System Package Data Exchange™ (SPDX®) Ontology
type: Ontology
abstract: This ontology defines the terms and relationships used in the SPDX specification to describe system packages
creator: SPDX Project
license: Community-Spec-1.0.html
references: specifications
title: System Package Data Exchange (SPDX) Ontology
preferred namespace prefix: spdx
copyright: Copyright (C) SPDX Project

NoAssertionElement
type: NamedIndividual
type: IndividualElement
comment: An Individual Value for Element representing a set of Elements of unknown identity or cardinality (number).
creationInfo: creationInfo NoAssertionElement

NoneElement
type: NamedIndividual
type: IndividualElement
comment: An Individual Value for Element representing a set of Elements with cardinality (number/count) of zero.
creationInfo: creationInfo NoneElement

NoAssertionLicense
type: NamedIndividual
type: IndividualLicensingInfo
comment: An Individual Value for License when no assertion can be made about its actual value.
creationInfo: creationInfo NoAssertionLicense

NoneLicense
type: NamedIndividual
type: IndividualLicensingInfo
comment: An Individual Value for License where the SPDX data creator determines that no license is present.
creationInfo: creationInfo NoneLicense

mass
type: DatatypeProperty
comment: Information related to physical hardware.
range: decimal
note: Mass is defined as an intrinsic property of a body for describing a physical hardware component.

Licensing
preferred namespace prefix: spdx-licensing

Lite
preferred namespace prefix: spdx-lite

exportControlClassificationResult
type: DatatypeProperty
comment: Provides the result of an export control assessment.
range: ExportControlClassification
note: Provides the result of an export control assessment.

AIPackage
type: Class
type: NodeShape
comment: A Package that contains AI software or an AI model.
subclass of: Package
note: A Package that contains code or a model that provides artificial intelligence capabilities.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: limitation
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metric
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: hyperparameter
property:
  datatype: string
  max count: 1
  path: informationAboutTraining
property:
  class: EnergyConsumption
  max count: 1
  node kind: BlankNodeOrIRI
  path: energyConsumption
property:
  in: yes
  in: no
  in: noAssertion
  max count: 1
  path: autonomyType
property:
  datatype: string
  path: typeOfModel
property:
  datatype: string
  path: standardCompliance
property:
  datatype: string
  path: modelDataPreprocessing
property:
  in: yes
  in: no
  in: noAssertion
  max count: 1
  path: useSensitivePersonalInformation
property:
  in: serious
  in: high
  in: medium
  in: low
  max count: 1
  path: safetyRiskAssessment
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metricDecisionThreshold
property:
  datatype: string
  path: domain
property:
  datatype: string
  max count: 1
  path: informationAboutApplication
property:
  datatype: string
  path: modelExplainability
property:
  in: autonomous
  in: fullAutomation
  in: highAutomation
  in: conditionalAutomation
  in: partialAutomation
  in: assistiveAutomation
  in: notAutomated
  max count: 1
  path: isoAutomationLevel

kilowattHour
type: NamedIndividual
type: EnergyUnitType
comment: Kilowatt-hour.

megajoule
type: NamedIndividual
type: EnergyUnitType
comment: Megajoule.

other
type: NamedIndividual
type: EnergyUnitType
comment: Any other units of energy measurement.

high
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The second-highest level of risk posed by an AI system.

low
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: Low/no risk is posed by an AI system.

medium
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The third-highest level of risk posed by an AI system.

serious
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The highest level of risk posed by an AI system.

autonomyType
type: ObjectProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Core/isoAutomationLevel instead. Indicates whether the system can perform a decision or action without human involvement or guidance.
range: PresenceType
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/isoAutomationLevel instead. Indicates if the system is fully automated or a human is involved in any of the decisions of the AI system. - yes: Indicates that the system is fully automated. - no: Indicates that a human is involved in any of the decisions of the AI system. - noAssertion: Makes no assertion about the autonomy.

domain
type: DatatypeProperty
comment: Domain in which the AI package can be used.
range: string
note: A free-form text that describes the domain where the AI model contained in the AI software can be expected to operate successfully. Examples include computer vision, natural language processing, etc.

energyConsumption
type: ObjectProperty
comment: Energy consumption incurred by an AI model.
range: EnergyConsumption
note: Energy consumption of an AI model, either known or estimated. In the absence of direct measurements, an SPDX data creator may choose to estimate the energy consumption based on information about computational resources (e.g., number of floating-point operations), training time, and other relevant training details.

energyQuantity
type: DatatypeProperty
comment: Energy quantity.
range: decimal
note: Provides the quantity information of the energy.

energyUnit
type: ObjectProperty
comment: Unit in which energy is measured.
range: EnergyUnitType
note: Provides the unit information of the energy.

finetuningEnergyConsumption
type: ObjectProperty
comment: Energy consumed when finetuning the AI model that is being used in the AI system.
range: EnergyConsumptionDescription
note: The field specifies the amount of energy consumed when finetuning the AI model that is being used in the AI system.

hyperparameter
type: ObjectProperty
comment: Hyperparameter used to build the AI model contained in the AI package.
range: DictionaryEntry
note: Records a hyperparameter value. Hyperparameters are settings defined before the training process that control the learning algorithm's behavior. They differ from model parameters, which are learned from the data during training. Developers typically set hyperparameters manually or through a process of hyperparameter tuning (also known as trial and error). Examples of hyperparameters include learning rate, batch size, and the number of layers in a neural network.

inferenceEnergyConsumption
type: ObjectProperty
comment: Energy consumed during inference time by an AI model that is being used in the AI system.
range: EnergyConsumptionDescription
note: The field specifies the amount of energy consumed during inference time by an AI model that is being used in the AI system.

informationAboutApplication
type: DatatypeProperty
comment: Information about the AI software, not including the model description.
range: string
note: A free-form text description of how the AI model is used within the software. It should include any relevant information, such as pre-processing steps, third-party APIs, and other pertinent details. It can also include: - Functionality provided by the AI model within the software application, including: any specific tasks or decisions it is designed to perform; any pre-processing steps that are applied to the input data before it is fed into the AI model for inference, such as data cleaning, normalization, or feature extraction; and any third-party APIs or services that are used in conjunction with the AI model, such as data sources, cloud services, or other AI models. - Description of any dependencies or requirements needed to run the AI model within the software application, including: specific hardware, software libraries, and operating systems.

informationAboutTraining
type: DatatypeProperty
comment: Information about different steps of the training process.
range: string
note: A detailed explanation of the training process, including the specific techniques, algorithms, and methods employed. Examples include: - training data used to train the AI model, along with any relevant details about its source, quality, and pre-processing steps; - specific training algorithms employed, including stochastic gradient descent, backpropagation, and reinforcement learning; - specific training techniques used to improve the performance or accuracy of the AI model, such as transfer learning, fine-tuning, or active learning; and - any evaluation metrics used to assess the performance of the AI model during the training process, including accuracy, precision, recall, and F1 score.

limitation
type: DatatypeProperty
comment: Limitation of the AI software.
range: string
note: A free-form text that captures a limitation of the AI package (or of the AI models present in the AI package). Note that this is not guaranteed to be exhaustive. For instance, a limitation can be that the AI package is having poor accuracy for a certain demography.

metric
type: ObjectProperty
comment: Metric used to evaluate the AI model.
range: DictionaryEntry
note: Metric used to evaluate the AI model. This makes statements about the prediction quality including uncertainty, accuracy, characteristics of the tested population, quality, fairness, explainability, robustness etc.

metricDecisionThreshold
type: ObjectProperty
comment: Threshold that was used for computation of a metric described in the metric field.
range: DictionaryEntry
note: Each metric can be computed based on a decision threshold. For instance, precision or recall is typically computed by checking if the probability of the outcome is larger than 0.5. Each decision threshold shall match with a metric field defined in the AI package.

modelDataPreprocessing
type: DatatypeProperty
comment: Preprocessing steps applied to the training data before the model training.
range: string
note: A free-form text that describes the preprocessing steps applied to the training data before training of the model(s) contained in the AI software.

modelExplainability
type: DatatypeProperty
comment: Methods that can be used to explain the results from the AI model.
range: string
note: A free-form text that lists the different explainability mechanisms and how they can be used to explain the results from the AI model. The mechanisms can be model-agnostic methods, such as SHapley Additive exPlanations (SHAP) <https://shap.readthedocs.io/> and Local Interpretable Model-agnostic Explanations (LIME) <https://github.com/marcotcr/lime>, and model-specific methods that applied to a limited category of models.

safetyRiskAssessment
type: ObjectProperty
comment: Results of general safety risk assessment of the AI system.
range: SafetyRiskAssessmentType
note: Results of general safety risk assessment of the AI system. Using categorization according to the EU general risk assessment methodology <https://ec.europa.eu/docsroom/documents/17107>. The methodology implements Article 20 of Regulation (EC) No 765/2008 and is intended to assist authorities when they assess general product safety compliance. It is important to note that this categorization differs from the one proposed in the EU AI Act's provisional agreement.

standardCompliance
type: DatatypeProperty
comment: A standard with which the artifact complies.
range: string
note: A free-form textual description that captures a standard with which the artifact complies. The standard may, but is not necessarily required to, satisfy a legal or regulatory requirement. If the artifact is using a standard as a reference or guideline, but not necessarily compliant with it, use the /Core/standardName property instead. For a detailed compliance information, please consider defining a /Core/Relationship with "conformsTo" relationship type to a /Core/Regulation.

trainingEnergyConsumption
type: ObjectProperty
comment: Energy consumed when training the AI model that is being used in the AI system.
range: EnergyConsumptionDescription
note: The field specifies the amount of energy consumed when training the AI model that is being used in the AI system.

typeOfModel
type: DatatypeProperty
comment: Type of the model used in the AI software.
range: string
note: A free-form text that records the type of the AI model(s) used in the software. For instance, if it is a supervised model, unsupervised model, reinforcement learning model or a combination of those.

useSensitivePersonalInformation
type: ObjectProperty
comment: Records if sensitive personal information is used during model training or could be used during the inference.
range: PresenceType
note: Notes if sensitive personal information is used in the training or inference of the AI models. This can include biometric data, addresses or other data that can be used to infer a person's identity. Related: hasSensitivePersonalInformation in /Dataset/DatasetPackage

buildEndTime
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Core/endTime instead. Property that describes the time at which a build stops.
range: dateTimeStamp
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/endTime instead. buildEndTime describes the time at which a build stops or finishes. This value is typically recorded by the builder.

buildId
type: DatatypeProperty
comment: A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
range: string
note: A buildId is a locally unique identifier to identify a unique instance of a build, according to the buildType. This identifier differs based on build toolchain, platform, or naming convention used by an organization or standard.

buildStartTime
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Core/startTime instead. Property describing the start time of a build.
range: dateTimeStamp
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/startTime instead. buildStartTime is the time at which a build is triggered. The builder typically records this value.

buildType
type: DatatypeProperty
comment: A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
range: anyURI
note: A buildType is an IRI expressing the toolchain, platform, or infrastructure that the build was invoked on. The buildType is used to interpret the meaning of other build parameters by defining the "type" of build; if the same buildType is seen in different Build elements, it means they are the same kind of build, but difference instances and possible with different configurations. If you are not using a well-known buildType, it should be namespaced to a domain you own to prevent conflicts with other buildType IRIs. Examples of a buildType can be: - A GitHub action workflow - A step in a GitHub actions pipeline - An invocation of a compiler or other tool - A script that orchestrates builds at a higher level Keep in mind that builds can be "nested" using the ancestorOf relationship. If the buildType IRI is not recognized, it is still possible to inspect other properties of the build, but it may not be possible to derive deeper meaning from them. For more information, see the SLSA definition of buildType.

configSourceDigest
type: ObjectProperty
comment: Property that describes the digest of the build configuration file used to invoke a build.
range: Hash
note: configSourceDigest is the checksum of the build configuration file used by a builder to execute a build, according to the buildType. This property uses the Core model's Hash class.

configSourceEntrypoint
type: DatatypeProperty
comment: Property describes the invocation entrypoint of a build.
range: string
note: A build entrypoint is the invoked executable of a build which always runs when the build is triggered, according to the buildType. For example, when a build is triggered by running a shell script, the entrypoint is script.sh. In terms of a declared build, the entrypoint is the position in a configuration file or a build declaration which is always run when the build is triggered. For example, in the following configuration file, the entrypoint of the build is publish. name: Publish packages to PyPI on: create: tags: "*" jobs: publish: runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/') steps: ...

configSourceUri
type: DatatypeProperty
comment: Property that describes the URI of the build configuration source file.
range: anyURI
note: If a build configuration exists for the toolchain or platform performing the build, the configSourceUri of a build is the URI of that build configuration, according to the buildType. For example, a build triggered by a GitHub Action is defined by a build configuration YAML file. In this case, the configSourceUri is the URL of that YAML file.

environment
type: ObjectProperty
comment: Property describing the session in which a build is invoked.
range: DictionaryEntry
note: environment is a map of environment variables and values that are set during a build session, according to the buildType. This is different from the parameter property in that it describes the environment variables set before a build is invoked rather than the variables provided to the builder.

parameter
type: ObjectProperty
comment: Property describing a parameter used in an instance of a build.
range: DictionaryEntry
note: parameter is a key-value of a build parameter and its value that was provided to the builder for a build instance, according to the buildType. This is different from the environment property in that the key and value are provided as command line arguments or a configuration file to the builder.

other
type: NamedIndividual
type: AnnotationType
comment: Used to store extra information about an Element which is not part of a review (e.g. extra information provided during the creation of the Element).

review
type: NamedIndividual
type: AnnotationType
comment: Used when someone reviews the Element.

compliance
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact point for compliance (i.e. export control, licensing).

other
type: NamedIndividual
type: ContactPointRelationshipType
comment: A generic contact point to be used when the contact type does not match any of the other options.

securityVulnerability
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact for reporting security vulnerabilities.

support
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact point for support.

ark
type: NamedIndividual
type: ExternalIdentifierType
comment: Archival Resource Key (ARK) <https://arks.org/about/>, is a Uniform Resource Identifier (URI) suited to being a persistent identifier for information objects of any type, standardized by the ARK Identifier Scheme <https://datatracker.ietf.org/doc/draft-kunze-ark/> Internet-Draft. It consists of the "ark:" label followed by a Name Assigning Authority Number, a forward slash, a name, and an optional qualifier (e.g., ark:12148/btv1b8449691v/f29).

bic
type: NamedIndividual
type: ExternalIdentifierType
comment: Business Identifier Code (BIC), also known as SWIFT-BIC or SWIFT code, is a unique 8 or 11-character alphanumeric code standardized by ISO 9362 <https://www.iso.org/standard/84108.html> to identify financial and non-financial institutions (e.g., BBWCUS33).

cpe22
type: NamedIndividual
type: ExternalIdentifierType
comment: Common Platform Enumeration Specification 2.2 <https://cpe.mitre.org/files/cpe-specification_2.2.pdf>.

cpe23
type: NamedIndividual
type: ExternalIdentifierType
comment: Common Platform Enumeration: Naming Specification Version 2.3 <https://csrc.nist.gov/publications/detail/nistir/7695/final>.

cve
type: NamedIndividual
type: ExternalIdentifierType
comment: Common Vulnerabilities and Exposures identifiers, an identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the CVE specification <https://csrc.nist.gov/glossary/term/cve_id>.

doi
type: NamedIndividual
type: ExternalIdentifierType
comment: Digital Object Identifier (DOI) <https://www.doi.org/the-identifier/what-is-a-doi/> is a unique, ISO 26324 <https://www.iso.org/standard/88862.html>-standardized identifier for physical, digital, or abstract objects, formatted as a prefix and suffix separated by a forward slash (e.g., 10.1000/182).

duns
type: NamedIndividual
type: ExternalIdentifierType
comment: Data Universal Numbering System (D-U-N-S) Number <https://www.dnb.com/en-us/smb/duns.html> is a unique nine-digit identifier, issued by Dun & Bradstreet, that identifies a business entity, often on a location-specific basis.

ecli
type: NamedIndividual
type: ExternalIdentifierType
comment: European Case Law Identifier (ECLI) <https://data.europa.eu/data/datasets/european-case-law-identifier-ecli> is a uniform identifier for judicial decisions across Europe. It consists of five mandatory components: the "ECLI" prefix, a country code, a court code, the year of the decision, and a unique serial number (e.g., ECLI:EU:C:2023:94).

eli
type: NamedIndividual
type: ExternalIdentifierType
comment: European Legislation Identifier (ELI) <https://eur-lex.europa.eu/content/help/eurlex-content/eli.html> is a Uniform Resource Identifier (URI) that uniquely identifies a legal resource, typically consisting of a document type, adoption year, and document number (e.g., http://data.europa.eu/eli/reg/2024/2847/oj).

email
type: NamedIndividual
type: ExternalIdentifierType
comment: Email address, as defined in RFC 3696 <https://datatracker.ietf.org/doc/rfc3696/> Section 3.

eori
type: NamedIndividual
type: ExternalIdentifierType
comment: Economic Operators Registration and Identification (EORI) number <https://taxation-customs.ec.europa.eu/customs/customs-procedures-import-and-export/customs-operations/economic-operators-registration-and-identification-number-eori_en> is a unique identifier for businesses undertaking customs operations across European Union customs territory, such as import, export, and transit. It consists of an ISO 3166-1 alpha-2 country code followed by a national identifier of up to 15 alphanumeric characters (e.g., PL1234567890ABCDE).

evidenceUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The unique identifier used by a reporting management system or any other lifecycle management tool to uniquely identify an evidence relationship item.

gitoid
type: NamedIndividual
type: ExternalIdentifierType
comment: Gitoid <https://www.iana.org/assignments/uri-schemes/prov/gitoid>, stands for Git Object ID <https://git-scm.com/book/en/v2/Git-Internals-Git-Objects>. A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an Artifact Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types> for the software artifact or an Input Manifest Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier> for the software artifact's associated Artifact Input Manifest <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest>; this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See OmniBOR Specification <https://github.com/omnibor/spec/>, a minimalistic specification for describing software Artifact Dependency Graphs <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg>.

gln
type: NamedIndividual
type: ExternalIdentifierType
comment: Global Location Number (GLN) <https://www.gs1.org/standards/id-keys/gln> is a 13-digit number, assigned by GS1, that uniquely identifies a legal entity (e.g., a company or customer), a function within a legal entity, a physical location (e.g., a warehouse or a specific shelf in a store), or a digital location (e.g., an Electronic Data Interchange (EDI) gateway).

glue
type: NamedIndividual
type: ExternalIdentifierType
comment: GLobal Unique Enterprise (GLUE) Identifiers <https://datatracker.ietf.org/doc/draft-ietf-spice-glue-id/>, as defined by the IETF Internet-Draft, is expressed as a GLUE URI, a Uniform Resource Identifier that standardizes the representation of existing organizational entity identifiers.

gtin
type: NamedIndividual
type: ExternalIdentifierType
comment: Global Trade Item Number (GTIN) <https://www.gs1.org/standards/id-keys/gtin> is a number, assigned by GS1, that uniquely identifies a trade item (product or service).

hsCodes
type: NamedIndividual
type: ExternalIdentifierType
comment: The Harmonized System (HS) <https://www.wcoomd.org/en/topics/nomenclature/overview/what-is-the-harmonized-system.aspx> of tariff nomenclature is an internationally standardized system of names and numbers, defined by the World Customs Organization, used to classify traded products.

iban
type: NamedIndividual
type: ExternalIdentifierType
comment: International Bank Account Number (IBAN) is a system for identifying bank accounts across national borders standardized by ISO 13616 <https://www.iso.org/standard/81090.html>. It consists of up to 34 alphanumeric characters, including a country code, two check digits, and a basic bank account number. While spaces may be inserted for human readability, they must be omitted when used for electronic data exchange (e.g., IE64IRCE92050112345678).

ibid
type: NamedIndividual
type: ExternalIdentifierType
comment: International Business Identifier (IBID) <https://ekys.org/business_identifiers/> is a verifiable unique identifier for legal entities as defined in the ISO/DIS 25500-3 <https://www.iso.org/standard/87705.html> draft standard. It is composed of three data elements: the International Business Registration Number (IBRN), the legal name, and the date of origin formatted as eight numeric characters (YYYYMMDD). Each element is separated by a pipe character (|) (e.g., US-DE.BER:3031657|Code Management Association|19990420).

ibrn
type: NamedIndividual
type: ExternalIdentifierType
comment: International Business Registration Number (IBRN) <https://ekys.org/business_identifiers/> is a unique identifier for legal entities standardized by ISO 8000-116 <https://www.iso.org/standard/75117.html>. It is composed of two parts: a jurisdiction prefix and a local authoritative legal entity identifier (ALEI), separated by a colon. The prefix contains an ISO 3166 country code, an optional subdivision code, and a register code (e.g., US-DE.BER:3031657).

isan
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Audiovisual Number (ISAN) <https://www.isan.org/about/#what_is_isan> is a unique 24-digit hexadecimal identifier for audiovisual works standardized by ISO 15706 <https://www.iso.org/standard/83124.html>. The ISAN remains persistent for a work regardless of its distribution format or its use. To facilitate human readability, the "ISAN" label, grouping hyphens, and two check characters are included (e.g., ISAN 0000-0000-3A8D-0000-Z-0000-0000-6); however, these elements shall be omitted when the identifier is stored electronically (e.g., 000000003A8D000000000000).

isbn
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Book Number (ISBN) <https://www.isbn-international.org/content/isbn-users-manual/29> is a unique numeric identifier for monographic publications standardized by ISO 2108 <https://www.iso.org/standard/65483.html>. It consists of either 10 digits (for assignments prior to January 1, 2007) or 13 digits. A 13-digit ISBN is composed of five parts: a GS1 prefix, a registration group, a registrant, a publication element, and a check digit. While elements may be divided by spaces or hyphens for human readability, these separators shall be omitted when the identifier is stored electronically (e.g., 9780198836063).

iscc
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Content Code (ISCC) <https://iscc.io/> is a content-derived identifier standardized by ISO 24138 <https://www.iso.org/standard/77899.html> for identifying digital assets. ISCC can be used in conjunction with other schemes, such as DOI, ISAN, ISBN, ISRC, ISSN and ISWC. A standard ISCC-CODE is build from multiple ISCC-UNITs. Each unit serve a different purpose. An ISCC-CODE typically look like ISCC:KACT4EBWK27737D2AYCJRAL5Z36G76RFRMO4554RU26HZ4ORJGIVHDI.

isci
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Collection Identifier (ISCI) is a variable-length identifier standardized by ISO 27730 <https://www.iso.org/standard/44293.html> for identifying collections held by libraries, archives, museums, and other memory institutions. It consists of two parts: the identifier for the assigning organization (an ISIL) enclosed in square brackets, followed by a local collection identifier string (e.g., [FR-751041001]Casadesus1).

isil
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Identifier for Libraries and Related Organizations (ISIL) <https://slks.dk/english/work-areas/libraries-and-literature/library-standards/isil/> is a unique alphanumeric code for identifying libraries, archives, museums, and related organizations standardized by ISO 15511 <https://www.iso.org/standard/77849.html>. It consists of a prefix—which may be an ISO 3166-1 alpha-2 country code or a non-country code assigned by the ISIL Registration Authority—followed by a unit identifier, totaling up to 16 characters (e.g., FI-Sipoo-Sö or ZDB-1-SBD). Valid symbols include any alphanumeric character, solidus (/), hyphen-minus (-), or colon.

ismn
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Music Number (ISMN) <https://ismn-international.org/ismn/the-ismn/> is a unique numeric identifier for printed music (notated music) standardized by ISO 10957 <https://www.iso.org/standard/83122.html>. It consists of either 10 characters (starting with the letter "M" for assignments prior to January 1, 2008) or 13 digits. A 13-digit ISMN is composed of four parts: the GS1 prefix 979-0, a registrant element, an item element, and a check digit. While elements may be divided by spaces or hyphens for human readability, these separators shall be omitted when the identifier is stored electronically (e.g., 9790006538424).

isni
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Name Identifier (ISNI) <https://isni.org/page/what-is-isni/> is a unique identifier used to distinguish the public identities of parties involved in the creation, production, and distribution of media content. Standardized by ISO 27729 <https://www.iso.org/standard/87177.html>, it consists of 16 characters—15 digits plus a final check character—and is often represented as a URI, such as https://isni.org/isni/000000012146438X.

isrc
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Recording Code (ISRC) <https://isrc.ifpi.org/isrc-standard> is a unique 12-character alphanumeric identifier for sound recordings and music video recordings standardized by ISO 3901 <https://www.iso.org/standard/64817.html>. While the "ISRC" label and grouping hyphens used for human readability, they shall be omitted when the identifier is stored electronically (e.g., USCA28900153).

issn
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Serial Number (ISSN) <https://www.issn.org/understanding-the-issn/what-is-an-issn/> is an eight-digit identifier for serial publications and other continuing resources standardized by ISO 3297 <https://www.iso.org/standard/84536.html>. It consists of two groups of four digits separated by a hyphen, where the final character is a check digit that may be an "X". The hyphen is retained when the identifier is stored electronically to maintain the standard 9-character string format (e.g., 1464-3693). The ISSN is media-specific; the same journal title may be assigned different identifiers for its physical and digital versions.

iswc
type: NamedIndividual
type: ExternalIdentifierType
comment: International Standard Musical Work Code (ISWC) <https://www.iswc.org/iswc> is an 11-character unique identifier standardized by ISO 15707 <https://www.iso.org/standard/83125.html> for musical works (compositions) as distinct from specific recordings. While the "ISWC" label and grouping separators (dots and hyphens) are used for human readability, they shall be omitted when the identifier is stored electronically (e.g., T0017812031).

lei
type: NamedIndividual
type: ExternalIdentifierType
comment: The Legal Entity Identifier (LEI) <https://www.gleif.org/en/organizational-identity/introducing-the-legal-entity-identifier-lei> is a 20-character, alphanumeric code based on the ISO 17442 <https://www.iso.org/standard/78829.html> standard developed by the International Organization for Standardization.

lexid
type: NamedIndividual
type: ExternalIdentifierType
comment: LEX Identifier is a Uniform Resource Name (URN) for sources of law within the LEX namespace <https://www.iana.org/assignments/urn-formal/lex>, as defined in RFC 9676 <https://datatracker.ietf.org/doc/rfc9676/> (e.g., urn:lex:it:stato:decreto.legislativo:2018-08-10;101).

nli
type: NamedIndividual
type: ExternalIdentifierType
comment: Natural Location Identifier (NLI) <https://eccma.org/enli-eccma-natural-location-identifier/> is a 14- or 15-character alphanumeric string standardized by ISO 8000-118 <https://www.iso.org/standard/85428.html> that uniquely identifies a three-dimensional geographic point location. The identifier is generated from geodetic coordinates and elevation data. For electronic storage, the ISO.NLI: prefix shall be retained (e.g., ISO.NLI:41TS8M-A8ELTQ-H2).

orcidid
type: NamedIndividual
type: ExternalIdentifierType
comment: Open Researcher and Contributor ID (ORCID) iD <https://info.orcid.org/what-is-orcid/> is a unique identifier for authors and contributors in scholarly communication; as a subset of the International Standard Name Identifier (ISNI), it typically appears as a URI such as https://orcid.org/0000-0002-1825-0097.

other
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when the type does not match any of the other options.

packageUrl
type: NamedIndividual
type: ExternalIdentifierType
comment: Package-URL (PURL), as defined in ECMA-427 <https://ecma-international.org/publications-and-standards/standards/ecma-427/>.

phoneNumber
type: NamedIndividual
type: ExternalIdentifierType
comment: Phone number; A string of decimal digits that uniquely indicates the network termination point defined in RFC 3966 <https://datatracker.ietf.org/doc/rfc3966/> Section 5.

requirementUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The unique identifier used by a requirements management or any other lifecycle management tool to uniquely identify a requirement item.

rorid
type: NamedIndividual
type: ExternalIdentifierType
comment: Research Organization Registry (ROR) identifier <https://ror.org/about/> is a unique identifier for research and funding organization, typically expressed in its preferred URI form such as https://ror.org/02mhbdp94.

securityOther
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when there is a security related identifier of unspecified type.

swhid
type: NamedIndividual
type: ExternalIdentifierType
comment: SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the SWHID specification <https://www.swhid.org/swhid-specification/v1.2/> (ISO/IEC 18670 <https://www.iso.org/standard/89985.html>). They typically look like swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2.

swid
type: NamedIndividual
type: ExternalIdentifierType
comment: Concise Software Identification (CoSWID) tag, as defined in RFC 9393 <https://datatracker.ietf.org/doc/rfc9393/> Section 2.3.

urlScheme
type: NamedIndividual
type: ExternalIdentifierType
comment: Uniform Resource Identifier (URI) Schemes <https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml>. The scheme used in order to locate a resource.

vatNumber
type: NamedIndividual
type: ExternalIdentifierType
comment: Value Added Tax (VAT) number, or Goods and Services Tax (GST) number, is an identifier assigned by tax authorities that uniquely identifies a business within a specific national border or tax jurisdiction for the collection and tracking of VAT/GST.

verificationUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The unique identifier used by a verification management system or any other lifecycle management tool to uniquely identify a verification item.

webpage
type: NamedIndividual
type: ExternalIdentifierType
comment: A Uniform Resource Locator (URL) that can be used to locate a resource, as defined in RFC 9110 <https://datatracker.ietf.org/doc/rfc9110/> Section 4.2.1 or Section 4.2.2. It may include an optional fragment identifier as specified in RFC 3986 <https://datatracker.ietf.org/doc/rfc3986> Section 3.5.

altDownloadLocation
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative download location.

altWebPage
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative web page.

binaryArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to binary artifacts related to a package.

bom
type: NamedIndividual
type: ExternalRefType
comment: A reference to a bill of materials related to a package.

bower
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Bower package. The package locator format, looks like package#version, is defined in the "install" section of Bower API documentation <https://bower.io/docs/api/#install>.

buildMeta
type: NamedIndividual
type: ExternalRefType
comment: A reference to the build metadata related to a published package.

buildSystem
type: NamedIndividual
type: ExternalRefType
comment: A reference to the build system used to create or publish the package.

certificationReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a certification report for a package from an accredited/independent body.

chat
type: NamedIndividual
type: ExternalRefType
comment: A reference to the instant messaging system used by the maintainer for a package.

componentAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Software Composition Analysis (SCA) report.

cwe
type: NamedIndividual
type: ExternalRefType
comment: Common Weakness Enumeration <https://csrc.nist.gov/glossary/term/common_weakness_enumeration>. A reference to a source of software flaws defined within the official CWE List <https://cwe.mitre.org/data/> that conforms to the CWE specification <https://cwe.mitre.org/>.

documentation
type: NamedIndividual
type: ExternalRefType
comment: A reference to the documentation for a package.

dynamicAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a dynamic analysis report for a package.

eolNotice
type: NamedIndividual
type: ExternalRefType
comment: A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.

exportControlAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to an export control assessment for a package.

funding
type: NamedIndividual
type: ExternalRefType
comment: A reference to funding information related to a package.

issueTracker
type: NamedIndividual
type: ExternalRefType
comment: A reference to the issue tracker for a package.

license
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional license information related to an artifact.

mailingList
type: NamedIndividual
type: ExternalRefType
comment: A reference to the mailing list used by the maintainer for a package.

mavenCentral
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Maven repository artifact. The artifact locator format is defined in the Maven documentation <https://maven.apache.org/guides/mini/guide-naming-conventions.html> and looks like groupId:artifactId[:version].

metrics
type: NamedIndividual
type: ExternalRefType
comment: A reference to metrics related to a package such as OpenSSF scorecards.

npm
type: NamedIndividual
type: ExternalRefType
comment: A reference to an npm package. The package locator format is defined in the npm documentation <https://docs.npmjs.com/cli/v10/configuring-npm/package-json> and looks like package@version.

nuget
type: NamedIndividual
type: ExternalRefType
comment: A reference to a NuGet package. The package locator format is defined in the NuGet documentation <https://docs.nuget.org> and looks like package/version.

other
type: NamedIndividual
type: ExternalRefType
comment: Used when the type does not match any of the other options.

privacyAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a privacy assessment for a package.

productMetadata
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional product metadata such as a reference within an organization's product catalog.

purchaseOrder
type: NamedIndividual
type: ExternalRefType
comment: A reference to a purchase order for a package.

qualityAssessmentReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a quality assessment for a package.

releaseHistory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published list of releases for a package.

releaseNotes
type: NamedIndividual
type: ExternalRefType
comment: A reference to the release notes for a package.

riskAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a risk assessment for a package.

runtimeAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a runtime analysis report for a package.

secureSoftwareAttestation
type: NamedIndividual
type: ExternalRefType
comment: A reference to information assuring that the software is developed using security practices as defined by NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1 <https://csrc.nist.gov/pubs/sp/800/218/final> or CISA Secure Software Development Attestation Form <https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form>.

securityAdversaryModel
type: NamedIndividual
type: ExternalRefType
comment: A reference to the security adversary model for a package.

securityAdvisory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published security advisory (where advisory is defined per ISO 29147:2018 <https://www.iso.org/standard/72311.html>) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.

securityFix
type: NamedIndividual
type: ExternalRefType
comment: A reference to the patch or source code that fixes a vulnerability.

securityOther
type: NamedIndividual
type: ExternalRefType
comment: A reference to related security information of unspecified type.

securityPenTestReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a penetration test <https://en.wikipedia.org/wiki/Penetration_test> report for a package.

securityPolicy
type: NamedIndividual
type: ExternalRefType
comment: A reference to instructions for reporting newly discovered security vulnerabilities for a package.

securityThreatModel
type: NamedIndividual
type: ExternalRefType
comment: A reference to the security threat model <https://en.wikipedia.org/wiki/Threat_model> for the package.

socialMedia
type: NamedIndividual
type: ExternalRefType
comment: A reference to a social media channel for a package.

sourceArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to an artifact containing the sources for a package.

staticAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a static analysis report for a package.

support
type: NamedIndividual
type: ExternalRefType
comment: A reference to the software support channel or other support information for a package.

vcs
type: NamedIndividual
type: ExternalRefType
comment: A reference to a version control system related to a software artifact.

vulnerabilityDisclosureReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations <https://csrc.nist.gov/pubs/sp/800/161/r1/final>.

vulnerabilityExploitabilityAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also NTIA VEX one-page summary <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.

x509Cert
type: NamedIndividual
type: ExternalRefType
comment: A reference to an X.509 certificate as defined in RFC 5280 <https://datatracker.ietf.org/doc/rfc5280/>. The primary media type shall be application/pkix-cert. The legacy media types application/x-x509-ca-cert and application/x-x509-user-cert may be used for backward compatibility, but shall not be used in new implementations. NOTE — RFC 5280 supersedes earlier X.509 profiles, including RFC 1422. Existing references based on RFC 1422 remain valid.

assistiveAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 1 - Assistive automation. The system assists an operator.

autonomous
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 6 - Autonomous. The system is capable of modifying its intended domain of use or its goals without external intervention, control or oversight.

conditionalAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 3 - Conditional automation. The system can propose strategies and then automatically execute the approved plan, with an external agent being ready to take over when necessary.

fullAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 5 - Full automation. The system is capable of performing its entire mission without external intervention.

highAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 4 - High automation. The system performs parts of its mission without external intervention.

notAutomated
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 0 - Not automated. No automation. The operator fully controls the system.

partialAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 2 - Partial automation or task automation. Some sub-functions of the system are fully automated while the system remain under control of an external agent. The system can perform actions for an approved task without requiring the agent's continuous direct control.

