{ "openapi": "3.1.1", "info": { "title": "SBOM License Checker API", "version": "1.0.0", "summary": "Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://sbomlicensechecker.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence.", "description": "Upload or paste a CycloneDX (JSON or XML) or SPDX (JSON or tag-value) SBOM. Every component licence is parsed as an SPDX expression (AND, OR, WITH), normalised against a bundled SPDX licence list subset (name, OSI approval, permissive / weak / strong / network copyleft) and checked against the licence of your project or product with a documented compatibility matrix. Missing and unknown licences are flagged. Not legal advice.\n\nMethodology:\n- Readers: CycloneDX JSON and SPDX 2.x JSON via the SBOM Explorer parser; CycloneDX XML (components, nested components, metadata component, license id/name/expression) and SPDX tag-value (PackageName, PackageVersion, PackageLicenseConcluded, else PackageLicenseDeclared, purl ExternalRefs) with our own readers. Several CycloneDX licence entries for one component are combined with AND (conservative).\n- Licence strings are parsed as SPDX license expressions (SPDX spec Annex D: WITH binds tighter than AND, AND tighter than OR, parentheses, “+”). Deprecated ids (GPL-2.0, GPL-2.0+, LGPL-2.1, GPL-2.0-with-classpath-exception …) are mapped to current ids; common free-text names (“Apache 2.0”, “The MIT License”, “GPLv3”) are normalised and the mapping is reported.\n- Licence data: a bundled subset of 114 licences from the SPDX License List 3.29.0 (2026-09-16): id, name and OSI approval from SPDX; the copyleft class (public domain, permissive, weak, strong, network, source-available) is our classification.\n- Compatibility: each licence is rated against the project licence with the matrix shown in the results (ok, conditions, review, conflict, unknown). OR takes the best option, AND the worst. Linking exceptions (Classpath, GCC, LLVM, Autoconf, Bison, Universal FOSS …) reduce GPL components to weak copyleft. The matrix encodes widely documented positions (FSF licence list, MPL-2.0 §3.3, GPL-3.0 §13, Apache-2.0/GPL-2.0 incompatibility); edge cases depend on how components are combined.\n- Not legal advice: obligations depend on linking, distribution, modification and jurisdiction. Use the result to decide what needs legal review.\n\nNot legal advice. Licence compatibility depends on how components are used, linked and distributed.", "tags": [ "security" ], "x-mcp-tool": "sbom_license_checker", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SbomLicenseCheckerInput" }, "examples": { "example1": { "summary": "CycloneDX XML Java service (Apache-2.0 project)", "value": { "sbom": "\n\n shop-backend3.2.0Apache-2.0\n \n org.apache.commonscommons-lang33.14.0pkg:maven/org.apache.commons/commons-lang3@3.14.0Apache-2.0\n mysql-connector-j8.3.0pkg:maven/com.mysql/mysql-connector-j@8.3.0GPL-2.0-only WITH Universal-FOSS-exception-1.0\n hibernate-core6.4.4LGPL-2.1-or-later\n jsoup1.17.2The MIT License\n ghostscript-wrapper10.0AGPL-3.0-or-later\n vendor-sdk2.1\n \n" } }, "example2": { "summary": "SPDX tag-value firmware (proprietary, distributed)", "value": { "sbom": "SPDXVersion: SPDX-2.3\nDataLicense: CC0-1.0\nSPDXID: SPDXRef-DOCUMENT\nDocumentName: firmware-image\nRelationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-fw\n\nPackageName: firmware\nSPDXID: SPDXRef-fw\nPackageVersion: 1.4\nPackageLicenseDeclared: LicenseRef-Proprietary\n\nPackageName: busybox\nSPDXID: SPDXRef-busybox\nPackageVersion: 1.36.1\nPackageLicenseConcluded: GPL-2.0-only\n\nPackageName: openssl\nSPDXID: SPDXRef-openssl\nPackageVersion: 3.0.13\nPackageLicenseConcluded: Apache-2.0\n\nPackageName: zlib\nSPDXID: SPDXRef-zlib\nPackageVersion: 1.3.1\nPackageLicenseConcluded: Zlib\n\nPackageName: libcurl\nSPDXID: SPDXRef-curl\nPackageVersion: 8.6.0\nPackageLicenseConcluded: curl\n\nPackageName: dual-licensed-lib\nSPDXID: SPDXRef-dual\nPackageVersion: 0.9\nPackageLicenseDeclared: (MIT OR GPL-3.0-or-later)\n", "projectLicense": "proprietary" } }, "example3": { "summary": "Same firmware as