Transparency Exchange API

SBOM coverage across PyPI

Which Python packages ship a CycloneDX or SPDX SBOM inside their wheels, whether it validates, and whether the wheel carries a PEP 740 attestation. Every SBOM found is served over TEA.

Browse packages Query with TEA

Loading stats…

Packages explored

–

Unique package versions checked

Packages with SBOMs

–

At least one wheel contains an SBOM

SBOM coverage

–

Share of packages with SBOMs

Wheels with SBOMs

–

Individual .whl files containing SBOMs

Wheels attested

–

PEP 740 verified wheels

SBOMs

What ships, and whether it holds up.

Package SBOM coverage

SBOM formats

Detected by parsing file content, not file extensions

SBOM validation

Schema validation against the CycloneDX and SPDX specs

SBOM encoding

File format breakdown: JSON, XML, tag-value

Attestations

Sigstore-based provenance, verified per wheel.

PEP 740 attestation status

Verification result per wheel

Attestation publishers

CI/CD platform that signed the attestation

Over time

Packages explored per day

Cumulative SBOM discovery

Wheel-level breakdown

Each package version ships several wheels, one per platform and Python version. This is SBOM coverage per individual wheel.

Total wheels

–

With SBOM

–

Without SBOM

–

– of wheels include an SBOM

Usage

Queries this server has answered.

Total queries

–

With platform filters

–

Queries using os/arch qualifiers

Unique packages queried

–

Queries per day

Top packages queried

Endpoint hits

OS qualifiers used

Arch qualifiers used

Recent queries

Package	Version	Platform	SBOM	Time

How to use TEA

The Transparency Exchange API (TEA) is an open standard for discovering SBOMs. Query this server with tea-cli:

# Install the TEA CLI
$ pip install libtea[cli]

# Inspect a PyPI package — discovers SBOMs via TEA in one shot
$ tea-cli inspect "urn:tei:purl:pypi.sbomify.com:pkg:pypi/[email protected]"

# Search for a specific package version by PURL
$ tea-cli search-releases --id-type PURL \
    --id-value "pkg:pypi/[email protected]" --domain pypi.sbomify.com

# Filter by platform — only get SBOMs for Linux x86_64 wheels
$ tea-cli search-releases --id-type PURL \
    --id-value "pkg:pypi/[email protected]?os=linux&arch=x86_64" --domain pypi.sbomify.com

Also available as a Python library: from libtea import TeaClient

Platform filtering: add ?os=linux&arch=x86_64 qualifiers to a PURL to get SBOMs only for matching wheels. Supported OS values: linux, darwin/macos, windows. Supported arch values: x86_64/amd64, aarch64/arm64, i686, ppc64le, s390x. Pure-Python wheels are always included.