# $schema: https://spec.openapis.org/oas/3.1/schema-base/2025-02-13
openapi: 3.1.1
jsonSchemaDialect: https://spec.openapis.org/oas/3.1/dialect/base
info:
  title: Transparency Exchange API
  summary: The OWASP Transparency Exchange API specification for consumers and publishers
  description: TBC
  contact:
    name: TEA Working Group
    email: tbc@somewhere.tld
    url: https://github.com/CycloneDX/transparency-exchange-api
  license:
    name: Apache 2.0
    url: https://github.com/CycloneDX/transparency-exchange-api/blob/main/LICENSE
  version: 0.1.0-beta.1
servers:
  - url: http://localhost/tea/v1
    description: Local development
paths:
  /product/{uuid}:
    get:
      description: Returns the corresponding TEA components for a given TEA product UUID.
      operationId: getTeaProductByUuid
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of the TEA product in the TEA server
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Requested TEA Product found and returned
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/product"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Product
  /products:
    get:
      description: Returns a list of TEA products. Note that multiple products may
        match.
      operationId: getTeaProductByIdentifier
      parameters:
        - $ref: "#/components/parameters/page-offset"
        - $ref: "#/components/parameters/page-size"
        - $ref: "#/components/parameters/id-type"
        - $ref: "#/components/parameters/id-value"
      responses:
        '200':
          $ref: "#/components/responses/paginated-product"
        '400':
          $ref: "#/components/responses/400-invalid-request"
      tags:
        - TEA Product
  /component/{uuid}:
    get:
      description: Get a TEA Component
      operationId: getTeaComponentById
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Component in the TEA server
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Requested TEA Component found and returned
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/component"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Component
  /component/{uuid}/releases:
    get:
      description: Get releases of the component
      operationId: getReleasesByComponentId
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Component in the TEA server
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Requested Releases of TEA Component found and returned
          content:
            application/json:
              schema:
                type: array
                items:
                  "$ref": "#/components/schemas/release"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Component
  /release/{uuid}/collection/latest:
    get:
      description: Get the latest TEA Collection belonging to the TEA Release
      operationId: getLatestCollection
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Release in the TEA server
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Requested TEA Collection found and returned
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/collection"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Release
  /release/{uuid}/collections:
    get:
      description: Get the TEA Collections belonging to the TEA Release
      operationId: getCollectionsByReleaseId
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Release in the TEA server
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Requested TEA Collection found and returned
          content:
            application/json:
              schema:
                type: array
                items:
                  "$ref": "#/components/schemas/collection"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Release
  /release/{uuid}/collection/{collectionVersion}:
    get:
      description: Get a specific Collection (by version) for a TEA Release by its UUID
      operationId: getCollection
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Collection in the TEA server
          schema:
            "$ref": "#/components/schemas/uuid"
        - name: collectionVersion
          in: path
          required: true
          description: Version of TEA Collection
          schema:
            type: integer
      responses:
        '200':
          description: Requested TEA Collection Version found and returned
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/collection"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Release
  /artifact/{uuid}:
    get:
      description: Get metadata for specific TEA artifact
      operationId: getArtifact
      parameters:
        - name: uuid
          in: path
          required: true
          description: UUID of TEA Artifact in the TEA server
          schema:
            "$ref": "#/components/schemas/uuid"
      responses:
        '200':
          description: Requested TEA Artifact metadata found and returned
          content:
            application/json:
              schema:
                "$ref": "#/components/schemas/artifact"
        '400':
          $ref: "#/components/responses/400-invalid-request"
        '404':
          $ref: "#/components/responses/404-object-by-id-not-found"
      tags:
        - TEA Artifact
components:
  schemas:
    #
    # Definitions reused in multiple domain objects
    #
    date-time:
      type: string
      description: Timestamp
      format: date-time
      pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
      example: '2024-03-20T15:30:00Z'
    identifier:
      type: object
      description: An identifier with a specified type
      properties:
        idType:
          description: Type of identifier, e.g. `TEI`, `PURL`, `CPE`
          "$ref": "#/components/schemas/identifier-type"
        idValue:
          description: Identifier value
          type: string
    identifier-type:
      type: string
      description: Enumeration of identifiers types
      enum:
        - CPE
        - TEI
        - PURL
    uuid:
      type: string
      description: A UUID
      format: uuid
      pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

    #
    # TEA Product
    #
    product:
      type: object
      description: A TEA product
      properties:
        uuid:
          description: A unique identifier for the TEA product
          "$ref": "#/components/schemas/uuid"
        name:
          type: string
          description: Product name
        identifiers:
          type: array
          description: |
            List of identifiers for the product, like TEI, CPE, PURL or other identifiers
          items:
            "$ref": "#/components/schemas/identifier"
        components:
          type: array
          description: |
            List of TEA component-refs for the product. The component-ref by default just 
            includes the UUID of the component, but in some cases also include a reference
            to the UUID of a specific release.
