Verified steps

Generate or obtain a CycloneDX VEX document that references the same component/project identifiers as an SBOM already ingested for that project.
Upload it to the /api/v1/vex endpoint (POST or PUT are both supported) with the X-Api-Key header set to a Dependency-Track API key that has VEX upload permission.
Submit as multipart form data with projectName and projectVersion fields (or projectUuid) plus the vex file field, e.g. curl -sSf -H "X-Api-Key: <API_KEY>" -F projectName=<name> -F projectVersion=<version> -F vex=@doc.vex.json https://<host>/api/v1/vex.
Confirm the analysis/state values in the VEX (e.g. not_affected, resolved, exploitable) are set correctly — Dependency-Track validates uploaded VEX documents against the CycloneDX schema and rejects files that fail validation.
After upload, check the project's Findings view (or the findings API) to confirm affected components now reflect the VEX-asserted analysis state instead of the raw scanner result.
Re-upload an updated VEX whenever a component's exploitability status changes, since Dependency-Track does not infer VEX state changes on its own.

Known gotchas

Uploading a VEX immediately after uploading its corresponding SBOM can race the SBOM's asynchronous processing pipeline and appear to have no effect — allow the SBOM to finish processing before submitting the VEX.
VEX documents that fail CycloneDX schema validation are rejected — check the API response status rather than assuming a 2xx-looking response means the analysis was applied.
VEX and SBOM are managed as distinct entities in Dependency-Track's data model, so a VEX only affects components already present in that project from a prior SBOM upload; it cannot introduce new components on its own.

docs.dependencytrack.org · 5 steps · unrated

Ingest a CycloneDX SBOM into OWASP Dependency-Track and retrieve the current risk score

Create a CycloneDX VEX document to communicate that a specific CVE does not affect your product and associate it with an SBOM

security/compliance · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Upload a CycloneDX VEX document to OWASP Dependency-Track to suppress or triage vulnerability findings for a project

Verified steps

Known gotchas

Related routes

Give your agent this knowledge — and 15,500+ more routes

Need this verified for your stack — or a route we don't have yet?