Multipage preference

9 Data model

This section catalogues the named schemas declared in components.schemas.

9.1 artifact

A security-related document

Type: object

Table 88: Properties
Property Type Requirement Description
uuid uuid Required The UUID of the TEA Artifact object. Together with version uniquely identifies the TEA Artifact.
version integer Required Revision number, starting at 1 and incremented by 1 for each new revision of the same artifact UUID. Together with uuid uniquely identifies the TEA Artifact. Successive revisions cover content changes and changes to any published field, including external url or signatureUrl values. Each published revision is immutable. For a fixed artifact UUID, version, and format, the server shall ensure that successful content retrieval through its download endpoint, including retrieval after following redirects, yields unchanged artifact bytes after HTTP transfer coding and content coding are removed, and that successful signature retrieval through its signature download endpoint yields unchanged signature bytes on the same terms. Changing only a download response's Location, or only its HTTP content coding, while preserving those bytes, does not require a new artifact or collection version.
name string Optional A human-readable name for the artefact
type artifact-type Required Type of TEA Artifact
createdDate date-time Required The date and time the TEA Artifact revision was created.
distributionIds Array of uuid Optional Array of TEA Component Release distributions that this TEA Artifact applies to. If absent or empty, the TEA Artifact applies to all distributions.
formats Array of artifact-format Required List of objects with the same content, but in different formats. The order of the list has no significance.
Example 1 (Informative)
{
  "uuid": "1cb47b95-8bf8-3bad-a5a4-0d54d86e10ce",
  "version": 2,
  "name": "Build SBOM",
  "type": "BOM",
  "createdDate": "2024-12-13T00:00:00.000Z",
  "formats": [
    {
      "mediaType": "application/vnd.cyclonedx+xml",
      "description": "CycloneDX SBOM (XML)",
      "url": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml",
      "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml.asc",
      "checksums": [
        {
          "algType": "SHA-256",
          "algValue": "e04c9d55986d7194822eaa4f8115a77f801844d807ad6e0d454ac31dd41861e5"
        },
        {
          "algType": "SHA-1",
          "algValue": "5a7d4caef63c5c5ccdf07c39337323529eb5a770"
        }
      ]
    }
  ]
}
Example 2 (Informative)
{
  "uuid": "dfa35519-9734-4259-bba1-3e825cf4be06",
  "version": 7,
  "name": "Vulnerability Disclosure Report",
  "type": "VULNERABILITIES",
  "createdDate": "2024-12-15T00:00:00.000Z",
  "formats": [
    {
      "mediaType": "application/vnd.cyclonedx+xml",
      "description": "CycloneDX VDR (XML)",
      "url": "https://logging.apache.org/cyclonedx/vdr.xml",
      "checksums": [
        {
          "algType": "SHA-256",
          "algValue": "75b81020b3917cb682b1a7605ade431e062f7a4c01a412f0b87543b6e995ad2a"
        }
      ]
    }
  ]
}

9.2 artifact-format

A security-related document in a specific format

Type: object

Table 89: Properties
Property Type Requirement Description
mediaType string Required

The Media Type of the document.

A media type shall appear at most once across the formats of a single TEA Artifact revision, so that every format can be selected unambiguously by media type when downloading its content or its signature.
description string Optional A free text describing the TEA Artifact
url string Optional

External download URL for this format of the TEA Artifact.

This is always a location outside the TEA API. When present, clients shall retrieve the content from it. When absent, the TEA server hosts the content itself and clients shall retrieve it from the artifact download endpoint, /artifact/{uuid}/{artifactVersion}/download, selecting this format by its mediaType.

url and signatureUrl should be stable URLs. Servers should not publish pre-signed or otherwise expiring URLs in them. A server that serves content from expiring storage links shall omit them and answer from the download endpoints, with 302 where the bytes live elsewhere.

A TEA access token is sent only to the TEA server's own API base URL, never to an external URL. External locations are either openly accessible or require credentials the client arranges separately.

External url values are part of the published artifact revision. Changing url shall create a new artifact revision, even when content bytes and checksums are unchanged. The server shall preserve the URLs published on each historical artifact revision. If a Collection adopts that new revision, collection versioning follows collection.version.

Byte stability for content retrieved through the server's download endpoint follows artifact.version.

The TEA server does not control the bytes behind an external url, so for every format that has a url the server shall publish at least one checksum: the checksums are the integrity statement for the revision. Content retrieved from url that does not match them is not the content of that revision.

Format: uri.
signatureUrl string Optional

External download URL for a detached signature of this format of the TEA Artifact.

As with url, this is always a location outside the TEA API. When present, clients shall retrieve the signature from it. When absent, clients shall retrieve it from the artifact signature download endpoint, /artifact/{uuid}/{artifactVersion}/signature/download, selecting this format by its mediaType; that endpoint returns 404 when no signature is published for the format. The same access-token, stable-URL, and revision rules as for url apply to signatureUrl. Byte stability for signature retrieval through the server's signature download endpoint follows artifact.version.

This specification does not define which signature technology is used, nor model the signing algorithm, key, or certificate chain.

Format: uri.
checksums Array of checksum Optional

Checksums for this artifact format's content bytes (the payload retrieved from url or from the artifact download endpoint for this mediaType), not the detached signature. When present, checksums shall contain at least one entry. When url is present, checksums is required. Those checksums are the integrity statement for that external url. Content retrieved from url that does not match them is not the content of that revision.

