Ingest a CycloneDX SBOM into OWASP Dependency-Track via its REST API and associate it with a project version for vulnerability tracking

Steps

1. Obtain an API key from Dependency-Track by navigating to Administration > Access Management > Teams, creating a team with BOM_UPLOAD permission, and copying the generated API key
2. Base64-encode the CycloneDX SBOM file: B64=$(base64 -w 0 sbom.cdx.json) and then POST to https://<DT_HOST>/api/v1/bom with headers X-Api-Key: YOUR_TOKEN and Content-Type: application/json, with body {"project": "<PROJECT_UUID>", "bom": "<B64_ENCODED_BOM>"}
3. Alternatively, use the multipart upload endpoint: POST to /api/v1/bom with Content-Type: multipart/form-data, form fields project=<UUID> and bom=@sbom.cdx.json for larger files
4. Poll the upload token status using GET /api/v1/bom/token/<TOKEN> until the processing field is false, indicating the BOM has been analyzed and vulnerability matching is complete
5. Query the resulting findings using GET /api/v1/finding/project/<PROJECT_UUID> which returns an array of vulnerability findings with severity, component, and advisory details