In CycloneDX 1.6, a component's licenses field takes one of two forms: a list of license objects, each with an SPDX id or a free text name, or a single SPDX license expression. You pick one form, not both. An acknowledgement of declared or concluded can mark how firm the claim is.
The two forms
From the CycloneDX 1.6 JSON reference:
- A list of licenses. Each entry is a license object that needs either an id or a name. The id must be a valid SPDX identifier, such as MIT or Apache-2.0. The name is free text for licenses SPDX does not define, such as a commercial license.
- One expression. A list holding exactly one item with an expression string, which must be a valid SPDX license expression. The reference gives the example of Apache-2.0 AND (MIT OR GPL-2.0-only).
When to use which
- Single known license: use the id.
- Custom or commercial terms: use the name, and link the text if you can.
- Compound situations such as a package offered under two licenses, or code containing parts under different ones: use the expression, since it captures AND and OR relations that a flat list cannot.
A flat list of two ids tells a reader nothing about whether you may choose one or must satisfy both. The expression does. That matters for dual licensed packages, where you normally choose between the offered licenses, as opposed to a package with mixed contents, where you meet both.
Declared and concluded
The license object and the expression item can carry an acknowledgement. The reference defines declared as the initial intentions of the authors about their code's licensing, and concluded as verified and confirmed. Observed licenses sit separately in the evidence section.
Use this to be honest in the file. Metadata from a package manifest is declared. A license you reviewed in the source and confirmed is concluded.
Optional fields worth filling
- text to embed the license content for custom licenses.
- url to point to the license file.
- licensing for licensor, licensee, purchaser and dates in commercial cases.
A quick validation check
Before you share a file, confirm every id is a real SPDX identifier, that no component mixes the list form with an expression, and that custom names have a link or text. The earlier post on reading license expressions shows how to read OR and AND.
Safeguard generates SBOMs in standard formats; see the free scan to look at one.
Quick check
Can I use id and expression together on one component?
No. The reference describes them as alternatives: either a list of licenses or a single expression.
When is name the right choice?
For licenses SPDX does not define, such as a commercial license.
Sources
Last reviewed: 19 October 2026.
