SPDX (Software Package Data Exchange) is an open, ISO/IEC 5962 standard for communicating software bill-of-materials information, including components, licenses, and copyrights. It supports license compliance and supply-chain security.
SPDX
SPDX (Software Package Data Exchange), standardized as ISO/IEC 5962, is an open format for describing a software bill of materials — the components inside a piece of software, along with their licenses, copyrights, and security references. Stewarded by the Linux Foundation, it gives supply-chain and legal tooling a common, machine-readable way to answer “what is actually in this thing?”
- Bill of materials - Enumerates every package and dependency so consumers know exactly what they are shipping and running.
- License and copyright data - Carries standardized SPDX license identifiers, making compliance checkable rather than guessed at.
- An ISO standard - Formalized as ISO/IEC 5962, which gives it standing in procurement and regulated environments.
- Multiple serializations - Documents can be expressed in tag-value, JSON, YAML, RDF, and spreadsheet forms to fit different pipelines.
In API operations SPDX matters because APIs ship as software with real dependency trees, and an SBOM is increasingly expected as evidence of supply-chain hygiene. I treat the presence of an SPDX (or CycloneDX) document as a maturity signal in the same family as a published security.txt — a cheap, machine-checkable artifact that tells consumers and their agents an organization takes provenance and security seriously.
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