          items:
            description: Unique identifier of the TEA component-ref
            "$ref": "#/components/schemas/uuid"
      required:
        - uuid
        - name
        - identifiers
        - components
      examples:
        - uuid: 09e8c73b-ac45-4475-acac-33e6a7314e6d
          name: Apache Log4j 2
          identifiers:
            - idType: CPE
              idValue: cpe:2.3:a:apache:log4j
            - idType: PURL
              idValue: pkg:maven/org.apache.logging.log4j/log4j-api
          components:
            - 3910e0fd-aff4-48d6-b75f-8bf6b84687f0
            - b844c9bd-55d6-478c-af59-954a932b6ad3
            - d6d3f754-d4f4-4672-b096-b994b064ca2d

    #
    # TEA Component and related objects
    #
    component:
      type: object
      description: A TEA component
      properties:
        uuid:
          description: A unique identifier for the TEA component
          "$ref": "#/components/schemas/uuid"
        name:
          type: string
          description: Component name
        identifiers:
          type: array
          description: List of identifiers for the component
          items:
            "$ref": "#/components/schemas/identifier"
      required:
        - uuid
        - name
        - identifiers
        - versions
      examples:
        - uuid: 3910e0fd-aff4-48d6-b75f-8bf6b84687f0
          name: Apache Log4j API
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.logging.log4j/log4j-api
        - uuid: b844c9bd-55d6-478c-af59-954a932b6ad3
          name: Apache Log4j Core
          identifiers:
            - idType: CPE
              idValue: cpe:2.3:a:apache:log4j
            - idType: PURL
              idValue: pkg:maven/org.apache.logging.log4j/log4j-core

#
    # Reference to a component, in some cases directly to a specific release
    # 
    # The release reference (release UUID) is only used in cases where a product
    # name incldues a version and this version of the product always include
    # the same releases of the component.
    component-ref:
      type: object
      description: A reference to a TEA component or specific component release
      properties:
        uuid:
          description: A unique identifier for the TEA component
          "$ref": "#/components/schemas/uuid"
        release:
          type: string
          description: |
            Optional UUID of a specific release included in the product in the case where the product
            always include a specific release of a component. The product name should include a version
            identifier in this case.
          items:
            "$ref": "#/components/schemas/uuid"
      required:
        - uuid



    #
    # TEA Release and related objects
    #
    release:
      type: object
      description: A TEA Component Release
      properties:
        uuid:
          description: A unique identifier for the TEA Component Release
          "$ref": "#/components/schemas/uuid"
        version:
          description: Version number
          type: string
          example: 1.2.3
        createdDate:
          description: Timestamp when this Release was created in TEA (for sorting purposes)
          "$ref": "#/components/schemas/date-time"
        releaseDate:
          description: Timestamp of the release
          "$ref": "#/components/schemas/date-time"
        preRelease:
          type: boolean
          description: |
            A flag indicating pre-release (or beta) status.
            May be disabled after the creation of the release object, but can't be enabled after creation of an object.
        identifiers:
          type: array
          description: List of identifiers for the component
          items:
            "$ref": "#/components/schemas/identifier"
        distributions:
          type: array
          description: List of different formats of this component release
          items:
            "$ref": "#/components/schemas/release-distribution"
        # add lifecycle here
      required:
        - uuid
        - version
        - createdDate
      examples:
        # Apache Tomcat 11.0.7
        - uuid: 605d0ecb-1057-40e4-9abf-c400b10f0345
          version: "11.0.7"
          createdDate: 2025-05-07T18:08:00Z
          releaseDate: 2025-05-12T18:08:00Z
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.7
          distributions:
            - distributionType: zip
              description: Core binary distribution, zip archive
              identifiers:
                - idType: PURL
                  idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?type=zip
              checksums:
                - algType: SHA_256
                  algValue: 9da736a1cdd27231e70187cbc67398d29ca0b714f885e7032da9f1fb247693c1
              url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip
              signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip.asc
            - distributionType: tar.gz
              description: Core binary distribution, tar.gz archive
              identifiers:
                - idType: PURL
                  idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?type=tar.gz
              checksums:
                - algType: SHA_256
                  algValue: 2fcece641c62ba1f28e1d7b257493151fc44f161fb391015ee6a95fa71632fb9
              url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.tar.gz
              signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.tar.gz.asc
            - distributionType: windows-x64.zip
              description: Core binary distribution, Windows x64 zip archive
              identifiers:
                - idType: PURL
                  idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?classifier=windows-x64&type=zip
              checksums:
                - algType: SHA_256
                  algValue: 62a5c358d87a8ef21d7ec1b3b63c9bbb577453dda9c00cbb522b16cee6c23fc4
              url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6-windows-x64.zip
              signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip.asc
            - distributionType: windows-x64.exe
              description: Core binary distribution, Windows Service Installer (MSI)
              checksums:
                - algType: SHA_512
                  algValue: 1d3824e7643c8aba455ab0bd9e67b14a60f2aaa6aa7775116bce40eb0579e8ced162a4f828051d3b867e96ee2858ec5da0cc654e83a83ba30823cbea0df4ff96
              url: https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe
              signatureUrl: https://downloads.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe.asc
        # A pre-release of Apache Tomcat
        - uuid: 95f481df-f760-47f4-b2f2-f8b76d858450
          version: "11.0.0-M26"
          createdDate: 2024-09-13T17:49:00Z
          preRelease: true
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.0-M26
    release-distribution:
      type: object
      properties:
        distributionType:
          type: string
          description: Unique identifier for the distribution type.
        description:
          type: string
          description: Free-text description of the distribution.
        identifiers:
          type: array
          description: List of identifiers specific to this distribution.
          items:
            $ref: "#/components/schemas/identifier"
        url:
          type: string
          description: Direct download URL for the distribution.
          format: url
        signatureUrl:
          type: string
          description: Direct download URL for the distribution's external signature.
          format: url
        checksums:
          type: array
          description: List of checksums for the distribution.
          items:
            "$ref": "#/components/schemas/checksum"
      required:
        - id
      examples:
        - distributionType: zip
          description: Core binary distribution, zip archive
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?type=zip
          checksums:
            - algType: SHA_256
              algValue: 9da736a1cdd27231e70187cbc67398d29ca0b714f885e7032da9f1fb247693c1
          url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip
          signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip.asc
        - distributionType: tar.gz
          description: Core binary distribution, tar.gz archive
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?type=tar.gz
          checksums:
            - algType: SHA_256
              algValue: 2fcece641c62ba1f28e1d7b257493151fc44f161fb391015ee6a95fa71632fb9
          url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.tar.gz
          signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.tar.gz.asc
        - distributionType: windows-x64.zip
          description: Core binary distribution, Windows x64 zip archive
          identifiers:
            - idType: PURL
              idValue: pkg:maven/org.apache.tomcat/tomcat@11.0.6?classifier=windows-x64&type=zip
          checksums:
            - algType: SHA_256
              algValue: 62a5c358d87a8ef21d7ec1b3b63c9bbb577453dda9c00cbb522b16cee6c23fc4
          url: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6-windows-x64.zip
          signatureUrl: https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.6.zip.asc
        - distributionType: windows-x64.exe
          description: Core binary distribution, Windows Service Installer (MSI)
          checksums:
            - algType: SHA_512
              algValue: 1d3824e7643c8aba455ab0bd9e67b14a60f2aaa6aa7775116bce40eb0579e8ced162a4f828051d3b867e96ee2858ec5da0cc654e83a83ba30823cbea0df4ff96
          url: https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe
          signatureUrl: https://downloads.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe.asc


    #
    # TEA Collection and related objects
    #
    collection:
      type: object
      description: A collection of security-related documents
      properties:
        uuid:
          description: |
            UUID of the TEA Collection object.
