API-Referenz.

GET/healthz

Liveness probe

Reports that the process is running. Checks no dependencies.

Antworten

• 200 Process is alive. Liveness

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/healthz"

GET/readyz

Readiness probe

Reports whether all dependencies can serve traffic, as a status and nothing else: no dependency is named, and no version or error text is returned. The external uptime monitor polls it. Failure details are logged.

Antworten

• 200 Ready to serve traffic. Readiness
• 503 At least one dependency is unavailable. Readiness

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/readyz"

GET/v1/products

List the products of the account

Returns the products the token may see: all products of the account, or only the one the token is limited to. Archived products are included and marked.

Antworten

• 200 The products the token may see. ProductList
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/products"

GET/v1/products/{productId}

Read one product

Returns the product. A product of another account, and a product the token is not limited to, are reported as not found.

Parameter

• productId path, string (uuid), erforderlich Identifier of the product.

Antworten

• 200 The product. Product
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/products/$PRODUCTID"

GET/v1/products/{productId}/sboms

List the uploads of one product

Returns the product's uploads, newest first. Requires the scope sboms:read.

Parameter

• productId path, string (uuid), erforderlich Identifier of the product.

Antworten

• 200 The uploads of the product. SBOMList
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/products/$PRODUCTID/sboms"

POST/v1/products/{productId}/sboms

Upload a bill of materials for a product

Stores a CycloneDX or SPDX document in JSON, at most 10 MiB, and indexes its components. The format is read from the document, not from the content type. Uploading the same bytes for the same product again answers 200 with the existing upload instead of storing a second one, so a build pipeline that runs twice on an unchanged tree is harmless.

Requires the scope sboms:write.

Parameter

• productId path, string (uuid), erforderlich Identifier of the product.

Anfragekörper

The document itself, as sent by the build tool.

• application/json
• application/vnd.cyclonedx+json
• application/spdx+json

Antworten

• 200 The same document was already stored for this product; nothing changed. SBOM
• 201 The document was stored. SBOM
• 400 The document is empty, not JSON, in neither format, or lists something unusable.
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.
• 413 The document is larger than 10 MiB.
• 415 The content type is not one of the accepted JSON types.

Beispiel

curl --fail-with-body -sS -X POST \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  -H "Content-Type: application/vnd.cyclonedx+json" \
  --data-binary @sbom.json \
  "https://app.bithive-it.com/v1/products/$PRODUCTID/sboms"

GET/v1/sboms/{sbomId}

Read one upload

Returns the upload. An upload of another account, and one belonging to a product the token is not limited to, are reported as not found. Requires the scope sboms:read.

Parameter

• sbomId path, string (uuid), erforderlich Identifier of the upload.

Antworten

• 200 The upload. SBOM
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/sboms/$SBOMID"

GET/v1/sboms/{sbomId}/components

Read the component index of one upload

Returns every component the document listed, by name. The list is complete and needs no paging: a document may not carry more than 50,000 components. Requires the scope sboms:read.

Parameter

• sbomId path, string (uuid), erforderlich Identifier of the upload.

Antworten

• 200 The components of the upload. ComponentList
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/sboms/$SBOMID/components"

GET/v1/sboms/{sbomId}/document

Download the document as it was uploaded

Returns the stored bytes unchanged, which is what an audit or a report attachment needs. Requires the scope sboms:read.

Parameter

• sbomId path, string (uuid), erforderlich Identifier of the upload.

Antworten

• 200 The document, byte for byte as uploaded.
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/sboms/$SBOMID/document"

GET/v1/products/{productId}/findings

List what was found in a product

Returns the product's findings, the ones for vulnerabilities known to be exploited first, then by severity, then newest. That order is the order to work in: an actively exploited vulnerability is what starts the Cyber Resilience Act's 24-hour report.

Whether a vulnerability is exploited is resolved when the request is answered, not stored on the finding, because a vulnerability becomes exploited later and that moment is what matters.

Requires the scope findings:read.

Parameter

• productId path, string (uuid), erforderlich Identifier of the product.

Antworten

• 200 The product's findings. FindingList
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/products/$PRODUCTID/findings"

GET/v1/products/{productId}/coverage

Read how much of a product can be checked

Returns how many components of the product's latest upload we can check, and names what it cannot. Results depend on the completeness of the bill of materials, so the uncovered part is named rather than merely subtracted: a client can see which ecosystems are not covered and why.

A component is not monitored when it carries no package identifier (common in firmware built with Yocto or Buildroot), when it names no version, or when it belongs to an ecosystem whose matching is not yet proven.

Requires the scope findings:read.

Parameter

• productId path, string (uuid), erforderlich Identifier of the product.

Antworten

• 200 What the product's latest upload could be checked against. Coverage
• 401 The API token is missing, unknown, expired or revoked.
• 403 The API token does not carry the required scope.
• 404 The resource does not exist, or the token may not see it.
• 405 The resource does not support this method.

Beispiel

curl --fail-with-body -sS \
  -H "Authorization: Bearer $BITHIVE_TOKEN" \
  "https://app.bithive-it.com/v1/products/$PRODUCTID/coverage"

Liveness

Readiness

Product

ProductList

SBOM

SBOMList

Component

ComponentList

Finding

FindingList

NotMonitoredGroup

Coverage

Problem

RFC 9457 problem details.