Using Badge

Agent SBOM

Export a signed CycloneDX 1.6 bill of materials for an agent, and verify one you received.

TL;DR — One click on your agent's manage page downloads a CycloneDX 1.6 ML-BOM listing the models, tools and certificates behind the agent, signed with the same Ed25519 key that signs badgeIA certificates. Anyone can check the signature on any certificate page (/verify/<run id>).

Security teams ask vendors for a software bill of materials. An agent is mostly models, tools and prompts, so badgeIA builds one from what it already knows about your agent.

Export

Open your agent, then Manage.
Choose Download SBOM (CycloneDX).

Or call the API as the owner or a workspace member:

curl -b "badge_session=$SESSION" \
  "https://badgeia.com/api/v1/agents/$AGENT_ID/sbom?format=cyclonedx" \
  -o agent-sbom.cdx.json

cyclonedx is the only format today; any other value returns 422. The response is application/vnd.cyclonedx+json; version=1.6.

A public agent does not make its SBOM public. Only the owner and workspace members who can edit the agent can export it; workspace viewers and workspaces with a lapsed plan cannot. If the feature is not switched on for a deployment, the endpoint and the download button report that it is not enabled.

What is inside

Section, Content table
Section	Content
`metadata.component`	The agent, with `badge:agent_id`, `badge:ownership_scope` and the blueprint version number (or `badge:blueprint = none`).
`components[]`	One `machine-learning-model` per model (observed in traces or declared in the manifest), plus `data` entries for prompt hashes and certified suites.
`services[]`	Tools, MCP servers, retrieval and sub-agents. CycloneDX 1.6 keeps services in their own array.
`externalReferences[]`	The public agent page (public agents only), each signed certificate, and the blueprint endpoint.
`dependencies[]`	The agent depends on every component and service.

Each entry carries a badge:source property: observed (seen in traces), declared (from the agent manifest), agent_record or certification.

Prompts are never exported

If your manifest lists prompt hashes (ml_bom.prompts[].sha256), the SBOM carries the SHA-256 and nothing else. Prompt text is never read or written.

Signature

The signature is a detached Ed25519 signature over canonical JSON. The top-level signature member is a JSF-shaped object, but it is not verifiable with a generic JSON Signature Format library.

What is signed, byte for byte:

"badge-sbom-v1" + 0x00 + canonical_json(document without "signature")

canonical_json means keys sorted at every level, separators , and : with no whitespace, and UTF-8 output with non-ASCII characters left unescaped. The badge-sbom-v1\0 prefix keeps the same key from validating anything else it signs, such as run certificates.

"signature": {
  "algorithm": "Ed25519",
  "keyId": "badge-ed25519-2026-06",
  "value": "<base64url Ed25519 signature>"
}

Changing any value in the signed content, or the signature, makes the document invalid. Whitespace and key order are not part of the signed content. A document with a repeated key is rejected outright, so it can never read one way to a person and another way to the verifier.

Verify an SBOM you received

On any certificate page, open Verify an SBOM, paste or upload the file, and choose Verify signature. Or call the API (no account needed):

curl -X POST https://badgeia.com/api/v1/verify/sbom \
  -H "Content-Type: application/json" \
  --data-binary @agent-sbom.cdx.json
# {"valid": true, "key_id": "...", "agent_id": "...", "signed_at": "..."}

An invalid or unsigned document returns {"valid": false} and no identity fields. A document that is not CycloneDX 1.6 returns {"valid": false, "reason": "not_cyclonedx_1_6"}. Check that the agent_id in a valid answer is the agent you expected: a valid signature on another agent's SBOM is still valid. The public key is published at /.well-known/badge-verification-key.json, so you can also verify offline.

Limits

The SBOM describes what badgeIA has seen and what the agent declares. A declaration is the agent's own claim; observed entries come from traces.
The signature proves badgeIA issued this exact document. It does not vouch that the agent is safe.