Published checksums shall be calculated over the artifact format's bytes before HTTP content coding is applied. Clients verifying them shall first remove any HTTP transfer coding and content coding, and shall not otherwise transform or canonicalize the artifact bytes. An artifact that is itself compressed, such as a .gz file, stays in that form. The TEA servers shall not declare the artifact's own compression as HTTP content coding, because clients would then remove it and the checksum would not match.

9.3 artifact-type

Type of TEA Artifact.

Type: string

Table 90: Enumeration of possible values
Value
ATTESTATION
BOM
BUILD_META
CERTIFICATION
FORMULATION
LICENSE
RELEASE_NOTES
SECURITY_TXT
THREAT_MODEL
VULNERABILITIES
OTHER

9.4 checksum

Integrity digest for identified content bytes. algValue is the lowercase hexadecimal encoding of the digest produced by algType over those bytes. The hex length shall match the algorithm's digest size (for example 40 for SHA-1, 64 for SHA-256 / SHA3-256 / BLAKE2b-256 / BLAKE3, 96 for SHA-384 / SHA3-384 / BLAKE2b-384, 128 for SHA-512 / SHA3-512 / BLAKE2b-512).

Type: object

Table 91: Properties
Property Type Requirement Description
algType checksum-type Required Checksum algorithm
algValue string Required Lowercase hexadecimal digest value for algType. Do not use Base64 or uppercase hex.
Minimum length: 40. Maximum length: 128. Pattern: ^[0-9a-f]+$.

9.5 checksum-type

Checksum algorithm

Type: string

Table 92: Enumeration of possible values
Value
SHA-1
SHA-256
SHA-384
SHA-512
SHA3-256
SHA3-384
SHA3-512
BLAKE2b-256
BLAKE2b-384
BLAKE2b-512
BLAKE3

9.6 cle

Lifecycle events for the object this endpoint is called on, as a TEA projection of the Common Lifecycle Enumeration (ECMA-428, 1st edition).

This is not a CLE document. The document envelope ($schema, identifier, updatedAt, and index / next page chaining) is not carried: the TEA object the response belongs to supplies the identity, and TEA has its own pagination. The event vocabulary, ordering and semantics are those of ECMA-428; the field shapes are TEA's. A consumer that needs a CLE document applies the mapping rules below and adds the envelope; a producer that holds a CLE document applies them in reverse. Publishers that need a bit-identical CLE 1.0.0 document publish it as a TEA Artifact in a release collection, as artifact type OTHER until a dedicated type exists; the same artifact may be referenced from more than one collection. The CLE endpoints are not a substitute for that document.

Mapping to ECMA-428:

  • identifiers[] on componentRenamed uses the TEA identifier shape (idType, idValue); CLE uses type / value with the same meaning.
  • A version specifier { version } names one version without a vers scheme, because a TEA server does not always know the package ecosystem. It corresponds to the CLE range vers:<scheme>/<version> once the scheme is known. { range } is a CLE range as-is.
  • cle-event is one flat object. The fields ECMA-428 requires or permits for each event type apply as written there; servers shall populate the required ones and omit fields that do not belong to the type.

Selection. Servers shall return in events a subset of the events of the CLE data they hold for the component or product, and shall not alter an event beyond the mapping above. On a release endpoint, servers may omit events scoped to other versions: events whose versions do not cover the release's version, and released events whose version differs from it. Events that name no version, other than withdrawn events, apply to the component as a whole and are retained. Inclusion of withdrawn events follows the rule below. Servers shall not otherwise reduce the set, and in particular shall not collapse it to the latest event per type. Servers shall not renumber event id values. Servers shall include a withdrawn event if, and only if, they include the event it withdraws. definitions.support shall contain at least the policies referenced by the included events.

events shall be ordered by id descending, as in ECMA-428. A server that provides CLE for an object answers 200, with an empty events array when no event has been recorded yet. A server that does not provide CLE for the object answers 404 with error: NOT_IMPLEMENTED; error: OBJECT_UNKNOWN means the object itself is unknown.

Type: object

Table 93: Properties
Property Type Requirement Description
events Array of cle-event Required Array of CLE Event objects representing lifecycle events. Events shall be ordered by id descending (newest events with highest IDs first).
definitions cle-definitions Optional Container for reusable policy definitions referenced by events
Example (Informative)
{
  "events": [
    {
      "id": 3,
      "type": "endOfSupport",
      "effective": "2025-06-01T00:00:00Z",
      "versions": [
        {
          "range": "vers:npm/>=1.0.0|<2.0.0"
        }
      ],
      "supportId": "standard",
      "published": "2025-01-01T00:00:00Z"
    },
    {
      "id": 2,
      "type": "endOfDevelopment",
      "effective": "2025-01-01T00:00:00Z",
      "versions": [
        {
          "version": "1.0.0"
        }
      ],
      "supportId": "standard",
      "published": "2024-06-01T00:00:00Z"
    },
    {
      "id": 1,
      "type": "released",
      "effective": "2024-01-01T00:00:00Z",
      "version": "1.0.0",
      "license": "Apache-2.0",
      "published": "2024-01-01T00:00:00Z"
    }
  ],
  "definitions": {
    "support": [
      {
        "id": "standard",
        "description": "Standard product support policy",
        "url": "https://example.com/support/standard"
      }
    ]
  }
}

9.7 cle-definitions

Container for reusable CLE policy definitions

Type: object

Table 94: Properties
Property Type Requirement Description
support Array of cle-support-definition Optional List of support policies

9.8 cle-event

A discrete lifecycle event from the CLE specification (ECMA-428).

