---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Uploading Software Bill of Materials for DevOps SBOM files

# Uploading Software Bill of Materials for DevOps SBOM files {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Generate and upload Software Bill of Materials
SBOM files for software throughout its continuous integration and continuous deployment development cycles.

## DevOps and SBOM files {#vr-sbom-uploading-devops__section_o5d_xkt_dcc}

SBOM files can be generated at multiple stages throughout the software continuous integration and continuous deployment (CI/CD) development life cycle. Most software development operations (DevOps) in organizations
use some type of CI/CD process to help them identify and prevent costly bugs that might surface after the release. Throughout the CI/CD pipeline, DevOps can generate SBOM files and pro-actively check for vulnerabilities and at-risk
components. These checks can help organizations achieve better software quality and avoid costly maintenance later. Generating SBOM files is critical for successfully implementing and automating accurate build assessments during the CI/CD development.

Uploading SBOM files from development pipelines is supported starting with the following versions of the SBOM applications.
{#vr-sbom-uploading-devops__table_ont_n5t_dcc__entry__2}

| Application | Supported versions |
|-|-|
| Data Model for SBOM | v3.0, v2.0 |
| SBOM Core | v5.0, v4.0, v3.0 |
| SBOM Response | v5.0, v4.0, v3.2, 3.1 |
[Table 1. Supported versions]

{#vr-sbom-uploading-devops__table_ont_n5t_dcc}

## Use cases {#vr-sbom-uploading-devops__section_ecr_ykt_dcc}

Generating SBOM files and sending them via the SBOM Upload API as part of the DevOps build pipeline can provide counts for the following to determine whether the pipeline should succeed or fail:

* Added components
* removed components
* Vulnerabilities information
* Package information (abandoned/stale components)
{#vr-sbom-uploading-devops__ul_zth_lnt_dcc}

DevOps policies and rules for the success or failure of a pipeline may be defined by the vulnerability counts and stale and abandoned component count thresholds that are received from the SBOM Status API.

For a failed pipeline, DevOps users can access information about the failed build in their ServiceNow® instance to help them better understand the root cause and origin of the vulnerabilities.

See [Uploading Software Bill of Materials files using a REST API](https://servicenow-prod.fluidtopics.net/to1IyWxue63sIxy_DLj7RQ "Review the following information prior to uploading Software Bill of Materials files using an API.") for more information about (POST) and (GET) parameters and URLs for the Upload and Status APIs.

## Domain Separation {#vr-sbom-uploading-devops__section_lcq_2wt_dcc}

All the tables in the SBOM applications are domain separated.