The Bills of Materials endpoint returns Cranium's representation of scanned repositories or projects across your tenant. BOMs are the anchor object for the Public API: vulnerabilities and model findings both reference a billOfMaterialsId. Use this endpoint to enumerate your AI inventory anchors and to drive correlation with the vulnerability and model enpoints.

List Bills of Materials

Returns a paginated list of Bills of Materials for the authenticated tenant.

Request:

GET /api/public/billofmaterials

Authorization:

Bearer token. See Authentication & Generating Credentials.

Query parameters:

Response record:

json

{
	"billOfMaterialsId": "guid",
	"name": "my-m1-service",
	"description": "string | null",
	"repositoryUrl": "https://github.com/org/repo",
	"vcsIntegrationName": "Our GitHub",
	"aiSystemIds": ["guid"],
	"lastScanStatus": "Completed | Failed | InProgress | NotStarted | Pending | Queued | Unscanned",
	"lastScanStatusMessage": "string" | "null",
	"totalVulnerabilitiesCount": 12,
	"totalResolvedVulnerabilitiesCount": 3,
	"modelCount": 2,
	"dataSetCount": 1,
	"technologyCount": 47,
	"infrastructureCount": 0,
	"createdDate": "2026-01-10T08:00:00Z",
	"updatedDate": "2026-04-14T15:32:00Z"
}

Field Definitions

• billOfMaterialsId: Unique identifier for the BOM. Stable across updates. Use this value to correlate with the billOfMaterialsId field on the Technology Vulnerabilities and Arena Model Vulnerabilities endpoints.
• name: Human-readable name of the BOM as displayed in the Cranium portal.
• description: Free-text description of the BOM. May be null.
• repositoryUrl: URL of the source repository associated with the BOM.
• vcsIntegrationId: Identifier of the VCS integration used to scan the repository. Null when the BOM was scanned without a VCS integration (for example, public repositories).
• vcsIntegrationName: Display name of the VCS integration. Null under the same conditions as vcsIntegrationId.
• aiSystemIds: Array of AI System identifiers to which the BOM belongs. A BOM can be associated with multiple AI Systems. The array is empty when the BOM has not bee assigned to any AI System.
• lastScanStatus: Status of the most recent scan. One of Completed, Failed, InProgress, NotStarted, Pending, Queued, Unscanned.
• lastScanStatusMessage: Additional context about the scan status, when available. May be null.
• totalVulnerabilitiesCount: Total number of vulnerabilities currently associated with the BOM.
• totalResolvedVulnerabilitiesCount: Number of vulnerabilities that have been marked as resolved or ignored in the Cranium portal.
• modelCount: Number of models detected in the BOM.
• dataSetCount: Number of datasets detected in the BOM.
• technologyCount: Number of technologies (packages or libraries) detected in the BOM.
• infrastructureCount: Number of infrastructure components detected in the BOM.
• createdDate: Timestamp at which the BOM was created. ISO 8601 format.
• updatedDate: Timestamp at which the BOM record was last updated. ISO 8601 format. This is the field the sync cursor tracks.