CLE timestamps in TEA responses use the shared date-time schema: UTC with the Z designator, fractional seconds preserved. A +00:00 offset in an upstream CLE document denotes the same instant and is re-expressed as Z. Any other offset is not UTC and is not valid CLE.

Type: object

Table 95: Properties
Property Type Requirement Description
id integer Required A unique, auto-incrementing integer identifier for the event
type cle-event-type Required The type of lifecycle event
effective date-time Required When the event takes effect.
published date-time Required When the event was first published.
version string Optional Version string (used by released event type)
versions Array of cle-version-specifier Optional List of version specifiers affected by this event
supportId string Optional Reference to a support policy ID defined in the definitions section
license string Optional License identifier (used by released event type)
supersededByVersion string Optional Version string that supersedes the affected versions (used by supersededBy event type)
identifiers Array of identifier Optional New identifiers for the component (componentRenamed only), in the TEA identifier shape. Corresponds to CLE identifiers[] with type / value.
eventId integer Optional ID of the event being withdrawn (used by withdrawn event type)
reason string Optional Human-readable explanation (used by withdrawn event type)
description string Optional Human-readable description of the event
references Array of string Optional List of URLs to supporting documentation
Example 1 (Informative)
{
  "id": 1,
  "type": "released",
  "effective": "2024-01-01T00:00:00Z",
  "version": "1.0.0",
  "license": "MIT",
  "published": "2023-06-01T00:00:00Z"
}
Example 2 (Informative)
{
  "id": 3,
  "type": "endOfSupport",
  "effective": "2024-01-01T00:00:00Z",
  "versions": [
    {
      "version": "1.0.0"
    }
  ],
  "supportId": "standard",
  "published": "2023-06-01T00:00:00Z"
}

9.9 cle-event-type

The type of CLE lifecycle event

Type: string

Table 96: Enumeration of possible values
Value
released
endOfDevelopment
endOfSupport
endOfLife
endOfDistribution
endOfMarketing
supersededBy
componentRenamed
withdrawn

9.10 cle-support-definition

A support policy definition from CLE

Type: object

Table 97: Properties
Property Type Requirement Description
id string Required Unique identifier for the support policy
description string Required Human-readable description of the policy
url string Optional URL to detailed documentation about this support policy
Format: uri.
Example (Informative)
{
  "id": "standard",
  "description": "Standard product support policy",
  "url": "https://example.com/support/standard"
}

9.11 cle-version-specifier

Which versions an event affects. Exactly one of version or range. range is an ECMA-428 version specification (vers). version names a single version without a vers scheme and is a TEA extension: it maps to vers:<scheme>/<version> when the ecosystem is known.

Type: object

Table 98: Properties
Property Type Requirement Description
version string Optional A specific version string
range string Optional A version range in vers format (e.g. "vers:npm/>=1.0.0|<2.0.0")

9.12 collection

A collection of security-related documents.

Every component release and product release has a collection. If no artifacts have been published when the release first becomes retrievable, the server serves version 1 with an empty artifacts list and updateReason.type: INITIAL_RELEASE. That version is immutable like any other; the first artifacts are published as version 2.

Type: object

Table 99: Properties
Property Type Requirement Description
uuid uuid Required UUID of the TEA Collection object. A TEA Collection shall use the same UUID as its parent Product Release or Component Release. Within an API base, a Product Release and a Component Release shall not share a UUID. Consequently, Collections belonging to different parent releases have different UUIDs. Versions of the same Collection retain the same UUID. See doc/tea-uuid-scope.md.
version integer Required TEA Collection version, incremented by 1 each time its content changes. Versions start with 1. Content changes include replacing an embedded artifact with a newer revision (for example one published because an external url or signatureUrl changed). If a Collection adopts that new artifact revision, the server shall publish a new Collection version. Previously published Collection versions shall remain unchanged. Classification of that adoption follows collection-update-reason-type.
createdDate date-time Required The date when the TEA Collection version was created.
belongsTo collection-belongs-to-type Required Indicates whether this collection belongs to a Component Release or a Product Release
updateReason collection-update-reason Required Reason for the update/release of the TEA Collection object.
artifacts Array of artifact Required Array of TEA Artifact objects (may be empty).
Example (Informative)
{
  "uuid": "da89e38e-95e7-44ca-aa7d-f3b6b34c7fab",
  "version": 10,
  "createdDate": "2024-12-15T00:00:00.000Z",
  "belongsTo": "COMPONENT_RELEASE",
  "updateReason": {
    "type": "VEX_UPDATED",
    "comment": "VDR file updated"
  },
  "artifacts": [
    {
      "uuid": "1cb47b95-8bf8-3bad-a5a4-0d54d86e10ce",
      "createdDate": "2024-12-13T00:00:00.000Z",
      "version": 2,
      "name": "Build SBOM",
      "type": "BOM",
      "formats": [
        {
          "mediaType": "application/vnd.cyclonedx+xml",
          "description": "CycloneDX SBOM (XML)",
          "url": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml",
          "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml.asc",
          "checksums": [
            {
              "algType": "SHA-256",
              "algValue": "e04c9d55986d7194822eaa4f8115a77f801844d807ad6e0d454ac31dd41861e5"
            },
            {
              "algType": "SHA-1",
              "algValue": "5a7d4caef63c5c5ccdf07c39337323529eb5a770"
            }
          ]
        }
      ]
    },
    {
      "uuid": "dfa35519-9734-4259-bba1-3e825cf4be06",
      "createdDate": "2024-12-15T00:00:00.000Z",
      "version": 7,
      "name": "Vulnerability Disclosure Report",
      "type": "VULNERABILITIES",
      "formats": [
        {
          "mediaType": "application/vnd.cyclonedx+xml",
          "description": "CycloneDX VDR (XML)",
          "url": "https://logging.apache.org/cyclonedx/vdr.xml",
          "checksums": [
            {
              "algType": "SHA-256",
              "algValue": "75b81020b3917cb682b1a7605ade431e062f7a4c01a412f0b87543b6e995ad2a"
            }
          ]
        }
      ]
    }
  ]
}

9.13 collection-belongs-to-type

Indicates whether a collection belongs to a component release or a product release

Type: string

Table 100: Enumeration of possible values
Value
COMPONENT_RELEASE
PRODUCT_RELEASE

9.14 collection-update-reason

Reason for the update to the TEA collection

Type: object

Table 101: Properties
Property Type Requirement Description
type collection-update-reason-type Required Type of update reason.
comment string Optional Free text description

9.15 collection-update-reason-type

Type of TEA collection update.

VEX_UPDATED covers adding or revising an artifact of type VULNERABILITIES, including a revision whose external url or signatureUrl changed. VEX and VDR share that type. ARTIFACT_UPDATED covers a new revision of an artifact whose type is not VULNERABILITIES, including a revision whose external url or signatureUrl changed. Replacing an embedded artifact revision solely because its published url or signatureUrl changed is VEX_UPDATED when the artifact type is VULNERABILITIES, and ARTIFACT_UPDATED otherwise. Removing an artifact, including one of type VULNERABILITIES, counts as ARTIFACT_REMOVED.

The first Collection version shall use INITIAL_RELEASE. In subsequent versions, adding or revising an artifact of type VULNERABILITIES counts as VEX_UPDATED. When multiple change kinds occur, the server shall select updateReason.type using the precedence rule below.

When a collection version other than the first contains changes of more than one kind, the server shall set updateReason.type to the first applicable value in this order: VEX_UPDATED, ARTIFACT_REMOVED, ARTIFACT_ADDED, ARTIFACT_UPDATED. comment can describe the other changes. A client that needs the complete set of changes should compare the version with the previous one.

Type: string

Table 102: Enumeration of possible values
Value
INITIAL_RELEASE
VEX_UPDATED
ARTIFACT_UPDATED
ARTIFACT_ADDED
ARTIFACT_REMOVED

9.16 compliance-document-type

Well-known compliance document types. When idType is COMPLIANCE_DOCUMENT, the idValue shall be one of these values.

Type: string

Table 103: Enumeration of possible values
Value
SOC_2_TYPE_I
SOC_2_TYPE_II
SOC_3
ISO_27001
ISO_27017
ISO_27018
ISO_27701
ISO_42001
PCI_DSS
HIPAA
FEDRAMP
GDPR
CSA_STAR
NIST_800_53
NIST_800_171
CMMC
HITRUST
TISAX
CYBER_ESSENTIALS
CYBER_ESSENTIALS_PLUS
EU_DECLARATION_OF_CONFORMITY

9.17 component

A TEA component

Type: object

Table 104: Properties
Property Type Requirement Description
uuid uuid Required A unique identifier for the TEA component
name string Required Component name. Within a TEA server, component names should be unique among components. Uniqueness is an implementation recommendation, not a hard API requirement. Product and component names are separate namespaces; a product and a component may share the same name.
identifiers Array of identifier Required List of identifiers for the component
Example 1 (Informative)
{
  "uuid": "3910e0fd-aff4-48d6-b75f-8bf6b84687f0",
  "name": "Apache Log4j API",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.logging.log4j/log4j-api"
    }
  ]
}
Example 2 (Informative)
{
  "uuid": "b844c9bd-55d6-478c-af59-954a932b6ad3",
  "name": "Apache Log4j Core",
  "identifiers": [
    {
      "idType": "CPE",
      "idValue": "cpe:2.3:a:apache:log4j"
    },
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.logging.log4j/log4j-core"
    }
  ]
}
Example 3 (Informative)
{
  "uuid": "c71b316e-ae77-11f1-aafb-1a52914d44b2",
  "name": "Apache Tomcat",
  "identifiers": [
    {
      "idType": "CPE",
      "idValue": "cpe:2.3:a:apache:tomcat"
    },
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat"
    }
  ]
}

9.18 component-ref

A reference to a TEA component or specific component release

Type: object

Table 105: Properties
Property Type Requirement Description
uuid uuid Required A unique identifier for the TEA component
release uuid Optional Optional UUID of a specific release included in the product in the case where the product always include a specific release of a component. The product name should include a version identifier in this case.

