's score and its trend, no account needed.

Frequently asked questions

## About SBOMs

### Does the SBOM cover transitive dependencies?

 It includes everything the lockfile describes. With a lockfile, transitive dependencies are included.

### Is the SBOM enough for the CRA?

 No, not on its own. The CRA requires a machine-readable SBOM, which CycloneDX and SPDX are, but also vulnerability handling and technical documentation, of which the SBOM is only one part. See [what the CRA and NIS2 require](/en/features/cra-nis2-compliance).

### Can I import it into Dependency-Track?

 Yes. The CycloneDX 1.5 JSON file imports into OWASP Dependency-Track like any CycloneDX SBOM.

## Your SBOM is waiting for you after the first analysis.

[Try it for 14 days](https://app.libwatch.com/users/sign_up)