1 Scope

This Standard defines the Transparency Exchange API (TEA), a format-agnostic protocol for the exchange of software, hardware and system transparency artefacts—including, but not limited to, Bills of Materials (xBOMs), attestations, vulnerability disclosure documents, and lifecycle events—between publishers and consumers.

The Standard covers:

• The Transparency Exchange Identifier (TEI) and its resolution.
• The data model used to describe products, components, releases, collections and artefacts.
• The HTTP API surface used to discover and retrieve transparency artefacts.
• Optional authentication and authorization, and the requirements on implementations that use them.

The Standard does not define the internal format of the transparency artefacts themselves; those are defined by their respective standards (e.g. CycloneDX, SPDX, OpenVEX, CSAF, CDXA).