Person
type: Class
type: NodeShape
comment: An individual human being.
subclass of: Agent
note: A Person is an individual human being.
node kind: IRI

active
type: NamedIndividual
type: ProcessReadinessType
comment: In use.

draft
type: NamedIndividual
type: ProcessReadinessType
comment: Not yet finalized; under development or review.

obsoleted
type: NamedIndividual
type: ProcessReadinessType
comment: Superseded or not valid at present.

other
type: NamedIndividual
type: ProcessReadinessType
comment: Other.

ai
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the AI profile specification.

build
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Build profile specification.

core
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Core profile specification.

dataset
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Dataset profile specification.

expandedLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the ExpandedLicensing profile specification.

extension
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Extension profile specification.

functionalSafety
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the FunctionalSafety profile specification.

hardware
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Hardware profile specification.

lite
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Lite profile specification.

operations
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Operations profile specification.

security
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Security profile specification.

service
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Service profile specification.

simpleLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the SimpleLicensing profile specification.

software
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Software profile specification.

supplyChain
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the SupplyChain profile specification.

Regulation
type: Class
type: NodeShape
comment: Regulation represents a rule or directive maintained by an authority.
subclass of: Specification
note: The Regulation class represents any rules or directives enforced by an official authority. Regulations within this class can be either mandatory or voluntary. Examples of these regulations include the EU Radio Equipment Directive, EU Cyber Resilience Act, the Japan Cyber STAR, or the U.S. Cyber Trust Mark.
node kind: IRI

complete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known to be exhaustive.

incomplete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known not to be exhaustive.

noAssertion
type: NamedIndividual
type: RelationshipCompleteness
comment: No assertion can be made about the completeness of the relationship.

amendedBy
type: NamedIndividual
type: RelationshipType
comment: The from Element is amended by each to Element.

ancestorOf
type: NamedIndividual
type: RelationshipType
comment: The from Element is an ancestor of each to Element.

availableFrom
type: NamedIndividual
type: RelationshipType
comment: The from Element is available from the additional supplier described by each to Element.

contains
type: NamedIndividual
type: RelationshipType
comment: The from Element contains each to Element.

copiedTo
type: NamedIndividual
type: RelationshipType
comment: The from Element has been copied to each to Element.

descendantOf
type: NamedIndividual
type: RelationshipType
comment: The from Element is a descendant of each to Element.

describes
type: NamedIndividual
type: RelationshipType
comment: The from Element describes each to Element. To denote the root(s) of a tree of elements in a collection, the rootElement property shall be used.

evaluatedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been evaluated on the to Element(s).

expandsTo
type: NamedIndividual
type: RelationshipType
comment: The from Element expands out as an artifact described by each to Element.

finetunedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been finetuned on the to Element(s).

follows
type: NamedIndividual
type: RelationshipType
comment: The to Element succeeds the from Element, establishing a unidirectional sequence. This succession is defined as chronological, procedural, or logical. It is used to represent either a temporal order (e.g., in a workflow) or a logical order for processing and traversal (e.g., in an ordered list).

generates
type: NamedIndividual
type: RelationshipType
comment: The from Element generates each to Element.

hasAddedFile
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a file added to the from Element (from hasAddedFile to).

hasDataFile
type: NamedIndividual
type: RelationshipType
comment: The from Element treats each to Element as a data file. A data file is an artifact that stores data required or optional for the from Element's functionality. A data file can be a database file, an index file, a log file, an AI model file, a calibration data file, a temporary file, a backup file, and more. For AI training dataset, test dataset, test artifact, configuration data, build input data, and build output data, please consider using the more specific relationship types: trainedOn, testedOn, hasTest, configures, hasInput, and hasOutput, respectively. This relationship does not imply dependency.

hasDeletedFile
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a file deleted from the from Element (from hasDeletedFile to).

hasDependencyManifest
type: NamedIndividual
type: RelationshipType
comment: The from Element has manifest files that contain dependency information in each to Element.

hasDistributionArtifact
type: NamedIndividual
type: RelationshipType
comment: The from Element is distributed as an artifact in each to Element (e.g. an RPM or archive file).

hasDocumentation
type: NamedIndividual
type: RelationshipType
comment: The from Element is documented by each to Element.

hasEvidence
type: NamedIndividual
type: RelationshipType
comment: Every to Element is considered as evidence for the from Element (from hasEvidence to).

hasExample
type: NamedIndividual
type: RelationshipType
comment: Every to Element is an example for the from Element (from hasExample to).

hasMetadata
type: NamedIndividual
type: RelationshipType
comment: Every to Element is metadata about the from Element (from hasMetadata to).

hasOptionalComponent
type: NamedIndividual
type: RelationshipType
comment: Every to Element is an optional component of the from Element (from hasOptionalComponent to).

hasTestCase
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a test case for the from Element (from hasTestCase to).

hasVariant
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a variant the from Element (from hasVariant to).

modifiedBy
type: NamedIndividual
type: RelationshipType
comment: The from Element is modified by each to Element.

other
type: NamedIndividual
type: RelationshipType
comment: Every to Element is related to the from Element where the relationship type is not described by any of the SPDX relationship types (this relationship is directionless).

packagedBy
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a packaged instance of the from Element (from packagedBy to).

patchedBy
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a patch for the from Element (from patchedBy to).

pretrainedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been pretrained on the to Element(s).

republishedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a from /Security/Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by each to Agent.

resolved
type: NamedIndividual
type: RelationshipType
comment: The to /SupplyChain/OutOfSpecAction is resolved in the from /SupplyChain/ResolutionAction.

testedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been tested on the to Element(s).

trainedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been trained on the to Element(s).

validatedOn
type: NamedIndividual
type: RelationshipType
comment: The from Element has been validated on the to Element(s).

active
type: NamedIndividual
type: RequirementStatusType
comment: A requirement has been approved by stakeholder, and can be include in traceability.

backlog
type: NamedIndividual
type: RequirementStatusType
comment: A requirement has been captured and logged, but not yet ready to become a formal requirement draft. A backlog requirement may still be incomplete or ambiguous.

draft
type: NamedIndividual
type: RequirementStatusType
comment: A requirement is considered a draft state and may be modified before being submitted for review.

retired
type: NamedIndividual
type: RequirementStatusType
comment: A requirement is no longer active for a specific use.

reviewable
type: NamedIndividual
type: RequirementStatusType
comment: A requirement is ready for formal review by stakeholders for a specific use.

SoftwareAgent
type: Class
type: NodeShape
comment: A software agent.
subclass of: Agent
note: A SoftwareAgent is a software program that is given the authority (similar to a user's authority) to act on a system.
node kind: IRI

formalStandard
type: NamedIndividual
type: SpecificationType
comment: A formal standard is a standard ratified by a recognized standards-development organization and published as a normative reference.

other
type: NamedIndividual
type: SpecificationType
comment: Any specification that does not fall under any of the other entries.

regulation
type: NamedIndividual
type: SpecificationType
comment: A mandatory legal specification issued by a governmental or regulatory authority. Compliance is enforceable by law.

specification
type: NamedIndividual
type: SpecificationType
comment: A specification is a detailed document (or set of documents) that describes the requirements, design, behavior, or other characteristics of a system, component, or process so that all stakeholders have a clear, unambiguous reference.

actionLocation
type: ObjectProperty
comment: Location of a specific action.
range: Location
note: The location of an action is defined by the actionLocation. Action locations help define and validate a specific action.

additionalInformation
type: ObjectProperty
comment: Additional relevance information.
range: DictionaryEntry
note: This element provides relevant information to the action.

annotationType
type: ObjectProperty
comment: Describes the type of annotation.
range: AnnotationType
note: An annotationType describes the type of an annotation.

assignedBy
type: ObjectProperty
comment: assignedBy identifies the agent that grants or assigns the role to the target element.
range: Agent
note: assignedBy is an property that specifies the agent responsible for assigning the givenRole to the target element. This property tracks who assigned the role, providing accountability and traceability for role assignments.

authorization
type: DatatypeProperty
comment: Authorization specifies the permissions, rights, privileges, or benefits granted to a Role, defining what the role is authorized to access, perform, or receive.
range: string
note: Authorization is a string property that captures the specific permissions, rights, privileges, or benefits that are associated with a Role. This property defines what the role is entitled to do or receive within a given context (e.g., build, system, distribution, supply chain, or lifecycle). For example, authorization might include access to certain resources, permissions to perform specific actions, or eligibility for particular benefits.

beginIntegerRange
type: DatatypeProperty
comment: Defines the beginning of a range.
range: positiveInteger
note: beginIntegerRange is a positive integer that defines the beginning of a range.

builtTime
type: DatatypeProperty
comment: Specifies the time an artifact was built.
range: dateTimeStamp
note: A builtTime specifies the time an artifact was built.

city
type: DatatypeProperty
comment: City is a specific name used to define a locality.
range: string
note: City is a specific name used to define a locality.

completeness
type: ObjectProperty
comment: Provides information about the completeness of relationships.
range: RelationshipCompleteness
note: Completeness gives information about whether the provided relationships are complete, known to be incomplete or if no assertion is made either way.

contactType
type: ObjectProperty
comment: Identifies the nature of the contactPointRelationship.
range: ContactPointRelationshipType
note: Identifies the role of the Artifact to the contact point.

context
type: DatatypeProperty
comment: Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
range: string
note: A context gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.

country
type: DatatypeProperty
comment: Specifies a country code of the location.
range: string
note: Specifies a country code of the location.

countyCode
type: DatatypeProperty
comment: A code that identifies a county.
range: string
note: A code that identifies a county. A county is a territorial division in some countries, often forming a primary unit of local administration. In the US, a county is a political and administrative division of a state.

created
type: DatatypeProperty
comment: Identifies when the Element was originally created.
range: dateTimeStamp
note: Created is a date that identifies when the Element was originally created. The time stamp can serve as an indication as to whether the analysis needs to be updated. This is often the date of last change (e.g., a git commit date), not the date when the SPDX data was created, as doing so supports reproducible builds.

createdBy
type: ObjectProperty
comment: Identifies who or what created the Element.
range: Agent
note: CreatedBy identifies who or what created the Element. The generation method will assist the recipient of the Element in assessing the general reliability/accuracy of the analysis information.

createdUsing
type: ObjectProperty
comment: Identifies the tooling that was used during the creation of the Element.
range: Tool
note: CreatedUsing identifies the tooling that was used during the creation of the Element. The generation method will assist the recipient of the Element in assessing the general reliability/accuracy of the analysis information.

creationInfo
type: ObjectProperty
comment: Provides information about the creation of the Element.
range: CreationInfo
note: CreationInfo provides information about the creation of the Element.

dataLicense
type: ObjectProperty
comment: Provides the license under which the SPDX documentation of the Element can be used.
range: AnyLicenseInfo
note: The data license provides the license under which the SPDX documentation of the Element can be used. This is to alleviate any concern that content (the data or database) in an SPDX file is subject to any form of intellectual property right that could restrict the re-use of the information or the creation of another SPDX file for the same project(s). This approach avoids intellectual property and related restrictions over the SPDX file, however individuals can still contract with each other to restrict release of specific collections of SPDX files (which map to software bill of materials) and the identification of the supplier of SPDX files. Compliance with this document includes populating the SPDX fields therein with data related to such fields ("SPDX-Metadata"). This document contains numerous fields where an SPDX file creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of "database rights" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you "as-is" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.

definingArtifact
type: ObjectProperty
comment: Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
range: Artifact
note: A definingArtifact property is used to link the Element identifier for an Element defined external to a given SpdxDocument to an Artifact Element representing the SPDX serialization instance which contains the definition for the Element.

definitionSource
type: ObjectProperty
comment: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization.
range: Specification
note: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization. These are adopted to create uniformity and facilitate interoperability within industries.

description
type: DatatypeProperty
comment: Provides a detailed description of the Element.
range: string
note: This field is a detailed description of the Element. It may also be extracted from the Element itself. The intent is to provide recipients of the SPDX file with a detailed technical explanation of the functionality, anticipated use, and anticipated implementation of the Element. This field may also include a description of improvements over prior versions of the Element.

devLifecycleStage
type: DatatypeProperty
comment: The product lifecycle phase, the requirement is applicable for.
range: LifecycleScopeType
note: The development lifecycle stage specifies the phase or phases of a product’s lifecycle to which a given requirement applies. These may include requirements that govern the design phase, guide development activities, define constraints for the build environment, provide instructions for the decommissioning phase, etc.

element
type: ObjectProperty
comment: Refers to one or more Elements that are part of an ElementCollection.
range: Element
note: This field refers to one or more Elements that are part of an ElementCollection.

elementValue
type: ObjectProperty
comment: A value used in a key-value pair with a generic key that refers to an Element
range: Element
note: A value used in a key-value pair with a generic key that refers to an Element. A key-value pair can be used to implement a dictionary which associates a key with an Element.

endIntegerRange
type: DatatypeProperty
comment: Defines the end of a range.
range: positiveInteger
note: endIntegerRange is a positive integer that defines the end of a range.

externalIdentifier
type: ObjectProperty
comment: Provides a reference to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.
range: ExternalIdentifier
note: ExternalIdentifier points to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.

externalIdentifierType
type: ObjectProperty
comment: Specifies the type of the external identifier.
range: ExternalIdentifierType
note: An externalIdentifierType specifies the type of the external identifier.

externalRef
type: ObjectProperty
comment: Points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.
range: ExternalRef
note: This field points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.

externalRefType
type: ObjectProperty
comment: Specifies the type of the external reference.
range: ExternalRefType
note: An externalRefType specifies the type of the external reference.

externalSpdxId
type: DatatypeProperty
comment: Identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.
range: anyURI
note: An externalSpdxId identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.

geographicPointLocation
type: DatatypeProperty
comment: A set of geographic point location coordinates.
range: string
note: Geographic point location coordinates expressed in the format defined by ISO 6709:2022.

givenRole
type: ObjectProperty
comment: givenRole is a property that specifies the role being assigned in a RoleRelationship. It links the relationship to an instance of the Role class, defining the function, responsibility, or position that the source element confers upon the target element.
range: Role
note: givenRole specific the role that is being assigned or defined by the relationship. This role represents the function, responsibility, or position that the source element (e.g., an organization, tool, or component) confers upon the target element (e.g., a person, team, or system).

headquartersLocation
type: ObjectProperty
comment: A location of the organization's headquarters.
range: Location
note: Headquarters denotes the location where most or all of the important functions of an organization are coordinated. In some jurisdictions, it represents the central entity of a corporation that assumes full responsibility for managing all business activities. Accurate identification of an organization's headquarters requires the provision of relevant address data, including mailing, street, and geographic point location.

identifier
type: DatatypeProperty
comment: Uniquely identifies an external element.
range: string
note: An identifier uniquely identifies an external element.

identifierLocator
type: DatatypeProperty
comment: Provides the location for more information regarding an external identifier.
range: anyURI
note: Identifiers are not always structured as URIs. An identifierLocator is a location hint (a URL) that provides contextual information relevant to the identifier.

import
type: ObjectProperty
comment: Provides an ExternalMap of Element identifiers.
range: ExternalMap
note: An import provides an ExternalMap of an Element identifier that is used within a document but defined external to that document.

inLanguage
type: DatatypeProperty
comment: Specifies a human language used within the content of an Element or a property.
range: string
note: Specifies a human language used within the content of an Element or a property. The property value shall be an IETF BCP 47 language tag <https://datatracker.ietf.org/doc/rfc5646/> used to indicating human languages, dialects, scripts, regions, and variants.

intendedUse
type: DatatypeProperty
comment: A statement of how, or for what purpose, an item or artifact is intended to be used.
range: string
note: A free-form textual description outlining the scope and boundaries of appropriate or intended applications for the item or artifact.

isoAutomationLevel
type: ObjectProperty
comment: ISO level of automation.
range: IsoAutomationLevel
note: The level of automation describes a spectrum of system capability, defining the degree of control and decision-making authority a system possesses relative to an external control. This classification helps to define the roles and responsibilities of both the human operator and the automated system. It is a critical component for risk assessment, regulatory compliance, and user interface design.

issuingAuthority
type: DatatypeProperty
comment: An entity that is authorized to issue identification credentials.
range: string
note: An issuingAuthority is an entity that is authorized to issue identification credentials. The entity may be a government, non-profit, educational institution, or commercial enterprise. The string provides a unique identifier for the issuing authority.

locationHint
type: DatatypeProperty
comment: Provides an indication of where to retrieve an external Element.
range: anyURI
note: A locationHint provides an indication of where to retrieve an external Element.

