In an SPDX 2.3 document, Creator names the person, organization or tool that produced the file, Created records when it was made in UTC, and LicenseListVersion states which version of the SPDX License List was used. Creator and Created are mandatory, while LicenseListVersion is optional but helps readers trust license identifiers.
Creator
The spec requires at least one Creator, and allows several. Each value begins with a keyword: Person, Organization or Tool. A tool entry carries the tool identifier and its version.
Creator: Tool: my-sbom-generator-2.4.1
Creator: Organization: Example Corp
The stated intent is that the generation method helps the recipient judge how reliable the analysis is. A file made by a tool from a lockfile is a different kind of evidence than one assembled by a person from memory. If a tool made the file and a person reviewed it, list both.
Always put the tool version in. Without it, you cannot tell which generator bug explains a missing component in last year's file.
Created
Created is a single required timestamp in the format YYYY-MM-DDThh:mm:ssZ, in UTC, following ISO 8601. The spec notes that the timestamp can indicate whether the analysis needs updating. That makes it the first field to check when a customer sends you an SBOM: if it is months old, the content describes software as it was then.
Two cautions. The value is when the document was originally created, not when you last looked at it. And do not backfill a date for a document that did not exist yet.
LicenseListVersion
This optional field has the format M.N, such as 3.17 in the spec's example. New licenses are added to the SPDX License List with each release, so a file written against an older list may use identifiers that a newer validator expects differently. Recording the version lets a recipient validate against the right list.
A short fill guide
| Field | Required | Fill with |
|---|---|---|
| Creator | Yes, one or more | Tool name and version, plus organization or person |
| Created | Yes | UTC timestamp of generation |
| LicenseListVersion | No | The list version your tool used |
| CreatorComment | No | Context such as lockfile only, or reviewed by security |
How this ties to minimum elements
NTIA's 2021 minimum elements ask for the author of SBOM data and a timestamp. The report says the author is the source of the metadata, not the author of the software, and that timestamp records when the data was assembled. In SPDX those map to Creator and Created.
Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo, click through the component list, and look at how each package is identified and what is missing.
Click through it at your own pace, or open it full screen.
Quick check
Can an SPDX file have more than one Creator?
Yes. The cardinality is one or more, so list the tool and the organization or person who ran it.
Is LicenseListVersion mandatory?
No. It is optional in SPDX 2.3, but it helps recipients validate license identifiers.
Sources
- SPDX 2.3.1, Clause 6: Document creation information
- NTIA, The Minimum Elements for a Software Bill of Materials (2021)
Last reviewed: 19 October 2026.