a GPL-2.0-only project", "value": { "sbom": "SPDXVersion: SPDX-2.3\nDataLicense: CC0-1.0\nSPDXID: SPDXRef-DOCUMENT\nDocumentName: firmware-image\nRelationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-fw\n\nPackageName: firmware\nSPDXID: SPDXRef-fw\nPackageVersion: 1.4\nPackageLicenseDeclared: LicenseRef-Proprietary\n\nPackageName: busybox\nSPDXID: SPDXRef-busybox\nPackageVersion: 1.36.1\nPackageLicenseConcluded: GPL-2.0-only\n\nPackageName: openssl\nSPDXID: SPDXRef-openssl\nPackageVersion: 3.0.13\nPackageLicenseConcluded: Apache-2.0\n\nPackageName: zlib\nSPDXID: SPDXRef-zlib\nPackageVersion: 1.3.1\nPackageLicenseConcluded: Zlib\n\nPackageName: libcurl\nSPDXID: SPDXRef-curl\nPackageVersion: 8.6.0\nPackageLicenseConcluded: curl\n\nPackageName: dual-licensed-lib\nSPDXID: SPDXRef-dual\nPackageVersion: 0.9\nPackageLicenseDeclared: (MIT OR GPL-3.0-or-later)\n", "projectLicense": "GPL-2.0-only" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SbomLicenseCheckerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "SbomLicenseCheckerInput": { "type": "object", "additionalProperties": false, "properties": { "sbom": { "title": "SBOM (CycloneDX JSON/XML or SPDX JSON/tag-value)", "type": "string", "maxLength": 5000000 }, "sbomFile": { "title": "Or upload an SBOM file", "type": "object", "description": "Upload as {filename, contentType?, contentBase64}. Max 4883 KiB. Accepts .json,.xml,.spdx,.txt,.cdx,application/json,application/xml,text/xml,text/plain.", "additionalProperties": false, "required": [ "filename", "contentBase64" ], "properties": { "filename": { "type": "string" }, "contentType": { "type": "string" }, "contentBase64": { "type": "string" } } }, "projectLicense": { "title": "Your project / product licence", "type": "string", "enum": [ "auto", "proprietary", "saas", "MIT", "Apache-2.0", "BSD-3-Clause", "MPL-2.0", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-or-later", "AGPL-3.0-or-later" ], "default": "auto" } }, "required": [] }, "SbomLicenseCheckerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "format", "projectLicense", "projectLicenseSource", "componentCount", "components", "classCounts", "verdictCounts", "conflicts", "unknownOrMissing", "nonOsi", "licenseList" ], "properties": { "format": { "type": "string" }, "projectLicense": { "type": "string" }, "projectLicenseSource": { "type": "string" }, "componentCount": { "type": "integer" }, "components": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "version", "purl", "rawLicense", "expression", "licenses", "class", "verdict", "reason", "issues" ], "properties": { "name": { "type": "string" }, "version": { "type": [ "string", "null" ] }, "purl": { "type": [ "string", "null" ] }, "rawLicense": { "type": "string" }, "expression": { "type": [ "string", "null" ] }, "licenses": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "osiApproved", "class", "exception" ], "properties": { "id": { "type": "string" }, "name": { "type": [ "string", "null" ] }, "osiApproved": { "type": [ "boolean", "null" ] }, "class": { "type": "string" }, "exception": { "type": [ "string", "null" ] } } } }, "class": { "type": "string", "enum": [ "public-domain", "permissive", "weak", "strong", "network", "source-available", "unknown" ] }, "verdict": { "type": "string", "enum": [ "ok", "conditions", "review", "unknown", "conflict" ] }, "reason": { "type": "string" }, "issues": { "type": "array", "items": { "type": "string" } } } } }, "classCounts": { "type": "object", "additionalProperties": { "type": "integer" } }, "verdictCounts": { "type": "object", "additionalProperties": { "type": "integer" } }, "conflicts": { "type": "array", "items": { "type": "string" } }, "unknownOrMissing": { "type": "array", "items": { "type": "string" } }, "nonOsi": { "type": "array", "items": { "type": "string" } }, "licenseList": { "type": "object", "additionalProperties": false, "required": [ "version", "releaseDate", "bundled" ], "properties": { "version": { "type": "string" }, "releaseDate": { "type": "string" }, "bundled": { "type": "integer" } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }