Dependency-Track SBOM upload "401 Unauthorized" API key in CI
The SBOM upload to Dependency-Track returned 401 Unauthorized because the X-Api-Key header was empty, wrong, or belongs to a team without the BOM_UPLOAD (and PROJECT_CREATION_UPLOAD) permission.
What this error means
The curl/API call to /api/v1/bom returns HTTP 401 and the SBOM is not ingested. The rest of the pipeline may then fail on a missing project or empty results.
< HTTP/1.1 401 Unauthorized
The API key is invalid or does not have the required permission (BOM_UPLOAD).Common causes
The API key secret is not set
DT_API_KEY is empty in the job (for example on a fork PR where secrets are withheld), so the header carries no key and the API returns 401.
The key lacks upload permission
The team the key belongs to does not have BOM_UPLOAD (and, for new projects, PROJECT_CREATION_UPLOAD), so Dependency-Track rejects the request.
How to fix it
Provide a key with upload permission
- Create a team in Dependency-Track with BOM_UPLOAD and PROJECT_CREATION_UPLOAD.
- Store its API key as a CI secret and pass it in the X-Api-Key header.
- Confirm the secret is available to the job (not a fork PR without secrets).
curl -X POST "$DT_URL/api/v1/bom" \
-H "X-Api-Key: ${DT_API_KEY}" \
-F "autoCreate=true" \
-F "projectName=my-app" -F "bom=@bom.json"Verify the key and URL
Check that DT_URL points at the API server and the key value is current; a rotated key or wrong base URL both surface as auth failures.
curl -H "X-Api-Key: $DT_API_KEY" "$DT_URL/api/v1/team/self"How to prevent it
- Grant the CI team only the permissions it needs (BOM_UPLOAD, project creation).
- Keep the API key and base URL in the secret store, not inline.
- Skip uploads on untrusted fork PRs where secrets are unavailable.