Export a CycloneDX 1.6 CBOM for global-catalog software

GET 
/export/cyclonedx

Resolves the (name, version, publisher) query to global-catalog rows (latest complete snapshot only — the read is freshness-gated) and renders ONE CycloneDX 1.6 document.

• With publisher: exact fingerprint lookup → at most one component.
• Without publisher: name+version may match several publisher variants; all are emitted as components in the single document, each with its own mesh:pqc_compliant and mesh:pqc_state properties.

On a catalog miss the request is recorded for fulfillment and the endpoint returns 202 (not 404): eligibility is decided at nightly build time by the fail-closed public gate, never at request time.

Request

Responses

200

Catalog hit — a CycloneDX 1.6 CBOM document.

202

Catalog miss — the software is not in the latest complete snapshot. A fulfillment request has been recorded (deduped per fingerprint). status is scheduled on first request, in_progress on a repeat of one already pending.

400

Bad request — missing/blank name, or a parameter over the 512-char cap.

401

Unauthenticated — the request carried no valid bearer token.

422

The software could not be identified or did not qualify for the catalog on a recent fulfillment attempt, and the fingerprint is in a re-request cooldown window. The error body carries the failure reason; the Retry-After header says when a retry becomes meaningful. Clients should stop polling.

429

Too Many Requests — the per-caller rate limit was exceeded. The Retry-After response header gives the wait, in seconds, before a retry will be accepted.

500

Internal error querying the catalog or rendering the document.

503

The export is temporarily unavailable. Retry later, or contact your Axiad representative if it persists.