Total files processed: 250

Maximum uncompressed size: 429.3 MB (spdx/rhel-10.1.z.json.bz2)
Minimum uncompressed size: 2.3 KB (spdx/quarkus-3.27.json.bz2)
Average uncompressed size: 19.5 MB
Median uncompressed size:  416.3 KB
Standard deviation:        65.0 MB
Total uncompressed size:   4.8 GB

$ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan
HTTP/2 400 
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
content-length: 129
date: Wed, 14 Jan 2026 04:58:14 GMT

{"code":3,"message":"validating media type: unsupported media type \"\", supported types [text/spdx+json application/spdx+json]"}

$ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -H "Content-Type: text/spdx+json" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan
HTTP/2 200 
content-type: application/json
vary: Accept-Encoding
content-length: 467
date: Wed, 14 Jan 2026 04:58:47 GMT

{
  "id":  "fake HashId",
  "scan":  {
    "scanTime":  "2026-01-14T04:58:47.653925991Z",
    "components":  [
      {
        "name":  "Fake Package #1",
        "vulns":  [
          {
            "cve":  "Fake Vuln #1"
          },
          {
            "cve":  "Fake Vuln #2"
          }
        ]
      }
    ],
    "operatingSystem":  "unknown",
    "dataSource":  {
      "id":  "a87471e6-9678-4e66-8348-91e302b6de07",
      "name":  "Scanner V4"
    }
  }
}

$ k set env deploy/central ROX_SBOM_SCAN_MAX_REQ_SIZE_BYTES=2
$ curl -ki -H "Authorization: Bearer $ROX_API_TOKEN" -H "Content-Type: text/spdx+json" -X POST https://$ROX_ENDPOINT/api/v1/sboms/scan -d "this is not actually an SBOM"
HTTP/2 400 
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
content-length: 67
date: Wed, 14 Jan 2026 05:26:39 GMT

{"code":3,"message":"request body exceeds maximum size of 2 bytes"}