Bomly Explain JSON Schema Reference

Last updated July 30, 2026View source (v0.21.1)

Complete reference for the bomly explain JSON output.

Document

Field	Type	Description
`schema_version`	`string`
`command`	`string`
`project`	`ProjectDescriptor`
`query`	`ExplainQuery`
`dependency`	`ExplainDependency`
`paths`	Array<`DependencyPath`>
`findings`	Array<`AuditFinding`>
`audit_summary`	`AuditSummary`
`targets`	Array<`ExplainTargetResponse`>
`warnings`	Array<`DetectorWarning`>
`metadata`	`Metadata`

Types

`AffectedSymbol`

Field	Type	Description
`symbol`	`string`
`kind`	`string`
`package`	`string`
`module`	`string`
`definition`	`SourcePosition`

`AuditFinding`

Field	Type	Description
`id`	`string`
`kind`	`string`
`severity`	`string`
`package`	`FindingPackageRef`
`title`	`string`
`reasons`	Array<`string`>
`source`	`string`
`auditor`	`string`
`rule_id`	`string`
`policy_status`	`string`
`vulnerability_id`	`string`
`dependency_refs`	Array<`string`>

`AuditSummary`

Field	Type	Description
`critical`	`integer`
`high`	`integer`
`medium`	`integer`
`low`	`integer`
`unknown`	`integer`
`total`	`integer`

`CVSSScore`

Field	Type	Description
`vector`	`string`
`score`	`number`
`version`	`string`
`source`	`string`

`CWE`

Field	Type	Description
`cve`	`string`
`id`	`string`
`source`	`string`
`type`	`string`

`CallFrame`

Field	Type	Description
`function`	`string`
`package`	`string`
`receiver`	`string`
`position`	`SourcePosition`

`CallPath`

Field	Type	Description
`sink`	`AffectedSymbol`
`frames`	Array<`CallFrame`>

`DependencyPath`

Field	Type	Description
`relationship`	`string`
`packages`	Array<`PackageRef`>
`introduced_via`	`string`
`cyclic`	`boolean`
`cycle_to`	`string`

`DetectorWarning`

Field	Type	Description
`type`	`string`
`code`	`string`
`source`	`string`
`subproject`	`string`
`manifest`	`string`
`message`	`string`

`EPSSScore`

Field	Type	Description
`cve`	`string`
`epss`	`number`
`percentile`	`number`
`date`	`string`

`ExplainDependency`

Field	Type	Description
`name`	`string`
`version`	`string`
`scope`	`string`
`purl`	`string`
`id`	`string`
`metadata`	`object`
`locations`	Array<`LocationRef`>
`licenses`	Array<`LicenseRef`>
`vulnerabilities`	Array<`VulnerabilityRef`>
`scorecard`	`PackageScorecard`
`relationship`	`string`
`direct`	`boolean`
`remediation`	`PackageRemediation`

`ExplainQuery`

Field	Type	Description
`name`	`string`

`ExplainTargetResponse`

Field	Type	Description
`project`	`ProjectDescriptor`
`detector`	`string`
`package_manager`	`string`
`dependency`	`ExplainDependency`
`paths`	Array<`DependencyPath`>
`findings`	Array<`AuditFinding`>
`audit_summary`	`AuditSummary`

`FindingPackageRef`

Field	Type	Description
`name`	`string`
`org`	`string`
`version`	`string`
`purl`	`string`
`ecosystem`	`string`

`FixAvailable`

Field	Type	Description
`version`	`string`
`date`	`string`
`kind`	`string`

`KnownExploited`

Field	Type	Description
`cve`	`string`
`vendor_project`	`string`
`product`	`string`
`date_added`	`string`
`required_action`	`string`
`due_date`	`string`
`known_ransomware_campaign_use`	`string`
`notes`	`string`
`urls`	Array<`string`>
`cwes`	Array<`string`>

`LicenseRef`

Field	Type	Description
`value`	`string`
`spdxExpression`	`string`
`type`	`string`

`LocationRef`

Field	Type	Description
`real_path`	`string`
`access_path`	`string`
`position`	`PositionRef`

`Metadata`

Field	Type	Description
`duration_ms`	`integer`
`reachability_enabled`	`boolean`
`scorecard_enabled`	`boolean`
`analyzer_runs`	Array<`string`>
`analyzer_stats`	`object`

`PackageRef`

Field	Type	Description
`name`	`string`
`version`	`string`
`scope`	`string`
`purl`	`string`
`id`	`string`
`metadata`	`object`
`locations`	Array<`LocationRef`>
`licenses`	Array<`LicenseRef`>
`vulnerabilities`	Array<`VulnerabilityRef`>
`scorecard`	`PackageScorecard`
`relationship`	`string`
`direct`	`boolean`

`PackageRemediation`

Field	Type	Description
`status`	`string`
`recommended_version`	`string`
`suggestions`	Array<`PackageRemediationSuggestion`>

`PackageRemediationSuggestion`

Field	Type	Description
`affected_dependency_refs`	Array<`string`>
`suggested_action_dependency_ref`	`string`
`manifest_path`	`string`
`action`	`string`
`override_advice`	`string`

`PackageScorecard`

Field	Type	Description
`source`	`string`
`repository`	`string`
`commitSha`	`string`
`scorecardVersion`	`string`
`runDate`	`Time`
`aggregateScore`	`number`
`checks`	Array<`PackageScorecardCheck`>

`PackageScorecardCheck`

Field	Type	Description
`name`	`string`
`score`	`integer`
`reason`	`string`
`documentation`	`string`

`PositionRef`

Field	Type	Description
`file`	`string`
`line`	`integer`
`column`	`integer`
`end_line`	`integer`

`ProjectDescriptor`

Field	Type	Description
`name`	`string`
`path`	`string`
`target_type`	`string`
`target_ref`	`string`
`ecosystem`	`string`
`package_manager`	`string`

`Reachability`

Field	Type	Description
`status`	`string`
`tier`	`string`
`analyzer`	`string`
`reason`	`string`
`symbols`	Array<`AffectedSymbol`>
`call_paths`	Array<`CallPath`>
`hops`	`integer`
`confidence`	`string`
`dynamic_imports_detected`	`boolean`
`analyzed_at`	`string`

`Reference`

Field	Type	Description
`url`	`string`
`type`	`string`

`SourcePosition`

Field	Type	Description
`file`	`string`
`line`	`integer`
`column`	`integer`
`end_line`	`integer`

`Time`

`VulnerabilityRef`

Field	Type	Description
`id`	`string`
`source`	`string`
`title`	`string`
`severity`	`string`
`severity_source`	`string`
`aliases`	Array<`string`>
`description`	`string`
`reasons`	Array<`string`>
`cvss`	Array<`CVSSScore`>
`fixed_in`	`string`
`fixed_versions`	Array<`string`>
`fix_state`	`string`
`fix_available`	Array<`FixAvailable`>
`affected_version_range`	`string`
`references`	Array<`Reference`>
`kev_exploited`	`boolean`
`known_exploited`	Array<`KnownExploited`>
`epss`	Array<`EPSSScore`>
`cwes`	Array<`CWE`>
`risk_score`	`number`
`data_source`	`string`
`namespace`	`string`
`cpes`	Array<`string`>
`affected_symbols`	Array<`AffectedSymbol`>
`reachability`	`Reachability`

Back to all docs