SPDX (Software Package Data Exchange) is an open, ISO/IEC 5962 standard for communicating software bill-of-materials information, including components, licenses, and copyrights. It supports license compliance and supply-chain security.
SPDX
SPDX (Software Package Data Exchange), standardized as ISO/IEC 5962, is an open format for describing a software bill of materials — the components inside a piece of software, along with their licenses, copyrights, and security references. Stewarded by the Linux Foundation, it gives supply-chain and legal tooling a common, machine-readable way to answer “what is actually in this thing?”
- Bill of materials - Enumerates every package and dependency so consumers know exactly what they are shipping and running.
- License and copyright data - Carries standardized SPDX license identifiers, making compliance checkable rather than guessed at.
- An ISO standard - Formalized as ISO/IEC 5962, which gives it standing in procurement and regulated environments.
- Multiple serializations - Documents can be expressed in tag-value, JSON, YAML, RDF, and spreadsheet forms to fit different pipelines.
In API operations SPDX matters because APIs ship as software with real dependency trees, and an SBOM is increasingly expected as evidence of supply-chain hygiene. I treat the presence of an SPDX (or CycloneDX) document as a maturity signal in the same family as a published security.txt — a cheap, machine-checkable artifact that tells consumers and their agents an organization takes provenance and security seriously.
Open source tools that implement this standard
Harvested from this standard's own governing organisation, with the license read from each repository rather than assumed. The role is what the tool does to the specification, from the shared vocabulary — so an agent holding one of these documents can resolve straight from a goal to a tool.
| Tool | Role | License | What it does |
|---|---|---|---|
| Grype | scans |
Apache-2.0 | Scans container images, filesystems and SBOMs for known vulnerabilities, reading OSV and other vulnerability sources. |
| Syft | generates |
Apache-2.0 | Generates a software bill of materials from container images and filesystems, emitting SPDX or CycloneDX — the most widely used... |
| SPDX Python Tools | validates |
Apache-2.0 | Parses, validates and creates SPDX documents in Python, covering SPDX 2 and 3. |
| SPDX Go Tools | parses |
Apache-2.0 | Go packages for reading, writing and validating SPDX documents. |
| SPDX Java Tools | parses |
Apache-2.0 | Command-line tools for converting, comparing and validating SPDX documents on the JVM. |
| NTIA Conformance Checker | validates |
Apache-2.0 | Checks an SPDX SBOM against the NTIA minimum elements and CISA guidance — whether it satisfies the baseline regulators actually... |
| SPDX Java Library | parses |
Apache-2.0 | The Java object model for SPDX, underneath the SPDX Java tooling. |
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