9.19 component-release

A TEA Component Release

Type: object

Table 106: Properties
Property Type Requirement Description
uuid uuid Required A unique identifier of the TEA Component Release. Within an API base it shall not also identify a Product Release; see doc/tea-uuid-scope.md.
component uuid Required UUID of the TEA Component this release belongs to
componentName string Optional Name of the TEA Component this release belongs to
version string Required Human-readable version string
createdDate date-time Required Timestamp when this Release was created in TEA (for sorting purposes)
releaseDate date-time Optional Timestamp of the release
preRelease boolean Optional A flag indicating pre-release (or beta) status. May be disabled after the creation of the release object, but can't be enabled after creation of an object.
identifiers Array of identifier Optional Array of identifiers for the component release
distributions Array of release-distribution Optional List of different formats of this component release
Example 1 (Informative)
{
  "uuid": "da89e38e-95e7-44ca-aa7d-f3b6b34c7fab",
  "version": "2.24.3",
  "component": "b844c9bd-55d6-478c-af59-954a932b6ad3",
  "componentName": "Apache Log4j Core",
  "createdDate": "2024-12-10T10:51:00.000Z",
  "releaseDate": "2024-12-13T12:52:29.000Z",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.logging.log4j/log4j-core@2.24.3"
    }
  ]
}
Example 2 (Informative)
{
  "uuid": "605d0ecb-1057-40e4-9abf-c400b10f0345",
  "version": "11.0.7",
  "component": "c71b316e-ae77-11f1-aafb-1a52914d44b2",
  "createdDate": "2025-05-07T18:08:00.000Z",
  "releaseDate": "2025-05-12T18:08:00.000Z",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7"
    }
  ],
  "distributions": [
    {
      "distributionId": "6a0d58e1-4896-4f1e-83f7-5feb6c032537",
      "description": "Core binary distribution, zip archive",
      "identifiers": [
        {
          "idType": "PURL",
          "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?type=zip"
        }
      ],
      "checksums": [
        {
          "algType": "SHA-256",
          "algValue": "9da736a1cdd27231e70187cbc67398d29ca0b714f885e7032da9f1fb247693c1"
        }
      ],
      "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.zip",
      "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.zip.asc"
    },
    {
      "distributionId": "dba01c13-dd96-4928-be72-9c87ffa8cab8",
      "description": "Core binary distribution, tar.gz archive",
      "identifiers": [
        {
          "idType": "PURL",
          "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?type=tar.gz"
        }
      ],
      "checksums": [
        {
          "algType": "SHA-256",
          "algValue": "2fcece641c62ba1f28e1d7b257493151fc44f161fb391015ee6a95fa71632fb9"
        }
      ],
      "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.tar.gz",
      "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.tar.gz.asc"
    },
    {
      "distributionId": "cfe068c2-fae7-43d0-97ec-5ea092454040",
      "description": "Core binary distribution, Windows x64 zip archive",
      "identifiers": [
        {
          "idType": "PURL",
          "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?classifier=windows-x64&type=zip"
        }
      ],
      "checksums": [
        {
          "algType": "SHA-256",
          "algValue": "62a5c358d87a8ef21d7ec1b3b63c9bbb577453dda9c00cbb522b16cee6c23fc4"
        }
      ],
      "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7-windows-x64.zip",
      "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7-windows-x64.zip.asc"
    },
    {
      "distributionId": "de45ffaf-e4b5-47b5-be28-444a76df098e",
      "description": "Core binary distribution, Windows Service Installer (.exe)",
      "checksums": [
        {
          "algType": "SHA-512",
          "algValue": "1d3824e7643c8aba455ab0bd9e67b14a60f2aaa6aa7775116bce40eb0579e8ced162a4f828051d3b867e96ee2858ec5da0cc654e83a83ba30823cbea0df4ff96"
        }
      ],
      "url": "https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe",
      "signatureUrl": "https://downloads.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe.asc"
    }
  ]
}
Example 3 (Informative)
{
  "uuid": "95f481df-f760-47f4-b2f2-f8b76d858450",
  "version": "11.0.0-M26",
  "component": "c71b316e-ae77-11f1-aafb-1a52914d44b2",
  "createdDate": "2024-09-13T17:49:00.000Z",
  "preRelease": true,
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.0-M26"
    }
  ]
}

9.20 component-release-with-collection

A TEA Component Release together with its latest collection.

Extends component-release with a latestCollection property; every field of component-release applies unchanged.

Includes all properties of component-release.

Table 107: Properties
Property Type Requirement Description
latestCollection collection Required The latest TEA Collection for this component release
Example (Informative)
{
  "uuid": "605d0ecb-1057-40e4-9abf-c400b10f0345",
  "version": "11.0.7",
  "createdDate": "2025-05-07T18:08:00.000Z",
  "releaseDate": "2025-05-12T18:08:00.000Z",
  "component": "c71b316e-ae77-11f1-aafb-1a52914d44b2",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7"
    }
  ],
  "latestCollection": {
    "uuid": "605d0ecb-1057-40e4-9abf-c400b10f0345",
    "version": 2,
    "createdDate": "2025-05-12T18:08:00.000Z",
    "belongsTo": "COMPONENT_RELEASE",
    "updateReason": {
      "type": "VEX_UPDATED",
      "comment": "First artifacts published for this release"
    },
    "artifacts": [
      {
        "uuid": "3c8f5d2a-6b1e-4f7a-9c0d-2e5b8a1f4c93",
        "name": "Build SBOM",
        "version": 1,
        "createdDate": "2025-05-07T18:08:00.000Z",
        "type": "BOM",
        "formats": [
          {
            "mediaType": "application/vnd.cyclonedx+xml",
            "description": "CycloneDX SBOM (XML)",
            "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7-cyclonedx.xml",
            "checksums": [
              {
                "algType": "SHA-256",
                "algValue": "66218c5c43e1a62fc2e3904500980241698aeddea4a6c446fda781c900e9d497"
              }
            ]
          }
        ]
      },
      {
        "uuid": "b7e2c4d9-1f3a-4a6e-8d5b-9c0e7f2a3b14",
        "name": "Vulnerability Disclosure Report",
        "version": 1,
        "createdDate": "2025-05-09T18:08:00.000Z",
        "type": "VULNERABILITIES",
        "formats": [
          {
            "mediaType": "application/vnd.cyclonedx+xml",
            "description": "CycloneDX VDR (XML)",
            "url": "https://tomcat.apache.org/cyclonedx/vdr.xml",
            "checksums": [
              {
                "algType": "SHA-256",
                "algValue": "3d93f05e799f6897570537313e8217dd67583c3b65f08ff0ebbce455357a6101"
              }
            ]
          }
        ]
      }
    ]
  }
}