locationTime
type: DatatypeProperty
comment: A known location is specified at this time.
range: dateTimeStamp
note: The locationTime establishes the relationship between a specific time and location. For example, at 8:45 the company's headquarters is located at this location. An action occurred at this location at this specific time.

locator
type: DatatypeProperty
comment: Provides the location of an external reference.
range: string
note: A locator provides the location of an external reference.

name
type: DatatypeProperty
comment: Identifies the name of an Element as designated by the creator.
range: string
note: This field identifies the name of an Element as designated by the creator. The name of an Element is an important convention and easier to refer to than the URI.

namespace
type: DatatypeProperty
comment: Provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.
range: anyURI
note: A namespace provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.

namespaceMap
type: ObjectProperty
comment: Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
range: NamespaceMap
note: This field provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.

originatedBy
type: ObjectProperty
comment: Identifies from where or whom the Element originally came.
range: Agent
note: An originatedBy identifies from where or whom the Element originally came.

packageVerificationCodeExcludedFile
type: DatatypeProperty
comment: The relative file name of a file to be excluded from the PackageVerificationCode.
range: string
note: A relative filename with the root of the package archive or directory referencing a file to be excluded from the PackageVerificationCode. Every filename is preceded with a ./.

postOfficeBoxNumber
type: DatatypeProperty
comment: The number that identifies a PO box. A PO box is a box in a post office or other postal service location assigned to an organization where postal items may be kept.
range: string
note: A postal box (P.O. Box) is a secure, numbered mailbox located at a post office or mail facility, used to receive mail. It provides a fixed mailing address, independent of a physical home or business location.

postalCode
type: DatatypeProperty
comment: Text specifying the postal code for an address.
range: string
note: Text specifying the postal code for an address.

postalName
type: DatatypeProperty
comment: The name of the recipient expressed in text.
range: string
note: postalName is a property that specifies the name of the organization, entity, or addressee to which mail or deliveries should be directed.

prefix
type: DatatypeProperty
comment: A substitute for a URI.
range: string
note: A prefix is a substitute for a URI.

processReadiness
type: DatatypeProperty
comment: The readiness of a process.
range: ProcessReadinessType
note: The readiness of a process, expressed using the ProcessReadinessType enumeration.

profileConformance
type: ObjectProperty
comment: Describes one a profile which the creator of this ElementCollection intends to conform to.
range: ProfileIdentifierType
note: Describes a profile to which the creator of this ElementCollection intends to conform. The profileConformance will apply to all Elements contained within the collection as well as the collection itself. Conformance to a profile is defined by the additional restrictions documented in the profile specific documentation and schema files. Use of this property allows the creator of an ElementCollection to communicate to consumers their intent to adhere to the profile additional restrictions. The profileConformance has a default value of "core" if no other profileConformance is specified since all ElementCollections and Element shall adhere to the Core profile.

provinceStateCode
type: DatatypeProperty
comment: Text specifying a province or state.
range: string
note: Text specifying a province or state (e.g., Buenos Aires, California, Cebu).

quantity
type: DatatypeProperty
comment: Quantity is the amount in the selected QUDT unit.
range: string
note: Quantity is a property that defines the count, multitude or magnitude. Express it as an xsd:decimal whenever possible. If it is not an xsd:decimal, place the notation being used in the parent element's comment field.

referenceSpecification
type: ObjectProperty
comment: referenceSpecification provides a reference to a DefinedType that defines the specific meaning, structure, and semantics of a Role. It connects the role to its authoritative source definition, ensuring consistent interpretation across different contexts.
range: DefinedType
note: referenceSpecification is an object property that links a Role element to an instance of DefinedType. This property establishes the authoritative source and type specification that defines what the role represents, its boundaries, and its intended interpretation. It specifies the tasks, rights, and qualifications associated with the role.

releaseTime
type: DatatypeProperty
comment: Specifies the time an artifact was released.
range: dateTimeStamp
note: A releaseTime specifies the time an artifact was released.

requirementStatement
type: DatatypeProperty
comment: A textual expression describing the actual need defined by the requirement.
range: string
note: The text-based portion of a requirement. This statement typically adheres to established rules and best practices of requirements engineering, such as the Easy Approach to Requirements Syntax (EARS).

requirementStatus
type: DatatypeProperty
comment: The assessment of the state of a requirement.
range: RequirementStatusType
note: The status specifies the state of a requirement in its lifecycle.

requirementUID
type: DatatypeProperty
comment: A requirementUID is a unique identifier assigned to a Requirement.
range: ExternalIdentifier
note: A unique identifier, as used by requirements management or other lifecycle management tools, usually a string that follows a project specific naming convention.

responsibility
type: ObjectProperty
comment: Describes the specific responsibility of a Role.
range: Requirement
note: Describes the specific responsibility of a Role.

roleQualification
type: ObjectProperty
comment: roleQualification specifies the requirements, criteria, or conditions that must be met for an entity to be considered qualified to fulfill a particular role.
range: Requirement
note: roleQualification is an object property that links a Role to one or more Requirement elements. It defines the qualifications—educational, experiential, certification, or competency-based—that an entity must possess to be considered capable of performing the responsibilities associated with the role.

rootElement
type: ObjectProperty
comment: This property is used to denote the root Element(s) of a tree of elements contained in a BOM.
range: Element
note: This property is used to denote the root Element(s) of a tree of elements contained in a BOM. The tree consists of other elements directly and indirectly related through properties or Relationships from the root.

scope
type: ObjectProperty
comment: Capture the scope of information about a specific relationship between elements.
range: LifecycleScopeType
note: A scope is additional context about a relationship, that clarifies the relationship between elements.

specType
type: DatatypeProperty
comment: A specification type defines the nature of a specification.
range: SpecificationType
note: A specification type defines the nature of a specification.

specVersion
type: DatatypeProperty
comment: Provides a reference number that can be used to understand how to parse and interpret an Element.
range: string
note: The specVersion provides a reference number that can be used to understand how to parse and interpret an Element. It will enable both future changes to the specification and to support backward compatibility. The major version number shall be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor version number shall be incremented when backwards compatible changes are made. The optional patch version number shall be incremented when backward compatible bug fixes are made. If no patch version is present, the latest released patch version can be assumed. Here, parties exchanging information in accordance with the SPDX specification need to provide 100% transparency as to which SPDX specification version such information is conforming to.

standardName
type: DatatypeProperty
comment: The name of a relevant standard that may apply to an artifact.
range: string
note: Various standards may be relevant or useful to capture for specific artifacts. This does not imply that the artifact is compliant with the standard, but rather that the standard is used as a reference or guideline for the design, implementation, production, or evaluation of the artifact. For compliance with a standard, use the standardCompliance property instead.

statement
type: DatatypeProperty
comment: Commentary on an assertion that an annotator has made.
range: string
note: A statement is a commentary on an assertion that an annotator has made.

streetAddress
type: DatatypeProperty
comment: Street address includes a street number, name and unit ID to identify a specific street.
range: string
note: Street address includes a street number, name and unit ID to identify a specific street.

subject
type: ObjectProperty
comment: An Element an annotator has made an assertion about.
range: Element
note: A subject is an Element an annotator has made an assertion about.

summary
type: DatatypeProperty
comment: A short description of an Element.
range: string
note: A summary is a short description of an Element. Here, the intent is to allow the Element creator to provide concise information about the function or use of the Element.

typeFromSource
type: DatatypeProperty
comment: typeFromSource is a value used to define an item within the definitionSource.
range: string
note: A typeFromSource is a specific term or label assigned within a definitionSource to define or identify an item, concept, or category. It represents a unique or standardized value within the classification system that helps categorize and describe the item's place or characteristics within the overall definitionSource.

unitQUDT
type: DatatypeProperty
comment: A QUDT unit applied to measurement criteria based on product type, region, and use.
range: string
note: QUDT (Quantity, Unit, Dimension and Type) specifies a standardized framework for describing measurable quantities, units of measure, numerical values, and their underlying data structures and types. The QUDT ontology and specifications are available at https://www.qudt.org/.

validUntilTime
type: DatatypeProperty
comment: Specifies until when the artifact can be used before its usage needs to be reassessed.
range: dateTimeStamp
note: A validUntilTime specifies until when the artifact can be used before its usage needs to be reassessed.

value
type: DatatypeProperty
comment: A value used in a generic key-value pair.
range: string
note: A value used in a generic key-value pair. A key-value pair can be used to implement a dictionary which associates a key with a value.

amber
type: NamedIndividual
type: ConfidentialityLevelType
comment: Limited distribution - organization and clients. The dataset shall be shared only with specific organizations and their clients on a need-to-know basis.

amberStrict
type: NamedIndividual
type: ConfidentialityLevelType
comment: Limited distribution - organization only. The dataset shall be shared only with specific organizations on a need-to-know basis.

clear
type: NamedIndividual
type: ConfidentialityLevelType
comment: Unlimited. Subject to standard copyright rules, the dataset may be shared freely, without restriction.

green
type: NamedIndividual
type: ConfidentialityLevelType
comment: Community wide. The dataset shall be shared only within a community of peers and partners.

red
type: NamedIndividual
type: ConfidentialityLevelType
comment: For named recipients only. The dataset is highly confidential and shall be shared only with named recipients.

clickthrough
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.

directDownload
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is publicly available and can be downloaded directly.

query
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.

registration
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.

scrapingScript
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset provider is not making available the underlying data and the dataset shall be reassembled, typically using the provided script for scraping the data.

DatasetPackage
type: Class
type: NodeShape
comment: A Package that contains a dataset.
subclass of: Package
note: A Package that contains data used for the operation, training, testing, evaluation, or calibration of software, hardware, or systems, or for reporting, documentation, reference, and archival purposes.
node kind: IRI
property:
  in: yes
  in: no
  in: noAssertion
  max count: 1
  path: hasSensitivePersonalInformation
property:
  datatype: string
  path: inLanguage
  pattern: ^[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*$
property:
  in: red
  in: amberStrict
  in: amber
  in: green
  in: clear
  max count: 1
  path: confidentialityLevel
property:
  datatype: string
  path: anonymizationMethodUsed
property:
  datatype: string
  path: knownBias
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: sensor
property:
  datatype: string
  max count: 1
  path: dataCollectionProcess
property:
  datatype: string
  max count: 1
  path: intendedUse
property:
  datatype: string
  max count: 1
  path: datasetNoise
property:
  in: audio
  in: categorical
  in: graph
  in: image
  in: noAssertion
  in: numeric
  in: other
  in: sensor
  in: structured
  in: syntactic
  in: text
  in: timeseries
  in: timestamp
  in: video
  min count: 1
  path: datasetType
property:
  datatype: string
  max count: 1
  path: datasetUpdateMechanism
property:
  datatype: string
  path: dataPreprocessing
property:
  datatype: nonNegativeInteger
  max count: 1
  path: datasetSize
property:
  in: clickthrough
  in: directDownload
  in: query
  in: registration
  in: scrapingScript
  max count: 1
  path: datasetAvailability

audio
type: NamedIndividual
type: DatasetType
comment: Data is audio based, such as a collection of music from the 80s.

categorical
type: NamedIndividual
type: DatasetType
comment: Data that is classified into a discrete number of categories, such as the eye color of a population of people.

graph
type: NamedIndividual
type: DatasetType
comment: Data is in the form of a graph where entries are somehow related to each other through edges, such as a social network of friends.

image
type: NamedIndividual
type: DatasetType
comment: Data is a collection of images such as pictures of animals.

noAssertion
type: NamedIndividual
type: DatasetType
comment: Data type is not known.

numeric
type: NamedIndividual
type: DatasetType
comment: Data consists only of numeric entries.

other
type: NamedIndividual
type: DatasetType
comment: Data is of a type not included in this list.

sensor
type: NamedIndividual
type: DatasetType
comment: Data is recorded from a physical sensor, such as a thermometer reading or biometric device.

structured
type: NamedIndividual
type: DatasetType
comment: Data is stored in tabular format or retrieved from a relational database.

syntactic
type: NamedIndividual
type: DatasetType
comment: Data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.

text
type: NamedIndividual
type: DatasetType
comment: Data consists of unstructured text, such as a book, a Wikipedia article (without images), or a transcript.

timeseries
type: NamedIndividual
type: DatasetType
comment: Data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.

timestamp
type: NamedIndividual
type: DatasetType
comment: Data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.

video
type: NamedIndividual
type: DatasetType
comment: Data is video based, such as a collection of movie clips.

anonymizationMethodUsed
type: DatatypeProperty
comment: Anonymization methods used.
range: string
note: A free-form text that describes the methods used to anonymize the dataset or fields in the dataset.

confidentialityLevel
type: ObjectProperty
comment: Confidentiality level of the data points contained in the dataset.
range: ConfidentialityLevelType
note: Describes the levels of confidentiality of the data points contained in the dataset.

dataCollectionProcess
type: DatatypeProperty
comment: How the dataset was collected.
range: string
note: A free-form text that describes how a dataset was collected. Examples include the sources from which a dataset was scraped and the interview protocol that was used for data collection.

dataPreprocessing
type: DatatypeProperty
comment: Preprocessing steps that were applied to the raw data to create the given dataset.
range: string
note: A free-form text that describes the various preprocessing steps that were applied to the raw data to create the dataset. Examples include standardization, normalization, deduplication, tokenization, and removal of tokens.

datasetAvailability
type: ObjectProperty
comment: Availability of a dataset.
range: DatasetAvailabilityType
note: Some datasets are publicly available and can be downloaded directly. Others are only accessible behind a clickthrough, or after filling a registration form. This field will describe the dataset availability from that perspective.

datasetNoise
type: DatatypeProperty
comment: Potentially noisy elements of the dataset.
range: string
note: Describes what kinds of noises a dataset can encompass. The free-form text specifies fields or samples that can be noisy. Alternatively, it can also be used to describe various noises that can impact the whole dataset.

datasetSize
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Software/artifactSize instead. Size of the dataset.
range: nonNegativeInteger
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Software/artifactSize instead. How large a dataset is. The size is to be measured in bytes.

datasetType
type: ObjectProperty
comment: Type of data in a dataset.
range: DatasetType
note: Describes the datatype contained in the dataset. For example, a dataset can be an image dataset for computer vision applications, a text dataset such as the contents of a book or Wikipedia article, or sometimes a multimodal dataset that contains multiple types of data.

datasetUpdateMechanism
type: DatatypeProperty
comment: Mechanism to update the dataset.
range: string
note: A free-form text that describes a mechanism to update the dataset.

hasSensitivePersonalInformation
type: ObjectProperty
comment: Describes if any sensitive personal information is present in the dataset.
range: PresenceType
note: Indicates the presence of sensitive personal data or information that allows drawing conclusions about a person's identity. Related: useSensitivePersonalInformation in /AI/AIPackage

intendedUse
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Core/intendedUse instead. The intended use of a given dataset.
range: string
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/intendedUse instead. A free-form text that describes what the given dataset should be used for. Some datasets are collected to be used only for particular purposes. For example, medical data collected from a specific demography should only be applicable for training machine learning models to make predictions for that demography. In such a case, the intendedUse field would capture this information. Similarly, if a dataset is collected for building a facial recognition model, the intendedUse field would specify that.

knownBias
type: DatatypeProperty
comment: Records the biases that the dataset is known to encompass.
range: string
note: A free-form text that describes the different biases that the dataset encompasses.

sensor
type: ObjectProperty
comment: Describes a sensor used for collecting the data.
range: DictionaryEntry
note: Describes a sensor that was used for collecting the data and its calibration value as a key-value pair.

additionText
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition.
range: string
note: An additionText contains the plain text of the LicenseAddition, without templating or other similar markup. Users of the additionText for a License can apply the SPDX License List Matching Guidelines when comparing it to another text for matching purposes.

isDeprecatedAdditionId
type: DatatypeProperty
comment: Specifies whether an additional text identifier has been marked as deprecated.
range: boolean
note: The isDeprecatedAdditionId property specifies whether an identifier for a LicenseAddition has been marked as deprecated. If the property is not defined, then it is presumed to be false (i.e., not deprecated). If the LicenseAddition is included on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, then the deprecatedVersion property indicates on which version release of the Exceptions List it was first marked as deprecated. "Deprecated" in this context refers to deprecating the use of the _identifier_, not the underlying license addition. In other words, even if a LicenseAddition's author or steward has stated that a particular LicenseAddition generally should not be used, that would _not_ mean that the LicenseAddition's identifier is "deprecated." Rather, a LicenseAddition operator is typically marked as "deprecated" when it is determined that use of another identifier is preferable.

isDeprecatedLicenseId
type: DatatypeProperty
comment: Specifies whether a license or additional text identifier has been marked as deprecated.
range: boolean
note: The isDeprecatedLicenseId property specifies whether an identifier for a License or LicenseAddition has been marked as deprecated. If the property is not defined, then it is presumed to be false (i.e., not deprecated). If the License or LicenseAddition is included on the SPDX License List <https://spdx.org/licenses/>, then the deprecatedVersion property indicates on which version release of the License List it was first marked as deprecated. "Deprecated" in this context refers to deprecating the use of the _identifier_, not the underlying license. In other words, even if a License's author or steward has stated that a particular License generally should not be used, that would _not_ mean that the License's identifier is "deprecated." Rather, a License or LicenseAddition operator is typically marked as "deprecated" when it is determined that use of another identifier is preferable.