            Note that this is equal to the UUID of the associated TEA Component Release object.
            When updating a collection, only the `version` is changed.
          "$ref": "#/components/schemas/uuid"
        version:
          type: integer
          description: |
            TEA Collection version, incremented each time its content changes.
            Versions start with 1.
        date:
          description: The date when the TEA Collection version was created.
          "$ref": "#/components/schemas/date-time"
        updateReason:
          description: Reason for the update/release of the TEA Collection object.
          "$ref": "#/components/schemas/collection-update-reason"
        artifacts:
          type: array
          description: List of TEA artifact objects.
          items:
            "$ref": "#/components/schemas/artifact"
      examples:
        # Documents in the latest release of Log4j Core
        - uuid: 4c72fe22-9d83-4c2f-8eba-d6db484f32c8
          version: 3
          date: 2024-12-13T00:00:00Z
          updateReason:
            type: ARTIFACT_UPDATED
            comment: VDR file updated
          artifacts:
            - uuid: 1cb47b95-8bf8-3bad-a5a4-0d54d86e10ce
              name: Build SBOM
              type: BOM
              formats:
                - mime_type: application/vnd.cyclonedx+xml
                  description: CycloneDX SBOM (XML)
                  url: https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml
                  signature_url: https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml.asc
                  checksums:
                    - algType: MD5
                      algValue: 2e1a525afc81b0a8ecff114b8b743de9
                    - algType: SHA-1
                      algValue: 5a7d4caef63c5c5ccdf07c39337323529eb5a770
            - uuid: dfa35519-9734-4259-bba1-3e825cf4be06
              name: Vulnerability Disclosure Report
              type: vulnerability-assertion
              formats:
                - mime_type: application/vnd.cyclonedx+xml
                  description: CycloneDX VDR (XML)
                  url: https://logging.apache.org/cyclonedx/vdr.xml
                  checksums:
                    - algType: SHA-256
                      algValue: 75b81020b3917cb682b1a7605ade431e062f7a4c01a412f0b87543b6e995ad2a

    collection-update-reason:
      type: object
      description: Reason for the update to the TEA collection
      properties:
        type:
          description: Type of update reason.
          "$ref": "#/components/schemas/collection-update-reason-type"
        comment:
          type: string
          description: Free text description
    collection-update-reason-type:
      type: string
      description: Type of TEA collection update
      enum:
        - INITIAL_RELEASE
        - VEX_UPDATED
        - ARTIFACT_UPDATED
        - ARTIFACT_ADDED
        - ARTIFACT_REMOVED

    #
    # TEA Artifact and related objects
    #
    artifact:
      type: object
      description: A security-related document
      properties:
        uuid:
          description: UUID of the TEA Artifact object.
          "$ref": "#/components/schemas/uuid"
        name:
          type: string
          description: Artifact name
        type:
          description: Type of artifact
          "$ref": "#/components/schemas/artifact-type"
        distributionTypes:
          type: array
          description: |
            List of component distributions types that this artifact applies to.
            If absent, the artifact applies to all distributions.
          items:
            type: string
            description: |
              The `id` of the component format that this artifact applies to.
        formats:
          type: array
          description: |
            List of objects with the same content, but in different formats.