9.21 date-time

Timestamp, RFC 3339 in UTC with the Z designator. Offsets are not accepted; servers shall convert to UTC before emitting. Fractional seconds are optional and preserved as sent. All timestamps in this specification use this schema.

Type: string

Format: date-time

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$

Example (Informative)
2024-03-20T15:30:00Z

9.22 discovery-info

Discovery information for one product release matched by a TEI or PURL lookup. A successful /discovery response is a non-empty array of these objects, ordered by priority when more than one release matches (first entry highest). .well-known/tea selects where /discovery is called; servers[] lists API bases that serve this product release (same version and priority selection rules). A rootUrl need not appear in the well-known endpoint list.

Type: object

Table 108: Properties
Property Type Requirement Description
productReleaseUuid uuid Required UUID of the resolved TEA Product Release
servers Array of server-info Required Non-empty array of TEA servers that serve this product release. Each entry has rootUrl (without trailing slash) and versions.

9.23 error-response

TEA API error body. Servers shall emit exactly this shape: error is one of the values of unknown-error-type, and message is the only other property allowed. Clients recognize a TEA error by an application/json response whose body is a JSON object with a string error property. Other JSON 404 bodies are not TEA error responses.

Any 4xx from a resource endpoint may carry an error-response body; when present, error is from unknown-error-type. Clients shall not require a body.

Type: object

Table 109: Properties
Property Type Requirement Description
error unknown-error-type Required
message string Optional Optional human-readable explanation for diagnostics. Clients shall not interpret it programmatically.

9.24 identifier

An identifier of a TEA object with a specified type. COMPLIANCE_DOCUMENT is valid only on TEA Components and TEA Component Releases (see identifier-type).

Type: object

Table 110: Properties
Property Type Requirement Description
idType identifier-type Required Type of identifier, e.g. TEI, PURL, CPE
idValue string Required Identifier value

9.25 identifier-type

Enumeration of identifier types.

COMPLIANCE_DOCUMENT marks a TEA Component or TEA Component Release as carrying a compliance document (for example a SOC 2 report), so that it can be discovered with idType=COMPLIANCE_DOCUMENT on /components and /componentReleases; the document itself is published as a TEA Artifact of the component release. It shall not be used on products, product releases, distributions, or CLE events.

Type: string

Table 111: Enumeration of possible values
Value
CPE
TEI
PURL
COMPLIANCE_DOCUMENT

9.26 paginated-collection-response

A paginated response containing TEA Collections

Includes all properties of pagination-details.

Table 112: Properties
Property Type Requirement Description
results Array of collection Required
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0",
  "results": []
}
Example 2 (Informative)
{
  "hasNext": false,
  "results": []
}

9.27 paginated-component-release-response

A paginated response containing TEA Component Releases

Includes all properties of pagination-details.

Table 113: Properties
Property Type Requirement Description
results Array of component-release Required
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0",
  "results": []
}
Example 2 (Informative)
{
  "hasNext": false,
  "results": []
}

9.28 paginated-component-response

A paginated response containing TEA Components

Includes all properties of pagination-details.

Table 114: Properties
Property Type Requirement Description
results Array of component Required
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0",
  "results": []
}
Example 2 (Informative)
{
  "hasNext": false,
  "results": []
}

9.29 paginated-product-release-response

A paginated response containing TEA Product Releases

Includes all properties of pagination-details.

Table 115: Properties
Property Type Requirement Description
results Array of product-release Required
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0",
  "results": []
}
Example 2 (Informative)
{
  "hasNext": false,
  "results": []
}

9.30 paginated-product-response

A paginated response containing TEA Products

Includes all properties of pagination-details.

Table 116: Properties
Property Type Requirement Description
results Array of product Required
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0",
  "results": []
}
Example 2 (Informative)
{
  "hasNext": false,
  "results": []
}

9.31 pagination-details

Type: object

Table 117: Properties
Property Type Requirement Description
hasNext boolean Required

A flag indicating whether there is another page of results to fetch.

When hasNext is true, nextPageToken shall be present. When hasNext is false, nextPageToken shall not be included.

Default: false.
nextPageToken string Optional

An opaque token that can be used in a following request to retrieve the next page of results.