isFsfLibre
type: DatatypeProperty
comment: Specifies whether the License is listed as free by the Free Software Foundation (FSF).
range: boolean
note: isFsfLibre specifies whether the Free Software Foundation (FSF) <https://fsf.org> has listed this License as "free" in their commentary on licenses, located at the time of this writing at Various Licenses and Comments about Them <https://www.gnu.org/licenses/license-list.en.html>. A value of "true" indicates that the license is in the list of licenses that FSF publishes as libre. A value of "false" indicates that the license is explicitly not in the corresponding list of FSF libre licenses (e.g., FSF has the license on a non-free list). If the isFsfLibre field is not specified, the SPDX data creator makes no assertions about whether the License is listed in the FSF's commentary.

isOsiApproved
type: DatatypeProperty
comment: Specifies whether the License is listed as approved by the Open Source Initiative (OSI).
range: boolean
note: isOsiApproved specifies whether the Open Source Initiative (OSI) <https://opensource.org> has listed this License as "approved" in their list of OSI Approved Licenses, located at the time of this writing at OSI Approved Licenses <https://opensource.org/licenses>. A value of "true" indicates that the license is in the list of licenses that OSI publishes as approved. A value of "false" indicates that the license is explicitly not in the corresponding list of OSI licenses (e.g., OSI has stated publicly that a license is not approved). If the isOsiApproved field is not specified, the SPDX data creator makes no assertions about whether the License is approved by the OSI.

standardAdditionTemplate
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition, in SPDX templating format.
range: string
note: A standardAdditionTemplate contains a license addition template which describes sections of the LicenseAddition text which can be varied. See the Legacy Text Template format section of the SPDX License List Matching Guidelines for format information. It is recommended to use licenseXml instead, as it can capture all the text and metadata associated with a license.

standardLicenseHeader
type: DatatypeProperty
comment: Provides a License author's preferred text to indicate that a file is covered by the License.
range: string
note: A standardLicenseHeader contains the plain text of the License author's preferred wording to be used, typically in a source code file's header comments or similar location, to indicate that the file is subject to the specified License.

standardLicenseTemplate
type: DatatypeProperty
comment: Identifies the full text of a License, in SPDX templating format.
range: string
note: A standardLicenseTemplate contains a license template which describes sections of the License text which can be varied. See the Legacy Text Template format section of the SPDX License List Matching Guidelines for format information. It is recommended to use licenseXml instead, as it can capture all the text and metadata associated with a license.

subjectAddition
type: ObjectProperty
comment: A LicenseAddition participating in a 'with addition' model.
range: LicenseAddition
note: A subjectAddition is a LicenseAddition which is subject to a 'with additional text' effect (WithAdditionOperator).

subjectExtendableLicense
type: ObjectProperty
comment: A License participating in a 'with addition' model.
range: ExtendableLicense
note: A subjectExtendableLicense is a License which is subject to a 'with additional text' effect (WithAdditionOperator).

subjectLicense
type: ObjectProperty
comment: A License participating in an 'or later' model.
range: License
note: A subjectLicense is a License which is subject an 'or later' effect (OrLaterOperator).

CdxPropertiesExtension
type: Class
type: NodeShape
comment: A type of extension consisting of a list of name value pairs.
subclass of: Extension
note: This extension provides a more structured extension using a name-value approach. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values. This is intended to be compatible with the CycloneDX property properties.
node kind: BlankNodeOrIRI
property:
  class: CdxPropertyEntry
  min count: 1
  node kind: BlankNodeOrIRI
  path: cdxProperty

cdxPropName
type: DatatypeProperty
comment: A name used in a CdxPropertyEntry name-value pair.
range: string
note: A cdxPropName is used in a CdxPropertyEntry name-value pair. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.

cdxPropValue
type: DatatypeProperty
comment: A value used in a CdxPropertyEntry name-value pair.
range: string
note: A cdxPropValue is used in a CdxPropertyEntry name-value pair. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.

cdxProperty
type: ObjectProperty
comment: Provides a map of a property name to a value.
range: CdxPropertyEntry
note: This field provides a mapping of a name to a value. This is intended to be compatible with the CycloneDX property properties. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.

fail
type: NamedIndividual
type: EvaluationResultType
comment: Indicates a failed evaluation where the requirement or condition is not met.

inconclusive
type: NamedIndividual
type: EvaluationResultType
comment: Inconclusive refers to a result or outcome from a verification, test, or analysis that cannot be clearly classified as either positive (successful, pass) or negative (failed, reject). An inconclusive result means there was not enough clear evidence, data, or signal to make a definitive determination, and further investigation or additional testing is necessary. An inconclusive result always shall need a comment on it.

pass
type: NamedIndividual
type: EvaluationResultType
comment: Indicates a successful evaluation where the requirement or condition is clearly met.

EvidenceRelationship
type: Class
type: NodeShape
comment: EvidenceRelationship defines the association between pieces of evidence and EvaluationResult.
subclass of: Relationship
note: EvidenceRelationship defines the association between pieces of evidence and EvaluationResult. This establishes traceability and contextual linkage between evidence items, supporting certification, verification, and audit activities.
node kind: IRI
property:
  in: report
  in: log
  in: recording
  in: observation
  in: other
  path: evidenceCategory
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: evidenceUID

log
type: NamedIndividual
type: EvidenceType
comment: Time-stamped records capturing system or operational data recorded as usually as a response to specific triggers in a specified environment.

observation
type: NamedIndividual
type: EvidenceType
comment: Documentation of direct monitoring or witnessing of the demonstration of processes, tests, or any kind of system responses during a specified timeframe under specified environmental conditions.

other
type: NamedIndividual
type: EvidenceType
comment: Any other relevant type of proof or documentation not covered above.

recording
type: NamedIndividual
type: EvidenceType
comment: Captured datastream like audio, video, or any other kind of continuous electronic capture of events, behavior or conditions.

report
type: NamedIndividual
type: EvidenceType
comment: Structured documentation of test results, inspections, or analyses.

analysis
type: NamedIndividual
type: VerificationType
comment: Analytical evaluating of data, designs, or processes methodically to verify correctness against standards or expectations. Typical analysis methods are FMEA, FTA, STPA, static analysis for MISRA compliance etc.

assessment
type: NamedIndividual
type: VerificationType
comment: A systematic examination of a system, process, or outcome to evaluate compliance of specific work products with a specific expectation with a specification, regulation or standard. Often involves judgement and a rationale of this judgement.

audit
type: NamedIndividual
type: VerificationType
comment: An examination typically focusing on compliance with policies, standards, or regulations. Usually this is done during an audit meeting, while the assessment also involves deep and detailed reviews of work products (e.g. requirements, verification specifications, reports etc.)

demonstration
type: NamedIndividual
type: VerificationType
comment: Demonstrating and monitoring or recording that the item under verification to confirm that a requirement is met by the item under verification.

inspection
type: NamedIndividual
type: VerificationType
comment: A thorough examination or checking of documentation, records, processes, or systems to confirm compliance or adherence. An inspection needs to have a defined set of acceptance criteria (e.g. a checklist), a documentation of roles involved in the inspection (e.g. to document the inspector's independence) and a clear documentation of when and how it was performed.

other
type: NamedIndividual
type: VerificationType
comment: Any other specialized or custom verification method that fits the context.

review
type: NamedIndividual
type: VerificationType
comment: A examination or checking of documentation, records, processes, or systems to confirm compliance or adherence with an upper level requirement. Typically done as peer review, offline review or review meeting.

test
type: NamedIndividual
type: VerificationType
comment: Conducting controlled tests, experiments or simulations to verify that specific requirements regarding performance, functionality, robustness, etc. are met.

assumptionStatement
type: DatatypeProperty
comment: A text describing the design constraint defined by the assumption.
range: string
note: The text describing a constraint is imposed by the intended design, the requirement context, or the operational context.

assumptionUID
type: ObjectProperty
comment: An assumptionUID is a unique identifier assigned to an Assumption item.
range: ExternalIdentifier
note: An assumptionUID is a unique identifier assigned to an item that represents a design constraint.

evaluation
type: DatatypeProperty
comment: Evaluation is an outcome considering results of a verification.
range: EvaluationResultType
note: Evaluation is the judgement, assessment or opinion regarding the compliance of a verification outcome with the expectations of this verification to meet the verification's acceptance criteria.

evaluationBasedOn
type: ObjectProperty
comment: Indicates the specific RequirementVerification instance on which the EvaluationResult is based.
range: RequirementVerification
note: The evaluationBasedOn property represents the linkage to the particular RequirementVerification that serves as the foundation for generating an EvaluationResult. It connects the evaluation outcome to the defined process or activity that verified the requirement, enabling traceability and verification of the evaluation’s basis. This linkage is critical in systems engineering to ensure that evaluation conclusions clearly reference the verified requirements and their verification methods, supporting auditability, compliance, and quality control.

evidenceCategory
type: ObjectProperty
comment: evidenceCategory refers to a category of documented or observable proof.
range: EvidenceType
note: evidenceCategory refers to a category of documented or observable proof used to verify compliance, qualification, or performance.

evidenceUID
type: ObjectProperty
comment: A evidenceUID is a unique identifier assigned to an entity, item, or requirement.
range: ExternalIdentifier
note: A evidenceUID is a unique identifier assigned to an entity, item, or any other kind of evaluated verification outcome.

verificationMethod
type: DatatypeProperty
comment: verificationMethod refers to the specific approach used for a checking an element's conformance with its requirements.
range: VerificationType
note: verificationMethod refers to the specific approach used to confirm that a (lower level) requirement or implemented system element complies with its higher level requirement.

verificationPostcondition
type: DatatypeProperty
comment: Verification postcondition that are true immediately after a verification method has been performed
range: string
note: Verification postcondition are explicit criteria, states, or conditions that are true immediately after a verification method (such as a test, inspection, or analysis) has been performed, confirming the successful execution and complete outcomes of the verification.

verificationPrecondition
type: DatatypeProperty
comment: Verification preconditions are initial criteria that are to be met prior to initiating the verification method.
range: string
note: Verification preconditions are specific conditions, requirements, or initial states that are to be satisfied before a verification will be executed.

verificationUID
type: ObjectProperty
comment: A verificationUID is a unique identifier assigned to a Verification item.
range: ExternalIdentifier
note: A verificationUID is a unique identifier assigned to an entity, item, or verification requirement.

ProductSpecification
type: Class
type: NodeShape
comment: A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product.
subclass of: Specification
note: A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product. It serves as a guide for engineers, designers, and manufacturers to ensure the final product meets expectations.
node kind: IRI
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: hazard
property:
  datatype: string
  min count: 1
  path: partNumber
property:
  datatype: string
  path: version

cycle
type: NamedIndividual
type: VirtualHardwareModelType
comment: Simulation architectures with precise cycle-level accuracy.

function
type: NamedIndividual
type: VirtualHardwareModelType
comment: Simulation the function of the hardware.

other
type: NamedIndividual
type: VirtualHardwareModelType
comment: All other simulation types.

additionalInformation
type: ObjectProperty
comment: Additional relevance information.
range: DictionaryEntry
note: This element provides relevant information about the product.

additionalInformationSpecification
type: ObjectProperty
comment: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization.
range: Specification
note: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization. These are adopted to create uniformity and facilitate interoperability within industries.

batchNumber
type: DatatypeProperty
comment: Identifier for product production batch.
range: string
note: A group of products produced in a common process is called a batch. Batches are identified by batch numbers.

bulkQuantity
type: ObjectProperty
comment: The amount or measure of a bulk product.
range: UnitOfMeasure
note: The amount or measure of a bulk product includes the quantity and unit of measure.

category
type: ObjectProperty
comment: The category describes the hardware item in a DefinedType.
range: DefinedType
note: The category describes the hardware item in a DefinedType.

centerOfMass
type: ObjectProperty
comment: A point representing the mean position of the matter in a body or system.
range: Dimensions
note: The mass-center is a fixed property for a given rigid body (e.g. with no slosh or articulation), whereas the center-of-gravity may, in addition, depend upon its orientation in a non-uniform gravitational field.

dimensions
type: ObjectProperty
comment: Information related to hardware dimension.
range: Dimensions
note: Product dimensions describe the physical characteristics of a specific product.

massOfHardware
type: DatatypeProperty
comment: Information related to massOfHardware physical hardware.
range: MeasureOfMass
note: Mass is defined as an intrinsic property of a body for describing a physical hardware component.

productAgent
type: ObjectProperty
comment: An Agent responsible for product identification, such as an original equipment manufacturer (OEM).
range: Agent
note: An Agent responsible for defining the partNumber, batchNumber or serialNumber of the unit of hardware.

releaseDate
type: ObjectProperty
comment: Date of product release.
range: dateTimeStamp
note: This is the first date associated to a specific product release.

serialNumber
type: DatatypeProperty
comment: Identifier for specific product is called a serial number.
range: string
note: This is a specific identifier assigned to a specific product.

virtualHardwareModel
type: DatatypeProperty
comment: Information related to virtual hardware simulation.
range: VirtualHardwareModelType
note: Information related to virtual hardware simulation modelling process.

xAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength
note: Information related to xAxis measurement of an object.

yAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength
note: Information related to yAxis measurement of an object.

zAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength
note: Information related to zAxis measurement of an object. Z axis is the height of the object.

assessedElement
type: DatatypeProperty
comment: Specifies an Element as subject of an assessment.
range: Element
note: Specifies an Element as subject of an assessment.

assessmentContext
type: DatatypeProperty
comment: Sets the context for an assessment by specifying the related project.
range: Project
note: Sets the context for an assessment by specifying the related project.

assessmentResult
type: DatatypeProperty
comment: Specifies an Element as subject of an assessment.
range: ExportControlClassification
note: Specifies an Element as subject of an assessment.

assessmentTime
type: DatatypeProperty
comment: Timestamp, when an assessment was conducted.
range: dateTimeStamp
note: Timestamp, when an assessment was conducted.

assessor
type: DatatypeProperty
comment: An entity providing an assessment.
range: Agent
note: An entity providing an assessment.

exportClassification
type: DatatypeProperty
comment: Expression for the export control classification.
range: string
note: Expression for the export control classification, e.g. "EAR99".

exportControlSpecification
type: DatatypeProperty
comment: Specification basis for the export control classification.
range: Specification
note: Specification basis for the export control classification.

exportingCountry
type: DatatypeProperty
comment: Country for which export controls must be taken into account.
range: string
note: Country for which export controls must be taken into account.

projectContract
type: DatatypeProperty
comment: Link to the project contract.
range: anyURI
note: Link to the project contract.

projectOwner
type: DatatypeProperty
comment: Owner or lead of the project.
range: Agent
note: Agent responsible for the project.

projectSponsor
type: DatatypeProperty
comment: Sponsor of the project.
range: Agent
note: Sponsor of the project.

projectTitle
type: DatatypeProperty
comment: Title of the project.
range: string
note: Title of the project.

weight
type: ObjectProperty
comment: Weight to express relevance in de minimis consideration.
range: positiveInteger
note: Weight to express relevance in de minimis consideration.

kev
type: NamedIndividual
type: ExploitCatalogType
comment: CISA's Known Exploited Vulnerability (KEV) catalog.

other
type: NamedIndividual
type: ExploitCatalogType
comment: Other exploit catalogs.

act
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.

attend
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.

track
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.

trackStar
type: NamedIndividual
type: SsvcDecisionType
comment: ("Track\*" in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track\* vulnerabilities within standard update timelines.

componentNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The software is not affected because the vulnerable component is not in the product.

inlineMitigationsAlreadyExist
type: NamedIndividual
type: VexJustificationType
comment: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.

vulnerableCodeCannotBeControlledByAdversary
type: NamedIndividual
type: VexJustificationType
comment: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.

vulnerableCodeNotInExecutePath
type: NamedIndividual
type: VexJustificationType
comment: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.

vulnerableCodeNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The product is not affected because the code underlying the vulnerability is not present in the product.

actionStatement
type: DatatypeProperty
comment: Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
range: string
note: When an element is referenced with a VexAffectedVulnAssessmentRelationship, the relationship shall include one actionStatement that should describe actions to remediate or mitigate the vulnerability.

actionStatementTime
type: DatatypeProperty
comment: Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
range: dateTimeStamp
note: When a VEX statement communicates an affected status, the author shall include an action statement with a recommended action to help mitigate the vulnerability's impact. The actionStatementTime property records the time when the action statement was first communicated.

assessedElement
type: ObjectProperty
comment: Specifies an Element where a vulnerability was found.
range: Artifact
note: Specifies components, subpackages, files or snippets referenced by a security assessment to specify the precise location where a vulnerability was found.

catalogType
type: ObjectProperty
comment: Specifies the exploit catalog type.
range: ExploitCatalogType
note: A catalogType is a mandatory value and shall select one of the existing entries in the ExploitCatalogType vocabulary.

decisionType
type: ObjectProperty
comment: Provide the enumeration of possible decisions in the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree <https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc>.
range: SsvcDecisionType
note: A decisionType is a mandatory value and shall select one of the four entries in the SsvcDecisionType vocabulary.

exploited
type: DatatypeProperty
comment: Denote whether a CVE is present in an exploit catalog.
range: boolean
note: This field is set to True when a CVE is present in an exploit catalog and False when the CVE is not present.

impactStatement
type: DatatypeProperty
comment: Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
range: string
note: When a VEX product element is related with a VexNotAffectedVulnAssessmentRelationship and a machine readable justification label is not provided, then an impactStatement that further explains how or why the product(s) are not affected by the vulnerability shall be provided.

impactStatementTime
type: DatatypeProperty
comment: Timestamp of impact statement.
range: dateTimeStamp
note: Specifies the time when the impact statement was recorded.