            The order of the list has no significance.
          items:
            "$ref": "#/components/schemas/artifact-format"
    artifact-type:
      type: string
      description: Specifies the type of external reference.
      enum:
        - ATTESTATION
        - BOM
        - BUILD_META
        - CERTIFICATION
        - FORMULATION
        - LICENSE
        - RELEASE_NOTES
        - SECURITY_TXT
        - THREAT_MODEL
        - VULNERABILITIES
        - OTHER
    artifact-format:
      type: object
      description: A security-related document in a specific format
      properties:
        mime_type:
          type: string
          description: The MIME type of the document
        description:
          type: string
          description: A free text describing the artifact
        url:
          type: string
          description: Direct download URL for the artifact
          format: url
        signatureUrl:
          type: string
          description: Direct download URL for an external signature of the artifact
          format: url
        checksums:
          type: array
          description: List of checksums for the artifact
          items:
            "$ref": "#/components/schemas/checksum"
    checksum:
      type: object
      properties:
        algType:
          description: Checksum algorithm
          "$ref": "#/components/schemas/checksum-type"
        algValue:
          type: string
          description: Checksum value
    checksum-type:
      type: string
      description: Checksum algorithm
      enum:
        - MD5
        - SHA-1
        - SHA-256
        - SHA-384
        - SHA-512
        - SHA3-256
        - SHA3-384
        - SHA3-512
        - BLAKE2b-256
        - BLAKE2b-384
        - BLAKE2b-512
        - BLAKE3
    #
    # Types used in API responses
    #
    pagination-details:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          example: '2024-03-20T15:30:00Z'
        pageStartIndex:
          type: integer
          format: int64
          default: 0
        pageSize:
          type: integer
          format: int64
          default: 100
        totalResults:
          type: integer
          format: int64
      required:
        - timestamp
        - pageStartIndex
        - pageSize
        - totalResults
  responses:
    204-common-delete:
      description: Object deleted successfully
      content:
        application/json: {}
    400-invalid-request:
      description: Request was Invalid
      content:
        application/json: {}
    401-unauthorized:
      description: Authentication required
      content:
        application/json: {}
    404-object-by-id-not-found:
      description: Object requested by identifier not found
      content:
        application/json: {}
    paginated-product:
      description: A paginated response containing TEA Products
      content:
        application/json:
          schema:
            allOf:
              - $ref: "#/components/schemas/pagination-details"
              - type: object
                properties:
                  results:
                    type: array
                    items:
                      "$ref": "#/components/schemas/product"
  parameters:
    # Pagination
    page-offset:
      name: pageOffset
      description: Pagination offset
      in: query
      required: false
      schema:
        type: integer
        format: int64
        default: 0
    page-size:
      name: pageSize
      description: Pagination offset
      in: query
      required: false
      schema:
        type: integer
        format: int64
        default: 100
    #
    # Query by identifier
    #
    # Since OpenAPI 3.0 it is possible to use RFC 6570-based serialization for JSON parameters of type array or object:
    #   https://swagger.io/docs/specification/v3_0/serialization/
    #
    # Unfortunately many tools don't support it, for example,
    # the `openapi-generator` for Java does not handle this correctly.
    #   https://github.com/OpenAPITools/openapi-generator/issues/4808
    #
    # This can be uncommented, when RFC 6570-base serialization reaches a wider adoption:
    #
    # identifier-param:
    #   name: identifierParam
    #   description: If present, only the objects with the given identifier will be returned.
    #   in: query
    #   schema:
    #     $ref: "#/components/schemas/identifier"
    #   style: form
    #   explode: true
    #
    # In the meantime we explode the object manually:
    id-type:
      # To allow RFC 6570 in the future without breaking changes to the HTTP API,
      # the name of this parameter should be identical to the equivalent property in /components/schemas/identifier
      name: idType
      description: Type of identifier specified in the `idValue` parameter
      in: query
      schema:
        $ref: "#/components/schemas/identifier-type"
    id-value:
      # To allow RFC 6570 in the future without breaking changes to the HTTP API,
      # the name of this parameter should be identical to the equivalent property in /components/schemas/identifier
      name: idValue
      description: If present, only the objects with the given identifier value will be returned.
      in: query
      schema:
        type: string

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
    basicAuth:
      type: http
      scheme: basic
security:
  - bearerAuth: []
  - basicAuth: []
tags:
  - name: TEA Product
  - name: TEA Component
  - name: TEA Release
  - name: TEA Artifact
externalDocs:
  description: Transparency Exchange API specification
  url: https://github.com/CycloneDX/transparency-exchange-api