A license inventory API should report what it knows, what evidence supports that knowledge, and what remains unresolved. In this case-study design, an inventory request can succeed while a separate release gate blocks approval whenever an obligation is unknown or needs review. That fail-closed gate is an organizational policy—not a behavior required by SPDX or CycloneDX.
Why the endpoint needs more than a license field
A package’s license metadata is evidence, not automatically a final determination of the terms governing a particular artifact. A producer may declare a license; an inventory may observe license information in files; and an analysis may conclude which license applies. Keeping those stages separate makes disagreement and uncertainty visible instead of collapsing them into a misleading “compliant” Boolean.
As an Amazon Associate I earn from qualifying purchases.
SPDX and CycloneDX both support exchanging software-component license information. ISO lists SPDX 2.2.1 as ISO/IEC 5962:2021, a standard data format for communicating component and metadata information associated with software packages. That publication is the v2.2.1 specification; it should not be confused with the distinct SPDX 3.0.1 semantics described below. ISO/IEC 5962:2021
What counts as license evidence?
Declared, observed, and concluded are different stages
CycloneDX distinguishes declared, observed, and concluded license records. A declaration records an initial assertion, while a conclusion reflects analysis and can differ from that assertion. Its guide explains: “On the other hand, concluded licenses are the result of a comprehensive analysis of the project’s codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses.” CycloneDX’s open-source licensing use case and its Authoritative Guide to SBOM describe these fields and the use of SPDX identifiers or expressions, license names, and license text.
#1 Best Overall
For an API, preserve each evidence stage as a separate value, with provenance. A declared value should not be relabeled as a conclusion merely because it is syntactically valid or matches a standard identifier. Likewise, an observed file or scanner result is evidence to evaluate, not by itself a legal conclusion.
Absence is not the same as a known unknown
SPDX 3.0.1 makes a critical distinction between an absent concluded-license relationship and an explicit NoAssertionLicense. The latter can record that no objective conclusion was possible, no analysis was attempted, or information was intentionally not supplied. If the relationship is absent, no such meaning follows. SPDX puts it plainly: “Note that a missing hasConcludedLicense is not the same as a relationship to a NoAssertionLicense since the latter is a ‘known unknown’ whereas no assumptions can be made from a missing hasConcludedLicense relationship.” SPDX 3.0.1 licensing model
That difference matters to downstream policy. A missing field means the inventory lacks a recorded value; an explicit unresolved value means the system has recorded a state of uncertainty. Neither state is evidence of a permissive license or a basis for automatic approval.
Designing the inventory response
Return the evidence and its resolution state rather than a single compliance verdict. For example, GET /components/{id}/license could return a successful inventory response even when the record needs review. This route and response shape are illustrative design choices, not a standardized endpoint or tested implementation.
| Response element | What it should convey |
|---|---|
| Component identity | Package name, version, and stable component identifier where available. |
| Source provenance | Where the value came from, such as package metadata, an inspected file, or an analysis result. |
| License evidence | Declared, observed, and concluded values kept distinct; preserve expressions, names, and available text rather than flattening them. |
| Conclusion method | The analysis method or evidence behind a conclusion, when one exists. |
| Normalization version | The SPDX License List and parser or normalization version used, so the interpretation can be reproduced. |
| Resolution state | A machine-readable state such as resolved, unknown, or review_required, with a reason when unresolved. |
Keep license evidence distinct from the organization’s authorization decision. This lets an inventory caller retrieve what is known without implying that retrieval itself approves release, deployment, or procurement.
Preserve licenses that are not on the list
The SPDX License List supplies identifiers, names, texts, and canonical URLs for commonly encountered licenses and exceptions. The list page retrieved for this case reports version 3.29.0, dated 2026-09-16; record the list version used to normalize a result rather than assuming identifiers will never change. SPDX License List
If a license is not listed, do not discard its text or reference simply because it lacks a standard identifier. The SPDX FAQ and the SPDX 2.2.2 document-composition guidance describe documenting non-listed license information, including defining a label for the license text and recording unique license information. Those are version-specific documentation practices, not a guarantee that a custom label will interoperate universally. SPDX FAQ · SPDX 2.2.2 document composition
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Where fail-closed behavior belongs
Put the block in a policy or release-gate layer that evaluates the inventory state. If the evidence cannot establish an obligation, the gate can deny approval or require review while the inventory API still returns its record. Make the denial reason machine-readable so a caller can distinguish an unresolved license from an unrelated authorization failure.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- The pages include spaces for, product name, description, category
- The other page includes spaces for purchases, sales, balances, as well as COG, units and total cost
- 120-page Inventory & Sales Ledger 8.5" x 11"
- Reorder SKU: LOG-120-7CW(Inventory-Sales)
- Collect: retrieve component identity and available declared, observed, or concluded license evidence.
- Normalize: interpret identifiers and expressions using a recorded list and parser version, preserving original text or references.
- Classify: mark a supported conclusion as resolved, and represent missing or inconclusive information with an explicit unresolved state and reason.
- Evaluate policy: pass resolved records to the organization’s rules; block approval when a blocking obligation remains unknown or requires review.
- Audit: retain the evidence source, normalization versions, reviewer, decision, and later resolution so the record can be reconstructed.
These steps describe a recommended architecture, not an HTTP status-code rule from either standard. The standards provide useful license-data semantics; they do not require a particular response status or mandate fail-closed approval policy.
What an SBOM can—and cannot—establish
License information in an SBOM can help identify potential incompatibilities and obligations such as attribution or source-code sharing. CycloneDX describes those as uses of its license capabilities, not as a legal conclusion about a specific dependency. An SBOM or license inventory supports identification and review; it does not, on its own, prove legal compliance for every jurisdiction, product, or distribution scenario. The organization still needs to assess the relevant evidence and its applicable policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
