Yes. Spring Boot Actuator includes an sbom endpoint that exposes a software bill of materials for the application, listed under an id of application. CycloneDX files can be auto detected, and other formats can be configured. Because only health is exposed by default, you must opt in to expose it.
What the endpoint returns
An SBOM (software bill of materials) is a machine readable list of the components inside a piece of software. The Spring Boot docs describe the sbom endpoint as exposing that list. A GET request to the Actuator path for sbom returns the available SBOM ids, and a second request with the id returns the document itself. In the Spring Boot REST API example the response is CycloneDX JSON.
| Request | Returns |
|---|---|
| GET on the sbom path | A list of ids, for example application |
| GET on sbom with an id | The SBOM document, in the format it was stored |
The docs say CycloneDX, SPDX and Syft media types are detected automatically. For other formats, the property management.endpoint.sbom.application.location sets where the file is read from, for example a classpath location.
How the file gets there
The endpoint serves a file. It does not build one on the fly. The Actuator docs point to a section on generating a CycloneDX SBOM at build time, so the build produces the file and packaging includes it. If nothing is generated, there is nothing to serve.
Should you expose it?
An SBOM is useful to your customers and your own tooling. It also tells an attacker exactly which library versions you run. So treat exposure as a decision.
- Generate the SBOM in your build and confirm it matches the shipped artifact.
- Add sbom to the Actuator exposure include list only where needed.
- Put the endpoint behind authentication, as with other Actuator endpoints. Our post on Actuator exposure shows how.
- Prefer pulling the file from the build pipeline for scanners, and serve it live only for consumers who need it.
- Fail the build if the SBOM is missing, so a release never ships without one.
What an SBOM does and does not tell you
It lists components. It does not say which vulnerabilities apply or whether your code reaches them. Feed it into a scanner for that. See our walkthrough on what a fat jar contains.
Try it yourself
Click through it at your own pace, or open it full screen. Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is the sbom endpoint exposed by default?
No. Only health is exposed over HTTP by default, so sbom must be added to the exposure include list.
Which SBOM formats can it serve?
CycloneDX SBOMs can be auto detected, and the docs say CycloneDX, SPDX and Syft media types are detected automatically. Other formats can be configured by location.
Sources
Last reviewed: 19 October 2026.