justificationType
type: ObjectProperty
comment: Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
range: VexJustificationType
note: When stating that an element is not affected by a vulnerability, the VexNotAffectedVulnAssessmentRelationship shall include a justification from the machine-readable labels catalog informing the reason the element is not impacted. impactStatement which is a string with English prose can be used instead or as complementary to the justification label, but one of both shall be defined.

locator
type: DatatypeProperty
comment: Provides the location of an exploit catalog.
range: anyURI
note: A locator provides the location of an exploit catalog.

percentile
type: DatatypeProperty
comment: The percentile of the current probability score.
range: decimal
note: The percentile between 0 and 1 (0 and 100%) of the current probability score, the proportion of all scored vulnerabilities with the same or a lower probability score. The definition follows "percentile" in EPSS Data <https://www.first.org/epss/data_stats>.

probability
type: DatatypeProperty
comment: A probability score between 0 and 1 of a vulnerability being exploited.
range: decimal
note: The probability score between 0 and 1 (0 and 100%) estimating the likelihood of exploitation in the wild in the next 30 days (following score publication). The definition follows "epss" in EPSS Data <https://www.first.org/epss/data_stats>.

statusNotes
type: DatatypeProperty
comment: Conveys information about how VEX status was determined.
range: string
note: A VEX statement may convey information about how status was determined and may reference other VEX information.

vexVersion
type: DatatypeProperty
comment: Specifies the version of a VEX statement.
range: string
note: The statement version default value is zero. When any VEX-related content changes, the version shall be incremented.

crl
type: NamedIndividual
type: AuthenticationProtocolType
comment: Certificate Revocation List, or CRL, is a list of revoked certificates that is downloaded from the Certificate Authority (CA).

ocsp
type: NamedIndividual
type: AuthenticationProtocolType
comment: Online Certificate Status Protocol, or OCSP, is a common scheme used to maintain the security of a server and other network resources.

other
type: NamedIndividual
type: AuthenticationProtocolType
comment: An authentication protocol not covered by one of the other AuthenticationProtocolTypes.

tls
type: NamedIndividual
type: AuthenticationProtocolType
comment: Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.

serverAuthenticationProtocol
type: ObjectProperty
comment: Authentication protocol used by a server.
range: AuthenticationProtocolType
note: Authentication protocols used by a server or a software service to authenticate the server to the consumer.

serviceHostingCountry
type: DatatypeProperty
comment: Specifies a country code where a software service is hosted.
range: string
note: Specifies a country or territory where a software service is located. This includes indirect locations (e.g., where the data may be hosted). The string shall be in the ISO 3166-1 alpha-3 <https://www.iso.org/obp/ui/#iso:std:iso:3166:-1> three-letter format. See the ISO 3166-1 alpha-3 Wikipedia page <https://en.wikipedia.org/wiki/ISO_3166-1_alpha-3> for more information.

customIdToLicense
type: ObjectProperty
comment: Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to a CustomLicense, a CustomLicenseAddition, or a SimpleLicensingText.
range: ElementMap
note: Within a license expression, references can be made to a custom license or a custom license addition. The License Expression syntax dictates any reference starting with a "LicenseRef-" or "AdditionRef-" refers to license or addition text not found in the official SPDX License List <https://spdx.org/licenses/>. The key for the ElementMap is the string used in the license expression and the elementValue is the target Element, which must be a CustomLicense, CustomLicenseAddition, or SimpleLicensingText. The key for the ElementMap shall be matched against the license expression in a case-insensitive manner. This is required because the entire license expression string is itself case-insensitive.

customIdToUri
type: ObjectProperty
comment: **DEPRECATED in SPDX 3.1.** Use customIdToLicense instead. Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to its URI identifier. **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use customIdToLicense instead.
range: DictionaryEntry
note: Within a License Expression, references can be made to a Custom License or a Custom License Addition. The License Expression syntax dictates any reference starting with a "LicenseRef-" or "AdditionRef-" refers to license or addition text not found in the official SPDX License List <https://spdx.org/licenses/>. These custom licenses shall be a CustomLicense, a CustomLicenseAddition, or a SimpleLicensingText which are identified with a unique URI identifier. The key for the DictionaryEntry is the string used in the license expression and the value is the URI for the corresponding CustomLicense, CustomLicenseAddition, or SimpleLicensingText.

licenseExpression
type: DatatypeProperty
comment: A string in the license expression format.
range: string
note: A licenseExpression enables the representation, in a single string, of a combination of one or more licenses, together with additions such as license exceptions. The syntax for a licenseExpression string is set forth in the corresponding Annex of this document ("SPDX license expressions"). A licenseExpression string is not valid if it does not conform to the grammar set forth in that Annex. The ExpandedLicensing profile can be used to represent the complete parsed license expression as a combination of license objects.

licenseListVersion
type: DatatypeProperty
comment: The version of the SPDX License List used in the license expression.
range: string
note: Recognizing that licenses are added to the SPDX License List <https://spdx.org/licenses/> with each subsequent version, the intent is to provide consumers with the version of the SPDX License List used. This anticipates that in the future, license expression can used a version of the SPDX License List that is older than the then current one. The specified version of the SPDX License List shall include all listed licenses and exceptions referenced in the expression.

gitoid
type: NamedIndividual
type: ContentIdentifierType
comment: Gitoid <https://www.iana.org/assignments/uri-schemes/prov/gitoid>, stands for Git Object ID <https://git-scm.com/book/en/v2/Git-Internals-Git-Objects>. A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an Artifact Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types> for the software artifact or an Input Manifest Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier> for the software artifact's associated Artifact Input Manifest <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest>; this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See OmniBOR Specification <https://github.com/omnibor/spec/>, a minimalistic specification for describing software Artifact Dependency Graphs <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg>.

swhid
type: NamedIndividual
type: ContentIdentifierType
comment: SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the SWHID specification <https://www.swhid.org/swhid-specification/v1.2/> (ISO/IEC 18670 <https://www.iso.org/standard/89985.html>). They typically look like swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2.

directory
type: NamedIndividual
type: FileKindType
comment: The file represents a directory and all content stored in that directory.

file
type: NamedIndividual
type: FileKindType
comment: The file represents a single file (default).

symlink
type: NamedIndividual
type: FileKindType
comment: This file represents a symbolic link (soft link).

Sbom
type: Class
type: NodeShape
comment: A collection of SPDX Elements describing a single package.
subclass of: Bom
note: A Software Bill of Materials (SBOM) is a collection of SPDX Elements describing a single package. This could include details of the content and composition of the product, provenance details of the product and/or its composition, licensing information, known quality or security issues, etc.
node kind: IRI
property:
  in: design
  in: source
  in: build
  in: deployed
  in: runtime
  in: analyzed
  path: sbomType

analyzed
type: NamedIndividual
type: SbomType
comment: SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a "3rd party" SBOM.

build
type: NamedIndividual
type: SbomType
comment: SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.

deployed
type: NamedIndividual
type: SbomType
comment: SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.

design
type: NamedIndividual
type: SbomType
comment: SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.

runtime
type: NamedIndividual
type: SbomType
comment: SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an "Instrumented" or "Dynamic" SBOM.

source
type: NamedIndividual
type: SbomType
comment: SBOM created directly from the development environment, source files, and included dependencies used to build a product artifact.

additionalPurpose
type: ObjectProperty
comment: Provides additional purpose information of the software artifact.
range: SoftwarePurpose
note: An additionalPurpose provides information about the additional purpose of the software artifact in addition to the primaryPurpose.

artifactSize
type: DatatypeProperty
comment: Identifies the size of a software Artifact, in bytes.
range: nonNegativeInteger
note: Identifies the size of a software Artifact, in bytes.

attributionText
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
range: string
note: An attributionText for a software Package, File or Snippet provides a consumer of SPDX data with acknowledgement content, to assist redistributors of the Package, File or Snippet with reproducing those acknowledgements. For example, this field may include a statement that is required by a particular license to be reproduced in end-user documentation, advertising materials, or another form. This field may describe where, or in which contexts, the acknowledgements need to be reproduced, but it is not required to do so. The SPDX data creator may also explain elsewhere (such as in a comment field) how they intend for data in this field to be used. An attributionText is not meant to include the software Package, File or Snippet's actual complete license text. Use hasConcludedLicense to identify the corresponding license.

byteRange
type: DatatypeProperty
comment: Defines the byte range in the original host file that the snippet information applies to.
range: PositiveIntegerRange
note: This field defines the byte range in the original host file that the snippet information applies to. A range of bytes is independent of various formatting concerns, and the most accurate way of referring to the differences. The choice was made to start the numbering of the byte range at 1 to be consistent with the W3C pointer method vocabulary.

contentIdentifier
type: DatatypeProperty
comment: A canonical, unique, immutable identifier of the artifact content, that may be used for verifying its identity and/or integrity.
range: ContentIdentifier
note: A contentIdentifier is a canonical, unique, immutable identifier of the content of a software artifact, such as a package, a file, or a snippet. It may be used for verifying its identity and/or integrity.

contentIdentifierType
type: ObjectProperty
comment: Specifies the type of the content identifier.
range: ContentIdentifierType
note: A contentIdentifierType specifies the type of the content identifier.

contentIdentifierValue
type: DatatypeProperty
comment: Specifies the value of the content identifier.
range: anyURI
note: A contentIdentifierValue specifies the value of a content identifier.

copyrightText
type: DatatypeProperty
comment: Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
range: string
note: A copyrightText consists of the text(s) of the copyright notice(s) found for a software Package, File or Snippet, if any. If a copyrightText contains text, then it may contain any text related to one or more copyright notices (even if not complete) for that software Package, File or Snippet. If a copyrightText has a "NONE" value, this indicates that the software Package, File or Snippet contains no copyright notice whatsoever. If a copyrightText has a "NOASSERTION" value, this indicates that one of the following applies: - the SPDX data creator has attempted to but cannot reach a reasonable objective determination; - the SPDX data creator has made no attempt to determine this field; or - the SPDX data creator has intentionally provided no information (no meaning shall be implied by doing so). If a copyrightText is present, but consists of solely an empty string or a string with no substantive content (e.g., a string that contains only whitespace), then this shall be interpreted as equivalent to a "NOASSERTION" value as described above.

downloadLocation
type: DatatypeProperty
comment: Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
range: anyURI
note: A downloadLocation identifies the download Uniform Resource Identifier for the package at the time that the document was created. Where and how to download the exact package being referenced is critical for verification and tracking data.

fileKind
type: ObjectProperty
comment: Describes if a given file is a directory or non-directory kind of file.
range: FileKindType
note: An SPDX file may represent a specific file or a directory of files. In the future, this may be extended to other kinds (e.g. network based files).

homePage
type: DatatypeProperty
comment: A place for the SPDX document creator to record a website that serves as the package's home page.
range: anyURI
note: A homePage is a place for the SPDX document creator to record a website that serves as the package's home page. This saves the recipient of the SPDX document who is looking for more info from having to search for and verify a match between the package and the associated project home page. This link can also be used to reference further information about the package referenced by the SPDX document creator.

lineRange
type: DatatypeProperty
comment: Defines the line range in the original host file that the snippet information applies to.
range: PositiveIntegerRange
note: This field defines the line range in the original host file that the snippet information applies to. If there is a disagreement between the byte range and line range, the byte range values will take precedence. A range of lines is a convenient reference for those files where there is a known line delimiter. The choice was made to start the numbering of the lines at 1 to be consistent with the W3C pointer method vocabulary.

packageUrl
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record the Package-URL for a software Package.
range: anyURI
note: A packageUrl property specifies a Package-URL (PURL). The PURL shall be a valid Uniform Resource Identifier (URI) and Uniform Resource Locator (URL) that identifies a software package independent of its ecosystem or distribution channel, in accordance with ECMA-427 <https://ecma-international.org/publications-and-standards/standards/ecma-427/>. The PURL contains a type component that defines the ecosystem-specific structure and semantics for the remaining PURL components. The registered PURL type definitions are maintained in the Package-URL type registry available at https://packageurl.org/docs/purl/purl-types.

packageVersion
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use /Core/version instead. Identify the version of a package.
range: string
note: **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/version instead. A packageVersion is useful for identification purposes and for indicating later changes of the package version.

primaryPurpose
type: ObjectProperty
comment: Provides information about the primary purpose of the software artifact.
range: SoftwarePurpose
note: primaryPurpose provides information about the primary purpose of the software artifact.

sbomType
type: ObjectProperty
comment: Provides information about the type of an SBOM.
range: SbomType
note: This field is a reasonable estimation of the type of SBOM created from a creator perspective. It is intended to be used to give guidance on the elements that may be contained within it. Aligning with the guidance produced in Types of Software Bill of Material (SBOM) Documents <https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf>.

snippetFromFile
type: ObjectProperty
comment: Defines the original host file that the snippet information applies to.
range: File
note: The field identifies the file which contains the snippet.

sourceInfo
type: DatatypeProperty
comment: Records any relevant background information or additional comments about the origin of the package.
range: string
note: A sourceInfo records any relevant background information or additional comments about the origin of the package. For example, this field can include comments indicating whether the package was pulled from a source code management system or has been repackaged. The creator can provide additional information to describe any anomalies or discoveries in the determination of the origin of the package.

boundaryParameter
type: ObjectProperty
comment: The boundary parameters define the area or region needed to describe a boundary.
range: DictionaryEntry
note: A boundary parameter refers to a limiting condition, constraint, or predefined value that determines area or region boundaries.

current
type: ObjectProperty
comment: This is the individual, business, or organization who currently manages goods, services, or assets.
range: Agent
note: This is the individual, business, or organization who currently manages goods, services, or assets.

currentState
type: ObjectProperty
comment: This is the state of an affected Element.
range: State
note: The state of an object refers to a string assigned to its attributes (or properties) at a given moment in time. The state describes the current condition or behavior of the object.

decisionProcess
type: ObjectProperty
comment: This is how the currentState of an affected Element is found.
range: DefinedStateProcess
note: This is how the currentState of an affected Element is found.

destructionPerformedBy
type: ObjectProperty
comment: This is the agent that performed the act of destroying the item.
range: Agent
note: This is the agent that performed the act of destroying the item.

dropoffLocation
type: ObjectProperty
comment: A location where a package or an item is being dropped off or delivered.
range: Location
note: A specific location where a package or an item was dropped off or delivered. For a location that is being designated for dropping off, see forDropoffLocation.

forDropoffLocation
type: ObjectProperty
comment: A location where a package or an item will be dropped off or delivered.
range: Location
note: A designated location for dropping off or delivering a package or an item. For a location where an item was dropped off, see dropoffLocation.

forPickupLocation
type: ObjectProperty
comment: A location where a package or an item will be picked up.
range: Location
note: A designated location for picking up a package or an item. For a location where an item was picked up, see pickupLocation.

pickupLocation
type: ObjectProperty
comment: A location where a package or an item is being picked up.
range: Location
note: A specific location where a package or an item was picked up. For a location that is being designated for picking up, see forPickupLocation.

plannedCurrent
type: ObjectProperty
comment: This is the planned individual, business, or organization who currently manages goods, services, or assets.
range: Agent
note: This is the planned individual, business, or organization who currently manages goods, services, or assets.

plannedInspectionLocation
type: ObjectProperty
comment: A planned location where a good, product, or material is inspected.
range: Location
note: A planned location related to the inspection of a good, product, or material.

plannedPrevious
type: ObjectProperty
comment: This is the planned individual, business, or organization who was previously managing goods, services, or assets.
range: Agent
note: This is the planned individual, business, or organization who was previously managing goods, services, or assets.

plannedProductOfResponsibilityChange
type: ObjectProperty
comment: This is the planned product associated with the change of responsibility.
range: Element
note: The planned product or service related to a responsibility change is identified in this field.

plannedStorageLocation
type: ObjectProperty
comment: A planned location where a good, product, or material is stored.
range: Location
note: A planned location related to the storage of a good, product, or material.

plannedTransportRoute
type: DatatypeProperty
comment: A planned path used to move people, goods, data, or resources from one location to another.
range: string
note: A planned path or network taken by people, products, goods, data, or resources. The route varies depending on product type, safety requirements, business constraints, or other factors.

previous
type: ObjectProperty
comment: This is the individual, business, or organization who was previously managing goods, services, or assets.
range: Agent
note: This is the individual, business, or organization who was previously managing goods, services, or assets.

responsibilityChangedOn
type: ObjectProperty
comment: The element that has its responsibility changed.
range: Element
note: The element that has its responsibility changed. For example, "This product is associated with the change of ownership."

transportRoute
type: DatatypeProperty
comment: A transport route refers to the specific path or network used to move people, goods, data, or resources from one location to another.
range: string
note: A transport route is the path taken by people, products, goods, data or resources. Transport routes vary by product type, safety requirements, business constraints or other factors.

validState
type: ObjectProperty
comment: The valid state for DefinedStateProcess.
range: State
note: The valid state for DefinedStateProcess.

creationInfo NoAssertionElement
type: CreationInfo
comment: This individual element was defined by the spec.
createdBy: SpdxOrganization

creationInfo NoAssertionLicense
type: CreationInfo
comment: This individual element was defined by the spec.
createdBy: SpdxOrganization

creationInfo NoneElement
type: CreationInfo
comment: This individual element was defined by the spec.
createdBy: SpdxOrganization

creationInfo NoneLicense
type: CreationInfo
comment: This individual element was defined by the spec.
createdBy: SpdxOrganization

creationInfo SpdxOrganization
type: CreationInfo
comment: This individual element was defined by the spec.
createdBy: SpdxOrganization