This field shall be present when hasNext is true. This field shall not be included when hasNext is false.
Example 1 (Informative)
{
  "hasNext": true,
  "nextPageToken": "eyJwYWdlIjoiY29udGludWF0aW9uIn0"
}
Example 2 (Informative)
{
  "hasNext": false
}

9.32 product

A TEA product

Type: object

Table 118: Properties
Property Type Requirement Description
uuid uuid Required A unique identifier for the TEA product
name string Required Product name. Within a TEA server, product names should be unique among products. Uniqueness is an implementation recommendation, not a hard API requirement. Product and component names are separate namespaces; a product and a component may share the same name.
identifiers Array of identifier Required List of identifiers for the product, like TEI, CPE, PURL or other identifiers
Example (Informative)
{
  "uuid": "09e8c73b-ac45-4475-acac-33e6a7314e6d",
  "name": "Apache Log4j 2",
  "identifiers": [
    {
      "idType": "CPE",
      "idValue": "cpe:2.3:a:apache:log4j"
    },
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.logging.log4j/log4j-api"
    }
  ]
}

9.33 product-release

A specific release of a TEA product

Type: object

Table 119: Properties
Property Type Requirement Description
uuid uuid Required A unique identifier for the TEA Product Release. Within an API base it shall not also identify a Component Release; see doc/tea-uuid-scope.md.
product uuid Required UUID of the TEA Product this release belongs to
productName string Optional Name of the TEA Product this release belongs to
version string Required Human-readable version string of the product release
createdDate date-time Required Timestamp when this Product Release was created in TEA (for sorting purposes)
releaseDate date-time Optional Timestamp of the product release
preRelease boolean Optional A flag indicating pre-release (or beta) status. May be disabled after the creation of the release object, but can't be enabled after creation of an object.
identifiers Array of identifier Optional Array of identifiers for the product release (idType is CPE, TEI or PURL; COMPLIANCE_DOCUMENT is not valid here)
components Array of component-ref Required Array of component references that compose this product release. A component reference can optionally include the UUID of a specific component release to pin the exact version.
Example (Informative)
{
  "uuid": "123e4567-e89b-12d3-a456-426614174000",
  "version": "2.24.3",
  "product": "09e8c73b-ac45-4475-acac-33e6a7314e6d",
  "createdDate": "2025-04-01T15:43:00.000Z",
  "releaseDate": "2025-04-01T15:43:00.000Z",
  "identifiers": [
    {
      "idType": "TEI",
      "idValue": "tei://vendor.example.com/uuid/47f51950-b0e2-11f1-adc2-1a52914d44b2"
    }
  ],
  "components": [
    {
      "uuid": "3910e0fd-aff4-48d6-b75f-8bf6b84687f0"
    },
    {
      "uuid": "b844c9bd-55d6-478c-af59-954a932b6ad3",
      "release": "da89e38e-95e7-44ca-aa7d-f3b6b34c7fab"
    }
  ]
}

9.34 product-release-with-collection

A TEA Product Release together with its latest collection.

Extends product-release with a latestCollection property; every field of product-release applies unchanged.

Includes all properties of product-release.

Table 120: Properties
Property Type Requirement Description
latestCollection collection Required The latest TEA Collection for this product release
Example (Informative)
{
  "uuid": "123e4567-e89b-12d3-a456-426614174000",
  "version": "2.24.3",
  "product": "09e8c73b-ac45-4475-acac-33e6a7314e6d",
  "createdDate": "2025-04-01T15:43:00.000Z",
  "releaseDate": "2025-04-01T15:43:00.000Z",
  "identifiers": [
    {
      "idType": "TEI",
      "idValue": "tei://vendor.example.com/uuid/47f51950-b0e2-11f1-adc2-1a52914d44b2"
    }
  ],
  "components": [
    {
      "uuid": "3910e0fd-aff4-48d6-b75f-8bf6b84687f0"
    },
    {
      "uuid": "b844c9bd-55d6-478c-af59-954a932b6ad3",
      "release": "da89e38e-95e7-44ca-aa7d-f3b6b34c7fab"
    }
  ],
  "latestCollection": {
    "uuid": "123e4567-e89b-12d3-a456-426614174000",
    "version": 1,
    "createdDate": "2025-04-01T15:43:00.000Z",
    "belongsTo": "PRODUCT_RELEASE",
    "updateReason": {
      "type": "INITIAL_RELEASE"
    },
    "artifacts": []
  }
}

