Compliance Artifacts

Software supply chain security requires transparent, machine-readable compliance artifacts. The Binarly API enables you to programmatically generate industry-standard reports for auditing, vulnerability disclosure, and post-quantum cryptography readiness assessment.

Available Reports

Report	Purpose	Documentation
SBOM	Software Bill of Materials - inventory of all software components	SBOM Report
VEX	Vulnerability Exploitability - communicate which vulnerabilities are actionable	VEX Report
CBOM	Cryptographic Bill of Materials - inventory of crypto assets	CBOM Report
PQC	Post-Quantum Cryptography Compliance - readiness for quantum threats	PQC Report
Findings	Security Findings - comprehensive security analysis results	Findings Report

Use Case: Regulatory Compliance

When preparing for regulatory submissions (e.g., FDA, EU Cyber Resilience Act), you typically need:

SBOM - Required by most regulations to demonstrate software transparency
VEX - Demonstrates how you’re addressing known vulnerabilities
PQC Report - Shows cryptographic posture for quantum readiness

Use Case: Continuous Compliance in CI/CD

Integrate compliance artifact generation into your release pipeline:

Upload binary image → Upload Image
Wait for scan completion → List Scans
Download artifacts → Individual report endpoints above

Use Case: Third-Party Audits

For supply chain audits:

Generate SBOM for software inventory
Generate CBOM for cryptographic material inventory
Generate Findings Report for security posture overview

Automation Script

Download all compliance artifacts for a binary image:

#!/bin/bash
set -e

# Configuration (set these environment variables)
# BINARLY_API_URL, BINARLY_PRODUCT_ID, TOKEN
IMAGE_ID="${1:?Usage: $0 <image-id>}"
OUTPUT_DIR="./compliance-artifacts"

mkdir -p "$OUTPUT_DIR"

echo "Downloading compliance artifacts for image: $IMAGE_ID"

# See individual report endpoints for full options:
# - /api-reference/report/sbom-report
# - /api-reference/report/vex-report
# - /api-reference/report/cbom-report
# - /api-reference/report/pqc-report
# - /api-reference/report/findings-report

BASE="${BINARLY_API_URL}/api/v4/products/${BINARLY_PRODUCT_ID}/images/${IMAGE_ID}"

curl -s -H "Authorization: Bearer ${TOKEN}" "${BASE}/sbomReport:cycloneDX?contentType=json" -o "${OUTPUT_DIR}/sbom.json"
curl -s -H "Authorization: Bearer ${TOKEN}" "${BASE}/vexReport:openVEX" -o "${OUTPUT_DIR}/vex.json"
curl -s -H "Authorization: Bearer ${TOKEN}" "${BASE}/cbomReport:cycloneDX" -o "${OUTPUT_DIR}/cbom.json"
curl -s -H "Authorization: Bearer ${TOKEN}" "${BASE}/cryptographicMaterialsReport?mode=pqc-compliance&contentType=json" -o "${OUTPUT_DIR}/pqc.json"
curl -s -H "Authorization: Bearer ${TOKEN}" "${BASE}?contentType=pdf&imageFields=findings" -o "${OUTPUT_DIR}/findings.pdf"

echo "✓ Artifacts saved to: $OUTPUT_DIR"

API Reference

User Guides

SBOM Export Guide - UI walkthrough and use cases
VEX Export Guide - Vulnerability disclosure workflows
CBOM Export Guide - Cryptographic inventory
PQC Compliance Guide - Detailed report contents and generation

Overview

Use Cases

Reference

Available Reports

Use Case: Regulatory Compliance

Use Case: Continuous Compliance in CI/CD

Use Case: Third-Party Audits

Automation Script

​Available Reports

​Use Case: Regulatory Compliance

​Use Case: Continuous Compliance in CI/CD

​Use Case: Third-Party Audits

​Automation Script

​Related

Available Reports

Use Case: Regulatory Compliance

Use Case: Continuous Compliance in CI/CD

Use Case: Third-Party Audits

Automation Script

Related