René's URL Explorer Experiment

Title: ROX-30569: Add SBOM Scanning REST API to Central by dcaravel · Pull Request #18484 · stackrox/stackrox · GitHub

Open Graph Title: ROX-30569: Add SBOM Scanning REST API to Central by dcaravel · Pull Request #18484 · stackrox/stackrox

X Title: ROX-30569: Add SBOM Scanning REST API to Central by dcaravel · Pull Request #18484 · stackrox/stackrox

Description: Description Adds the /api/v1/sboms/scan custom route and handler to facilitate SBOM scanning. Reading the SBOM content from the request and scanning it will be handled in a future PR - a fake response is returned for now. A few decisions to call out (happy to change as needed): Even though SBOMs can represent 'anything', the new API endpoint requires Image write permission (for now) given there isn't another already existing permission that fits better, and the initial use case is primarily for scanning SBOMs for images, seems an OK compromise until we decide if a new permission should be created. The handler code was placed in the image service location to align with ^^, but was kept isolated from the existing SBOM generation handler so that it can be moved elsewhere easily as needed in the future. Max size of request payload set to 100 MB (changable via env) See below for file size data from https://security.access.redhat.com/data/sbom/v1/spdx/ The env var for enabling/disabling the feature is ROX_SBOM_SCANNING The design called for ROX_SBOM_MATCHING - I'm happy to change it, the API endpoint has scan in its path and other user exposed areas of ACS reference 'scanning' - 'SCAN' seemed like the more consistent value. File sizes from: https://security.access.redhat.com/data/sbom/v1/spdx/ Total files processed: 250 Maximum uncompressed size: 429.3 MB (spdx/rhel-10.1.z.json.bz2) Minimum uncompressed size: 2.3 KB (spdx/quarkus-3.27.json.bz2) Average uncompressed size: 19.5 MB Median uncompressed size: 416.3 KB Standard deviation: 65.0 MB Total uncompressed size: 4.8 GB PR Stack: #18503 #18658 #18484 ⬅️ this PR User-facing documentation CHANGELOG.md is updated OR update is not needed documentation PR is created and is linked above OR is not needed Testing and quality the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag CI results are inspected Automated testing added unit tests How I validated my change Unit tests + sending a fake request to the API: $ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan HTTP/2 400 vary: Accept-Encoding content-type: text/plain; charset=utf-8 content-length: 129 date: Wed, 14 Jan 2026 04:58:14 GMT {"code":3,"message":"validating media type: unsupported media type \"\", supported types [text/spdx+json application/spdx+json]"} $ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -H "Content-Type: text/spdx+json" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan HTTP/2 200 content-type: application/json vary: Accept-Encoding content-length: 467 date: Wed, 14 Jan 2026 04:58:47 GMT { "id": "fake HashId", "scan": { "scanTime": "2026-01-14T04:58:47.653925991Z", "components": [ { "name": "Fake Package #1", "vulns": [ { "cve": "Fake Vuln #1" }, { "cve": "Fake Vuln #2" } ] } ], "operatingSystem": "unknown", "dataSource": { "id": "a87471e6-9678-4e66-8348-91e302b6de07", "name": "Scanner V4" } } } Max request size enforcement $ k set env deploy/central ROX_SBOM_SCAN_MAX_REQ_SIZE_BYTES=2 $ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -H "Content-Type: text/spdx+json" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan -d "this is not actually an SBOM" HTTP/2 400 vary: Accept-Encoding content-type: text/plain; charset=utf-8 content-length: 67 date: Wed, 14 Jan 2026 05:26:39 GMT {"code":3,"message":"request body exceeds maximum size of 2 bytes"}

Open Graph Description: Description Adds the /api/v1/sboms/scan custom route and handler to facilitate SBOM scanning. Reading the SBOM content from the request and scanning it will be handled in a future PR - a fake respo...

X Description: Description Adds the /api/v1/sboms/scan custom route and handler to facilitate SBOM scanning. Reading the SBOM content from the request and scanning it will be handled in a future PR - a fake respo...

Opengraph URL: https://github.com/stackrox/stackrox/pull/18484

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width