Upload an SBOM to OWASP Dependency-Track via its REST API, trigger analysis, and query policy violations programmatically

Steps

1. Generate an API key in Dependency-Track under Administration > Access Management > Teams; assign the team the Portfolio Management or Automation permission as needed for your use case.
2. Create or look up a project via the PUT /api/v1/project endpoint, supplying name and version in the JSON body; note the returned project UUID.
3. Upload the SBOM (CycloneDX JSON or XML) using the PUT /api/v1/bom endpoint with the project UUID and the SBOM content as a base64-encoded string or as a multipart form; Dependency-Track queues analysis after upload.
4. Poll the GET /api/v1/bom/token/{token} endpoint with the token returned from the upload until the processing status is PROCESSED, indicating the vulnerability and license analysis is complete.
5. Query GET /api/v1/violation/project/{uuid} to retrieve policy violations for the project; parse the response for violationState (FAIL, WARN, INFO) to fail or flag a CI pipeline.