9.35 release-distribution

Type: object

Table 121: Properties
Property Type Requirement Description
distributionId uuid Required A unique identifier for the TEA Distribution object (uuid)
description string Optional Free-text description of the distribution
identifiers Array of identifier Optional Array of identifiers specific to this distribution
url string Optional Direct download URL for the distribution. This is always a location outside the TEA API. A TEA access token is sent only to the TEA server's own API base URL, never to an external URL: distribution locations are either openly accessible, pre-signed, or require credentials the client arranges separately.
Format: uri.
signatureUrl string Optional Direct download URL for the distribution's external signature. As with url, this is always a location outside the TEA API. A TEA access token is sent only to the TEA server's own API base URL, never to an external URL.
Format: uri.
checksums Array of checksum Optional Array of checksums for the distribution payload retrieved from url (the distribution bytes, not the signature at signatureUrl).
Example 1 (Informative)
{
  "distributionId": "6a0d58e1-4896-4f1e-83f7-5feb6c032537",
  "description": "Core binary distribution, zip archive",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?type=zip"
    }
  ],
  "checksums": [
    {
      "algType": "SHA-256",
      "algValue": "9da736a1cdd27231e70187cbc67398d29ca0b714f885e7032da9f1fb247693c1"
    }
  ],
  "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.zip",
  "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.zip.asc"
}
Example 2 (Informative)
{
  "distributionId": "dba01c13-dd96-4928-be72-9c87ffa8cab8",
  "description": "Core binary distribution, tar.gz archive",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?type=tar.gz"
    }
  ],
  "checksums": [
    {
      "algType": "SHA-256",
      "algValue": "2fcece641c62ba1f28e1d7b257493151fc44f161fb391015ee6a95fa71632fb9"
    }
  ],
  "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.tar.gz",
  "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7.tar.gz.asc"
}
Example 3 (Informative)
{
  "distributionId": "cfe068c2-fae7-43d0-97ec-5ea092454040",
  "description": "Core binary distribution, Windows x64 zip archive",
  "identifiers": [
    {
      "idType": "PURL",
      "idValue": "pkg:maven/org.apache.tomcat/tomcat@11.0.7?classifier=windows-x64&type=zip"
    }
  ],
  "checksums": [
    {
      "algType": "SHA-256",
      "algValue": "62a5c358d87a8ef21d7ec1b3b63c9bbb577453dda9c00cbb522b16cee6c23fc4"
    }
  ],
  "url": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7-windows-x64.zip",
  "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat/11.0.7/tomcat-11.0.7-windows-x64.zip.asc"
}
Example 4 (Informative)
{
  "distributionId": "de45ffaf-e4b5-47b5-be28-444a76df098e",
  "description": "Core binary distribution, Windows Service Installer (.exe)",
  "checksums": [
    {
      "algType": "SHA-512",
      "algValue": "1d3824e7643c8aba455ab0bd9e67b14a60f2aaa6aa7775116bce40eb0579e8ced162a4f828051d3b867e96ee2858ec5da0cc654e83a83ba30823cbea0df4ff96"
    }
  ],
  "url": "https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe",
  "signatureUrl": "https://downloads.apache.org/tomcat/tomcat-11/v11.0.7/bin/apache-tomcat-11.0.7.exe.asc"
}

9.36 server-info

TEA server information including URL, versions, and optional priority

Type: object

Table 122: Properties
Property Type Requirement Description
rootUrl string Required Absolute API base URL for this TEA server, without trailing slash. Shall not include userinfo, query, or fragment. The scheme match is lowercase only (normalized form). Conforming deployments use lowercase https; http is allowed only so local-test documents still validate.
Format: uri. Pattern: ^https?://[^/?#@]+(/[^?#\s]*[^/?#\s])?$.
versions Array of string Required Supported TEA API versions at this server, without a leading v. Each value is full SemVer 2.0.0 (MAJOR.MINOR.PATCH with optional prerelease and build metadata). Clients select the highest mutually supported version and append /v followed by that exact string.
priority number Optional Optional priority for this server (0.0 to 1.0, where 1.0 is highest priority). If omitted in the JSON response, clients shall treat the effective priority as 1.0 when ordering servers (the same rule as for .well-known/tea endpoint priority).
Default: 1. Minimum: 0. Maximum: 1. Format: float.

9.37 token-error-response

Token error response, as defined in RFC 6749 section 5.2.

Type: object

Table 123: Properties
Property Type Requirement Description
error string (enum) Required Error code as defined in RFC 6749 section 5.2.
One of: invalid_request, invalid_client, invalid_grant, unauthorized_client, unsupported_grant_type, invalid_scope.
error_description string Optional Human-readable text providing additional information about the error.
error_uri string Optional URI of a human-readable web page with information about the error.
Format: uri.

9.38 token-request

Token request for the client_credentials grant, as defined in RFC 6749 section 4.4.2, or an optional assertion grant identified below. The scope parameter applies to both. The assertion parameter applies only to assertion grants. RFC 8693 token exchange is outside the TEA 1.0 profile (see /token description).

Type: object

Table 124: Properties
Property Type Requirement Description
grant_type string Required OAuth 2.0 grant type. Servers shall support client_credentials. Servers may support assertion grants (urn:ietf:params:oauth:grant-type:saml2-bearer, urn:ietf:params:oauth:grant-type:jwt-bearer). Token exchange (urn:ietf:params:oauth:grant-type:token-exchange) is outside the TEA 1.0 interoperable authentication profile; see /token.
scope string Optional Optional space-delimited scope request (RFC 6749 section 3.3). TEA does not define scope values; servers may ignore this parameter.
assertion string Optional Assertion value, when an assertion grant type is used (RFC 7521 section 4.1).

9.39 token-response

Successful token response, as defined in RFC 6749 section 5.1.

Type: object

Table 125: Properties
Property Type Requirement Description
access_token string Required The issued access token, presented on other TEA endpoints as Authorization: Bearer <access_token>. Opaque to the client.
token_type string Required Token type. Always Bearer in TEA.
expires_in integer Optional Lifetime of the access token in seconds. Servers should include this so that clients can re-authenticate before expiry rather than on failure.
scope string Optional Granted scope, when it differs from the scope requested.

9.40 unknown-error-type

Classification of TEA error response

Type: string

Table 126: Enumeration of possible values
Value
OBJECT_UNKNOWN
NOT_IMPLEMENTED
NO_ACCEPTABLE_FORMAT
SIGNATURE_NOT_FOUND
INVALID_REQUEST
INVALID_PAGE_TOKEN

9.41 uuid

A UUID in lower case (RFC 9562)

Type: string

Format: uuid

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$