XRAY: Troubleshooting "Component is not found for given SHA" Error in exportDetails REST-API

When encountering the "Component is not found for a given SHA'' error while attempting to retrieve (SBOM) details using the exportDetails REST API in Xray, it indicates potential issues with the provided component name or SHA256. Below are comprehensive steps to troubleshoot and resolve this error:

1. Identify the Issue

The error message suggests that either the component name or SHA256 is incorrect. To confirm, try running the exportDetails API call without specifying the component name, (as an example):

curl -XPOST -H "Content-Type: application/json" <artifactory-url>/xray/api/v1/component/exportDetails -d '{"license": true, "security": true, "exclude_unknown": true, "sha_256":"5cbde1b4c6cb34db1771c93929d49a293b8ad5017f9bd76ed127d2fc7b7d8a1d", "package_type": "maven", "output_format": "json" }' -o components.zip

If successful, it implies that the provided component name is the issue, if giving the only SHA256 and still the issue persists, it means that the file doesn’t exist in the database.

2. Retrieve Correct Component Name

To obtain the correct component name, explore the following three options:

Option 1: Using REST API

Execute the following REST API POST /dependencyGraph/artifact to retrieve the component ID, which can serve as the correct component name:
In the CURL request, I just gave the path for the Artifact /artifactory/"artifactpath.

curl -u admin:password -X POST -H "Content-Type: application/json" "<artifactory-url>/xray/api/v1/dependencyGraph/artifact" -d '{"path": "/artifactory/test-libs-release-local/mysql-connector-java/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar"}' | jq -r '.artifact.component_id'

The response will contain the component_id which should be used for exporting the SBOM file.

Option 2: Using Artifactory UI

Navigate to the file on the Artifactory UI, select "Xray -> scan lists -> repo -> descendants ," and copy the displayed name. Use this name as the component name in the REST API call:

Option 3: Using Chrome Developer Tools

Follow these steps:

Navigate to the file on the UI.
Open the developer tools.
Go to the network section.
Click on "Xray" as demonstrated.
Open the aboutBox in the Developer tools and use the component ID as the component name.

User-added image

After retrieving the correct component name, now we can run the Rest API with or without the SHA-256 using the component name, example below:

curl -uadmin:password -XPOST -H "Content-Type: application/json" <artifactory-url>/xray/api/v1/component/exportDetails -d '{"license": true, "security": true, "exclude_unknown": true,"component_name": "mysql:mysql-connector-java:5.1.41","package_type": "maven", "output_format": "json_full" }' -o  sbom_output.json

For more information on how Xray generate component name please refer to the following In Component Identifier page.