Annotation
type: Class
type: NodeShape
comment: An assertion made in relation to one or more elements.
subclass of: Element
note: An Annotation is an assertion made in relation to one or more elements. The contentType property describes the format of the statement property.
node kind: IRI
property:
  in: other
  in: review
  max count: 1
  min count: 1
  path: annotationType
property:
  datatype: string
  max count: 1
  path: statement
property:
  datatype: string
  max count: 1
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: subject

Bom
type: Class
type: NodeShape
comment: A container for a grouping of SPDX 3 content characterizing details (provenance, composition, licensing, etc.) about a product.
subclass of: Bundle
note: A Bill of Materials (BOM) is a container for a grouping of SPDX 3 content characterizing details about a product. This could include details of the content and composition of the product, provenance details of the product and/or its composition, licensing information, known quality or security issues, etc.
node kind: IRI

ContactPointRelationship
type: Class
type: NodeShape
comment: A contact point from an Artifact to an Agent.
subclass of: Relationship
note: Specifies a point of contact specific to an Artifact. For example, a software package may have a security contact point that researchers should use for reporting security vulnerabilities. This relationship is restricted to using the hasContactPoint relationship type.
node kind: IRI
property:
  in: compliance
  in: other
  in: securityVulnerability
  in: support
  max count: 1
  min count: 1
  path: contactType

adler32
type: NamedIndividual
type: HashAlgorithm
comment: Adler-32 checksum is part of the widely used zlib compression library as defined in RFC 1950 <https://datatracker.ietf.org/doc/rfc1950/> Section 2.3.

blake2b256
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 256, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.

blake2b384
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 384, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.

blake2b512
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 512, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.

blake3
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE3 <https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf>

crystalsDilithium
type: NamedIndividual
type: HashAlgorithm
comment: Dilithium <https://pq-crystals.org/dilithium/>

crystalsKyber
type: NamedIndividual
type: HashAlgorithm
comment: Kyber <https://pq-crystals.org/kyber/>

falcon
type: NamedIndividual
type: HashAlgorithm
comment: FALCON <https://falcon-sign.info/falcon.pdf>

md2
type: NamedIndividual
type: HashAlgorithm
comment: MD2 message-digest algorithm, as defined in RFC 1319 <https://datatracker.ietf.org/doc/rfc1319/>.

md4
type: NamedIndividual
type: HashAlgorithm
comment: MD4 message-digest algorithm, as defined in RFC 1186 <https://datatracker.ietf.org/doc/rfc1186/>.

md5
type: NamedIndividual
type: HashAlgorithm
comment: MD5 message-digest algorithm, as defined in RFC 1321 <https://datatracker.ietf.org/doc/rfc1321/>.

md6
type: NamedIndividual
type: HashAlgorithm
comment: MD6 hash function <https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf>

other
type: NamedIndividual
type: HashAlgorithm
comment: any hashing algorithm that does not exist in this list of entries

sha1
type: NamedIndividual
type: HashAlgorithm
comment: SHA-1, a secure hashing algorithm, as defined in RFC 3174 <https://datatracker.ietf.org/doc/rfc3174/>.

sha224
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 224, as defined in RFC 3874 <https://datatracker.ietf.org/doc/rfc3874/>.

sha256
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 256, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.

sha384
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 384, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.

sha3_224
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 224, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.

sha3_256
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 256, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.

sha3_384
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 384, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.

sha3_512
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 512, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.

sha512
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 512, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.

build
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's build phase, during development.

decommission
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications for a product's retirement and/or decommissioning.

design
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's design.

development
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during development phase of an element.

other
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.

runtime
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during the execution phase of an element.

test
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's testing phase, during development.

update
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications for a product update.

Organization
type: Class
type: NodeShape
comment: A group of people who work together in an organized way for a shared purpose.
subclass of: Agent
note: An Organization is a group of people who work together in an organized way for a shared purpose.
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: headquartersLocation

PackageVerificationCode
type: Class
type: NodeShape
comment: An SPDX version 2.X compatible verification method for software packages.
subclass of: IntegrityMethod
note: This verification method is provided for compatibility with SPDX 2.X. Use of this verification code method is discouraged except for scenarios where the contentIdentifier property on Artifact can not be used. This verification method provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX document itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX document. This identifier enables a recipient to determine if any file in the original package (that the analysis was done on) has been changed and permits inclusion of an SPDX document as part of a package. Algorithm: templist = "" for all files in the package { if file is a packageVerificationCodeExcludedFile skip it /* exclude SPDX analysis file */ else append "algorithm(file)/n" to templist } sort templist in ascending order by value /* remove separators from ordered sequence */ valueslist = remove "/n"s from templist if valueslist is empty hashValue = 0 else hashValue = algorithm(valueslist) where algorithm(string) applies a hash algorithm on a string and returns the result in lowercase hexadecimal digits. Required sort order: '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' (ASCII order)
node kind: BlankNodeOrIRI
property:
  datatype: string
  path: packageVerificationCodeExcludedFile
property:
  datatype: string
  max count: 1
  min count: 1
  path: hashValue
property:
  in: adler32
  in: blake2b256
  in: blake2b384
  in: blake2b512
  in: blake3
  in: crystalsDilithium
  in: crystalsKyber
  in: falcon
  in: md2
  in: md4
  in: md5
  in: md6
  in: other
  in: sha1
  in: sha224
  in: sha256
  in: sha384
  in: sha512
  in: sha3_224
  in: sha3_256
  in: sha3_384
  in: sha3_512
  max count: 1
  min count: 1
  path: algorithm

PhysicalLocation
type: Class
type: NodeShape
comment: A physical location is a tangible, geographically identifiable place where objects, people, or assets exist or operate.
subclass of: Location
note: A physical location is a tangible, geographically identifiable place where objects, people, or assets exist or operate.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: postalName
property:
  datatype: string
  path: geographicPointLocation
property:
  datatype: string
  max count: 1
  path: streetAddress
property:
  datatype: string
  max count: 1
  path: country
  pattern: ^[A-Z]{3}$
property:
  datatype: string
  max count: 1
  path: countyCode
property:
  datatype: string
  max count: 1
  path: postOfficeBoxNumber
property:
  datatype: string
  max count: 1
  path: postalCode
property:
  datatype: string
  max count: 1
  path: provinceStateCode
property:
  datatype: string
  max count: 1
  path: city

affects
type: NamedIndividual
type: RelationshipType
comment: The from /Security/Vulnerability, Action or DefinedProcess affects each to Element.

assumes
type: NamedIndividual
type: RelationshipType
comment: The from Element assumes each to /FunctionalSafety/Assumption.

configures
type: NamedIndividual
type: RelationshipType
comment: The from Element is a configuration applied to each to Element, during a LifecycleScopeType period.

conformsTo
type: NamedIndividual
type: RelationshipType
comment: The from Element conforms to each to /FunctionalSafety/Assumption or Specification.

coordinatedBy
type: NamedIndividual
type: RelationshipType
comment: The from /Security/Vulnerability is coordinatedBy the to Agent(s) (vendor, researcher, or consumer agent).

createdBy
type: NamedIndividual
type: RelationshipType
comment: The from Action or DefinedProcess is createdBy to Agent(s).

delegatedTo
type: NamedIndividual
type: RelationshipType
comment: The from Agent is delegating an action to the Agent of the to Relationship (which shall be of type invokedBy), during a LifecycleScopeType period (e.g. the to invokedBy Relationship is being done on behalf of from).

dependsOn
type: NamedIndividual
type: RelationshipType
comment: The from Element depends on each to Element, during a LifecycleScopeType period.

doesNotAffect
type: NamedIndividual
type: RelationshipType
comment: The from /Security/Vulnerability has no impact on each to Element. The use of the doesNotAffect is constrained to /Security/VexNotAffectedVulnAssessmentRelationship classed relationships.

exploitCreatedBy
type: NamedIndividual
type: RelationshipType
comment: The from /Security/Vulnerability has had an exploit created against it by each to Agent.

fixedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a from /Security/Vulnerability has been fixed by the to Agent(s).

fixedIn
type: NamedIndividual
type: RelationshipType
comment: A from /Security/Vulnerability has been fixed in each to Element. The use of the fixedIn type is constrained to /Security/VexFixedVulnAssessmentRelationship classed relationships.

foundBy
type: NamedIndividual
type: RelationshipType
comment: Designates a from /Security/Vulnerability was originally discovered by the to Agent(s).

hasAssessmentFor
type: NamedIndividual
type: RelationshipType
comment: Relates a from /Security/Vulnerability and each to Element with a security assessment. The use of the hasAssessmentFor type is constrained to /Security/VulnAssessmentRelationship classed relationships.

hasAssociatedVulnerability
type: NamedIndividual
type: RelationshipType
comment: Used to associate a from Artifact with each to /Security/Vulnerability.

hasConcludedLicense
type: NamedIndividual
type: RelationshipType
comment: The from Artifact is concluded by the SPDX data creator to be governed by each to /SimpleLicensing/AnyLicenseInfo. If the to of an Artifact's hasConcludedLicense is not the same as the to of its hasDeclaredLicense, a written explanation should be provided in the comment field of the hasConcludedLicense relationship.

hasContactPoint
type: NamedIndividual
type: RelationshipType
comment: The from Artifact has each to Agent as a contact point. The use of the hasContactPoint type is constrained to ContactPointRelationship classed relationships. The type of contact (i.e. security) may be specified using a ContactPointRelationship element.

hasDeclaredLicense
type: NamedIndividual
type: RelationshipType
comment: The from Artifact was discovered to actually contain each to /SimpleLicensing/AnyLicenseInfo (for example, as detected by automated tooling).

hasDynamicLink
type: NamedIndividual
type: RelationshipType
comment: The from Element dynamically links in each to Element, during a LifecycleScopeType period.

hasHost
type: NamedIndividual
type: RelationshipType
comment: The from /Build/Build was run on the to Element during a LifecycleScopeType period (e.g. the host that the build runs on).

hasInput
type: NamedIndividual
type: RelationshipType
comment: The from /Build/Build, DefinedProcess or Action element has each to Element as an input.

hasOptionalDependency
type: NamedIndividual
type: RelationshipType
comment: The from Element optionally depends on each to Element, during a LifecycleScopeType period.

hasOutput
type: NamedIndividual
type: RelationshipType
comment: The from /Build/Build, DefinedProcess or Action element generates each to Element as an output.

hasPrerequisite
type: NamedIndividual
type: RelationshipType
comment: The from Element has a prerequisite on each to Element, during a LifecycleScopeType period.

hasProvidedDependency
type: NamedIndividual
type: RelationshipType
comment: The from Element has a dependency on each to Element, dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period.

hasRequirement
type: NamedIndividual
type: RelationshipType
comment: The from Element has a requirement on each to Element, during a LifecycleScopeType period.

hasResolution
type: NamedIndividual
type: RelationshipType
comment: The from /SupplyChain/ResolutionAction points to the to /SupplyChain/OutOfSpecAction that is addressed.

hasRoleIn
type: NamedIndividual
type: RelationshipType
comment: The from Element has a role in the to Element. The use of the hasRoleIn is constrained to RoleRelationship classed relationships.

hasSpecification
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a specification for the from Element (from hasSpecification to), during a LifecycleScopeType period.

hasStaticLink
type: NamedIndividual
type: RelationshipType
comment: The from Element statically links in each to Element, during a LifecycleScopeType period.

hasTest
type: NamedIndividual
type: RelationshipType
comment: Every to Element is a test artifact for the from Element (from hasTest to), during a LifecycleScopeType period.

implementedBy
type: NamedIndividual
type: RelationshipType
comment: The from Requirement is implemented in the to Element(s).

invokedBy
type: NamedIndividual
type: RelationshipType
comment: The from Element was invoked by the to Agent, during a LifecycleScopeType period (for example, a /Build/Build element that describes a build step).

locatedAt
type: NamedIndividual
type: RelationshipType
comment: from Element located at a specific to Location. A time period is optional.

performedBy
type: NamedIndividual
type: RelationshipType
comment: Every from Action is performedBy to Agent.

providesSupportFor
type: NamedIndividual
type: RelationshipType
comment: The from Agent provides support for each to Artifact. The use of the providesSupportFor type is constrained to SupportRelationship classed relationships.

publishedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a from /Security/Vulnerability was made available for public use or reference by each to Agent.

reportedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a from /Security/Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each to Agent.

runsOn
type: NamedIndividual
type: RelationshipType
comment: The from Element (the instructions) runs on each to /Hardware/Hardware (processing element), during a LifecycleScopeType period.

serializedInArtifact
type: NamedIndividual
type: RelationshipType
comment: The from SpdxDocument can be found in a serialized form in each to Artifact.

tracedToDetail
type: NamedIndividual
type: RelationshipType
comment: The from Requirement is refined and further elaborated by each to Requirement, which contains more detailed implementation information.

underInvestigationFor
type: NamedIndividual
type: RelationshipType
comment: The from /Security/Vulnerability impact is being investigated for each to Element. The use of the underInvestigationFor type is constrained to /Security/VexUnderInvestigationVulnAssessmentRelationship classed relationships.

usesTool
type: NamedIndividual
type: RelationshipType
comment: The from Element uses each to Element as a tool, during a LifecycleScopeType period.

verifiedBy
type: NamedIndividual
type: RelationshipType
comment: The from Requirement that has verification (test, review, analysis etc.) details defined in the to /FunctionalSafety/RequirementVerification.

RoleRelationship
type: Class
type: NodeShape
comment: RoleRelationship represents a relationship between an entity holding a role and the scope or context in which that role applies. The givenRole property specifies the role assigned.
subclass of: Relationship
note: RoleRelationship is a concrete subclass of Relationship that captures the connection between an entities (such as a person, organization, tool, or component) and the specific position, function, or responsibility it fulfills. This relationship type is used when documenting roles that are not implicitly defined by the SPDX document structure, allowing explicit modeling of organizational responsibilities, tooling involvement, or component functions across systems or contexts. RoleRelationship inherits the from and to properties from Relationship, where: - relationshipType = hasRoleIn. - from: The element to which the role is assigned (the role recipient). - to: The context, system, element or domain within which the role exists.
node kind: IRI
property:
  class: Role
  min count: 1
  node kind: IRI
  path: givenRole
property:
  class: Agent
  node kind: IRI
  path: assignedBy

SupportRelationship
type: Class
type: NodeShape
comment: Describes how an Agent provides support for an Artifact.
subclass of: Relationship
note: Specifies how an Agent supports a given Artifact. The relationship type shall be providesSupportFor. The from of the relationship is the Agent providing support, and the to are the Artifact for which support is being provided. startTime and endTime are mandatory when using this class.
node kind: IRI
property:
  in: development
  in: support
  in: deployed
  in: limitedSupport
  in: endOfSupport
  in: noSupport
  in: noAssertion
  max count: 1
  min count: 1
  path: supportLevel

deployed
type: NamedIndividual
type: SupportType
comment: In addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.

development
type: NamedIndividual
type: SupportType
comment: The artifact is in active development and is not considered ready for formal support from the supplier.

endOfSupport
type: NamedIndividual
type: SupportType
comment: There is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.

limitedSupport
type: NamedIndividual
type: SupportType
comment: The artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

noAssertion
type: NamedIndividual
type: SupportType
comment: No assertion about the type of support is made. This is considered the default if no other support type is used.

noSupport
type: NamedIndividual
type: SupportType
comment: There is no support for the artifact from the supplier, consumer assumes any support obligations.

support
type: NamedIndividual
type: SupportType
comment: The artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

algorithm
type: ObjectProperty
comment: Specifies the algorithm used for calculating the hash value.
range: HashAlgorithm
note: An algorithm specifies the algorithm that was used for calculating the hash value.

extension
type: ObjectProperty
comment: Specifies an Extension characterization of some aspect of an Element.
range: Extension
note: extension specifies an Extension-based characterization of a particular aspect of an Element.

hashValue
type: DatatypeProperty
comment: The result of applying a hash algorithm to an Element.
range: string
note: A hashValue is the result of applying a hash algorithm to an Element.

key
type: DatatypeProperty
comment: A key used in a generic key-value pair.
range: string
note: A key used in generic a key-value pair. A key-value pair can be used to implement a dictionary which associates a key with a value.

suppliedBy
type: ObjectProperty
comment: Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
range: Agent
note: Identify the actual distribution source for the artifact (e.g., snippet, file, package, vulnerability) or VulnAssessmentRelationship being referenced. This may or may not be different from the originating distribution source for the artifact (e.g., snippet, file, package, vulnerability) or VulnAssessmentRelationship.

supportLevel
type: ObjectProperty
comment: Specifies the level of support associated with an artifact.
range: SupportType
note: supportLevel provides an indication of what support expectations that the supplier of an artifact is providing to the user.

verifiedUsing
type: ObjectProperty
comment: Provides an IntegrityMethod with which the integrity of an Element can be asserted.
range: IntegrityMethod
note: A verifiedUsing provides an IntegrityMethod with which the integrity of an Element can be asserted. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.

ConjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
subclass of: AnyLicenseInfo
note: A ConjunctiveLicenseSet indicates that _each_ of its subsidiary AnyLicenseInfos apply. In other words, a ConjunctiveLicenseSet of two or more licenses represents a licensing situation where _all_ of the specified licenses are to be complied with. It is represented in the SPDX License Expression Syntax by the AND operator. It is syntactically correct to specify a ConjunctiveLicenseSet where the subsidiary AnyLicenseInfos may be "incompatible" according to a particular interpretation of the corresponding Licenses. The SPDX License Expression Syntax does not take into account interpretation of license texts, which is left to the consumer of SPDX data to determine for themselves.
node kind: IRI
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: IRI
  path: member

CustomLicense
type: Class
type: NodeShape
comment: A license that is not listed on the SPDX License List.
subclass of: License
note: A CustomLicense represents a License that is not listed on the SPDX License List <https://spdx.org/licenses>, and is therefore defined by an SPDX data creator.
node kind: IRI

CustomLicenseAddition
type: Class
type: NodeShape
comment: A license addition that is not listed on the SPDX Exceptions List.
subclass of: LicenseAddition
note: A CustomLicenseAddition represents an addition to a License that is not listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, and is therefore defined by an SPDX data creator. It is intended to represent additional language which is meant to be added to a License, but which is not itself a standalone License.
node kind: IRI

DisjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
subclass of: AnyLicenseInfo
note: A DisjunctiveLicenseSet indicates that _only one_ of its subsidiary AnyLicenseInfos is required to apply. In other words, a DisjunctiveLicenseSet of two or more licenses represents a licensing situation where _only one_ of the specified licenses are to be complied with. A consumer of SPDX data would typically understand this to permit the recipient of the licensed content to choose which of the corresponding license they would prefer to use. It is represented in the SPDX License Expression Syntax by the OR operator.
node kind: IRI
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: IRI
  path: member

ListedLicense
type: Class
type: NodeShape
comment: A license that is listed on the SPDX License List.
subclass of: License
note: A ListedLicense represents a License that is listed on the SPDX License List <https://spdx.org/licenses>.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: deprecatedVersion
property:
  datatype: string
  max count: 1
  path: listVersionAdded

ListedLicenseException
type: Class
type: NodeShape
comment: A license exception that is listed on the SPDX Exceptions list.
subclass of: LicenseAddition
note: A ListedLicenseException represents an exception to a License (in other words, an exception to a license condition or an additional permission beyond those granted in a License) which is listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: listVersionAdded
property:
  datatype: string
  max count: 1
  path: deprecatedVersion

OrLaterOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
subclass of: ExtendableLicense
note: An OrLaterOperator indicates that this portion of the AnyLicenseInfo represents either (1) the specified version of the corresponding License, or (2) any later version of that License. It is represented in the SPDX License Expression Syntax by the + operator. It is context-dependent, and unspecified by SPDX, as to what constitutes a "later version" of any particular License. Some Licenses may not be versioned, or may not have clearly-defined ordering for versions. The consumer of SPDX data will need to determine for themselves what meaning to attribute to a "later version" operator for a particular License.
node kind: IRI
property:
  class: License
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectLicense

WithAdditionOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
subclass of: AnyLicenseInfo
note: A WithAdditionOperator indicates that the designated License is subject to the designated LicenseAddition, which can be a license exception on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html> (ListedLicenseException) or may be other additional text (CustomLicenseAddition). It is represented in the SPDX License Expression Syntax by the WITH operator.
node kind: IRI
property:
  class: LicenseAddition
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectAddition
property:
  class: ExtendableLicense
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectExtendableLicense

deprecatedVersion
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this license or exception identifier was deprecated.
range: string
note: A deprecatedVersion, for a ListedLicense on the SPDX License List <https://spdx.org/licenses/> or a ListedLicenseException on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, specifies which version release of the License List was the first one in which it was marked as deprecated.

licenseXml
type: DatatypeProperty
comment: Identifies all the text and metadata associated with a license in the license XML format.
range: string
note: The license XML format is defined and used by the SPDX legal team. The formal schema definition is available at SPDX License List XML Schema <https://github.com/spdx/license-list-XML/blob/v3.25.0/schema/ListedLicense.xsd>. For a text description of the XML fields, see XML template fields <https://github.com/spdx/license-list-XML/blob/v3.25.0/DOCS/xml-fields.md>.

listVersionAdded
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
range: string
note: A listVersionAdded for a ListedLicense or ListedLicenseException on the SPDX License List <https://spdx.org/licenses/> specifies which version release of the License List was the first one in which it was included.

member
type: ObjectProperty
comment: A license expression participating in a license set.
range: AnyLicenseInfo
note: A member is a license expression participating in a conjunctive (of type ConjunctiveLicenseSet) or a disjunctive (of type DisjunctiveLicenseSet) license set.

obsoletedBy
type: DatatypeProperty
comment: Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
range: string
note: An obsoletedBy value for a deprecated License or LicenseAddition specifies the licenseId of the replacement License or LicenseAddition that is preferred to be used in its place. It shall use the same format as specified for a licenseId. The License's or LicenseAddition's comment value may include more information about the reason why the licenseId specified in the obsoletedBy value is preferred.

seeAlso
type: DatatypeProperty
comment: Contains a URL where the License or LicenseAddition can be found in use.
range: anyURI
note: A seeAlso defines a cross-reference with a URL where the License or LicenseAddition can be found in use by one or a few projects. If applicable, it should include a URL where the license text is posted by the license steward, particularly if the license steward has made available a "canonical" primary URL for the license text. If the license is OSI approved, a seeAlso should be included with the URL for the license's listing on the OSI website. The seeAlso URL may refer to a previously-available URL for the License or LicenseAddition which is no longer active. Where applicable, the seeAlso URL should include the license text in its native language. seeAlso URLs to English or other translations may be included where multiple, equivalent official translations exist.

EvaluationResult
type: Class
type: NodeShape
comment: EvaluationResult is the result of an evaluation.
subclass of: Element
note: EvaluationResult represents the documented outcome of assessing a work product, like a requirement, system, component, or process against specified criteria. It records whether the evaluated subject has met, failed, or yielded an inconclusive result based on the applied EvaluationResultType. The EvaluationResult captures the rationale behind the conclusion, providing necessary context and justification while referencing the specific RequirementVerification upon which the evaluation was based. This structure ensures clear traceability and supports compliance with standards for rigorous verification and validation processes. An EvaluationResult with an evaluation value of "inconclusive" should have a value in its comment property. A rationale is a detailed explanation or reasoning that supports the EvaluationResult. It provides the underlying justification for why an evaluation was deemed to have passed, failed, or been inconclusive. This clarifies the decision-making process, citing evidence, criteria, analysis methods, and any considerations of uncertainties or risks.
node kind: IRI
property:
  class: RequirementVerification
  max count: 1
  min count: 1
  node kind: IRI
  path: evaluationBasedOn
property:
  in: pass
  in: fail
  in: inconclusive
  max count: 1
  min count: 1
  path: evaluation
property:
  datatype: string
  max count: 1
  min count: 1
  path: rationale

BulkHardware
type: Class
type: NodeShape
comment: Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk.
subclass of: Hardware
note: Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk based on a batch or bulk ID number associated with the bulk unit. Bulk units defined in the QUDT Units standards.
node kind: IRI
property:
  class: UnitOfMeasure
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: bulkQuantity

PhysicalHardware
type: Class
type: NodeShape
comment: Class that describes a physical instance of Hardware.
subclass of: Hardware
note: A PhysicalHardware artifact describes a distinct physical unit.
node kind: IRI
property:
  class: Dimensions
  max count: 1
  node kind: BlankNodeOrIRI
  path: dimensions
property:
  class: Dimensions
  max count: 1
  node kind: BlankNodeOrIRI
  path: centerOfMass
property:
  class: MeasureOfMass
  max count: 1
  node kind: BlankNodeOrIRI
  path: massOfHardware

VirtualHardware
type: Class
type: NodeShape
comment: Class that describes an instance of VirtualHardware.
subclass of: Hardware
note: A VirtualHardware is a distinct article related to simulation or emulation hardware. This is used to assist in recording "Digital Twinning". An FPGA simulation of hardware is a VirtualHardware. Virtual hardware requires instantiation involving specific hardware and software.
node kind: IRI
property:
  in: function
  in: cycle
  in: other
  max count: 1
  path: virtualHardwareModel

hazard
type: ObjectProperty
comment: Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware.
range: DefinedType
note: Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware. For example, a lithium battery is a hazardous hardware item.

partNumber
type: DatatypeProperty
comment: Product Part Number as defined by OEM.
range: string
note: Product Part Number as defined by manufacturer. Can be used for an SKU.

ExportControlClassificationAssessment
type: Class
type: NodeShape
comment: Assessment of an Element for export control classification.
subclass of: Artifact
note: Assessment of an Element for export control classification according to the classification schema of one or multiple countries.
node kind: IRI
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: assessedElement
property:
  class: ExportControlClassification
  min count: 1
  node kind: BlankNodeOrIRI
  path: assessmentResult
property:
  datatype: dateTimeStamp
  max count: 1
  path: assessmentTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Project
  max count: 1
  node kind: IRI
  path: assessmentContext
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: assessor

critical
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 9.0 - 10.0.

high
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 7.0 - 8.9.

low
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 0.1 - 3.9.

medium
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 4.0 - 6.9.

none
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is 0.0.

CvssV2VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 2.0 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
note: A CvssV2VulnAssessmentRelationship relationship describes the determined score and vector of a vulnerability as defined in A Complete Guide to the Common Vulnerability Scoring System Version 2.0 <https://www.first.org/cvss/v2/guide>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV2VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv2-cve-2020-28498", "relationshipType": "hasAssessmentFor", "security_score": "4.3", "security_vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" }, { "type": "ExternalRef", "externalRefType": "securityFix", "locator": "https://github.com/indutny/elliptic/commit/441b742" } ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-05-06T10:06:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv2-cve-2020-28498", "to": ["urn:spdx.dev:agent-snyk"], "startTime": "2021-03-08T16:06:50Z" }
node kind: IRI
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: score
property:
  datatype: string
  max count: 1
  min count: 1
  path: vectorString

CvssV3VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 3 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
note: A CvssV3VulnAssessmentRelationship relationship describes the determined score, severity, and vector of a vulnerability as defined in Common Vulnerability Scoring System v3.0: Specification Document <https://www.first.org/cvss/v3.0/specification-document> or Common Vulnerability Scoring System v3.1: Specification Document <https://www.first.org/cvss/v3.1/specification-document>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV3VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv3-cve-2020-28498", "relationshipType": "hasAssessmentFor", "security_score": "6.8", "security_severity": "medium", "security_vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" }, { "type": "ExternalRef", "externalRefType": "securityFix", "locator": "https://github.com/indutny/elliptic/commit/441b742" } ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-05-06T10:06:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv3-cve-2020-28498", "to": ["urn:spdx.dev:agent-snyk"], "startTime": "2021-03-08T16:06:50Z" }
node kind: IRI
property:
  in: critical
  in: high
  in: medium
  in: low
  in: none
  max count: 1
  min count: 1
  path: severity
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: score
property:
  datatype: string
  max count: 1
  min count: 1
  path: vectorString

CvssV4VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 4 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
note: A CvssV4VulnAssessmentRelationship relationship describes the determined score, severity, and vector of a vulnerability as defined in Common Vulnerability Scoring System version 4.0: Specification Document <https://www.first.org/cvss/v4.0/specification-document>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV4VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv4-cve-2021-44228", "relationshipType": "hasAssessmentFor", "security_severity": "critical", "security_score": "10.0", "security_vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N", "from": "urn:spdx.dev:vuln-cve-2021-44228", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:apache-log4j-2.14.1", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": "https://www.first.org/cvss/v4.0/examples#Apache-log4j-Vulnerability-CVE-2021-44228" }, ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-10-05T23:09:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv4-cve-2021-44228", "to": ["urn:spdx.dev:agent-apache.org"], "startTime": "2021-12-11T18:39:00Z" }
node kind: IRI
property:
  in: critical
  in: high
  in: medium
  in: low
  in: none
  max count: 1
  min count: 1
  path: severity
property:
  datatype: string
  max count: 1
  min count: 1
  path: vectorString
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: score

EpssVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an EPSS assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
note: An EpssVulnAssessmentRelationship relationship describes the likelihood or probability that a vulnerability will be exploited in the wild, and the percentile ranking of probability relative to all other vulnerabilities' EPSS scores, using the Exploit Prediction Scoring System (EPSS) as defined at The EPSS Model <https://www.first.org/epss/model>. *Constraints* - The relationship type shall be set to hasAssessmentFor. - The probability shall be between 0 and 1. - The percentile shall be between 0 and 1. *Example* { "type": "security_EpssVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:epss-CVE-2020-28498", "relationshipType": "hasAssessmentFor", "security_probability": "0.00105", "security_percentile": "0.42356", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2023-10-05T00:00:30Z" }
node kind: IRI
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: percentile
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: probability

ExploitCatalogVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an exploit assessment of a vulnerability.
subclass of: VulnAssessmentRelationship
note: An ExploitCatalogVulnAssessmentRelationship describes if a vulnerability is listed in any exploit catalog such as the CISA Known Exploited Vulnerabilities (KEV) Catalog <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_ExploitCatalogVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:exploit-catalog-1", "relationshipType": "hasAssessmentFor", "security_catalogType": "kev", "locator": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "security_exploited": "true", "from": "urn:spdx.dev:vuln-cve-2023-2136", "to": ["urn:product-google-chrome-112.0.5615.136"], "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: locator
property:
  in: kev
  in: other
  max count: 1
  min count: 1
  path: catalogType
property:
  datatype: boolean
  max count: 1
  min count: 1
  path: exploited

SsvcVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an SSVC assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
note: An SsvcVulnAssessmentRelationship describes the decision made using the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree as defined by CISA Stakeholder-Specific Vulnerability Categorization Guide <https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc>. It is intended to communicate the results of using the CISA SSVC Calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_SsvcVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:ssvc-1", "relationshipType": "hasAssessmentFor", "security_decisionType": "act", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI
property:
  in: act
  in: attend
  in: track
  in: trackStar
  max count: 1
  min count: 1
  path: decisionType

VexAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
note: VexAffectedVulnAssessmentRelationship connects a vulnerability and a number of elements. The relationship marks these elements as products affected by the vulnerability. This relationship corresponds to the VEX affected status. *Constraints* When linking elements using a VexAffectedVulnAssessmentRelationship, the following requirements shall be observed: - Elements linked with a VulnVexAffectedAssessmentRelationship are constrained to the affects relationship type. *Example* { "type": "security_VexAffectedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-affected-1", "relationshipType": "affects", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "security_actionStatement": "Upgrade to version 1.4 of ACME application.", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  path: actionStatementTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: string
  max count: 1
  min count: 1
  path: actionStatement

modifiedTime
type: DatatypeProperty
comment: Specifies a time when a vulnerability assessment was modified
range: dateTimeStamp
note: Specifies a time when a vulnerability assessment was last modified.

publishedTime
type: DatatypeProperty
comment: Specifies the time when a vulnerability was published.
range: dateTimeStamp
note: Specifies the time when a vulnerability was first published.

severity
type: ObjectProperty
comment: Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
range: CvssSeverityType
note: The severity field provides a human readable string of the resulting numerical CVSS score.

withdrawnTime
type: DatatypeProperty
comment: Specified the time and date when a vulnerability was withdrawn.
range: dateTimeStamp
note: Specified the time and date when a vulnerability was withdrawn.

SoftwareService
type: Class
type: NodeShape
comment: Software provided as a service over a network.
subclass of: Artifact
note: SoftwareService represents a service based on software components offered for access online over a network. The primary provider of the SoftwareService is the /Core/suppliedBy. Any additional providers can use a relationship of relationship type availableFrom.
node kind: IRI
property:
  in: tls
  in: ocsp
  in: crl
  in: other
  path: serverAuthenticationProtocol
property:
  datatype: string
  path: serviceHostingCountry
  pattern: ^[A-Z]{3}$

LicenseExpression
type: Class
type: NodeShape
comment: An SPDX Element containing an SPDX license expression string.
subclass of: AnyLicenseInfo
note: A LicenseExpression enables the representation, in a single string, of a combination of one or more licenses, together with additions such as license exceptions. The syntax for a licenseExpression string is set forth in the corresponding Annex of this document ("SPDX license expressions"). A licenseExpression string is not valid if it does not conform to the grammar set forth in that Annex. The ExpandedLicensing profile can be used to represent the complete parsed license expression as a combination of license objects. customIdToUri is deprecated. Migrate to customIdToLicense. customIdToUri will be removed in a future release.
node kind: IRI
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: customIdToUri
property:
  class: ElementMap
  node kind: BlankNodeOrIRI
  path: customIdToLicense
property:
  datatype: string
  max count: 1
  path: licenseListVersion
  pattern: ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))?$
property:
  datatype: string
  max count: 1
  min count: 1
  path: licenseExpression

SimpleLicensingText
type: Class
type: NodeShape
comment: A license or a license addition that is not listed on the SPDX License List.
subclass of: Element
note: A SimpleLicensingText represents a license or a license addition that is not listed on the SPDX License List <https://spdx.org/licenses>, and is therefore defined by an SPDX data creator.
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: licenseText

licenseText
type: DatatypeProperty
comment: The full plain text of a license or a license addition.
range: string
note: The full plain text of a license or a license addition, without templating or other similar markup. Users of the licenseText for a license can apply the SPDX License List Matching Guidelines when comparing it to another text for matching purposes.

Snippet
type: Class
type: NodeShape
comment: Describes a certain part of a file.
subclass of: SoftwareArtifact
note: A Snippet describes a certain part of a file and can be used when the file is known to have some content that has been included from another original source. Snippets are useful for denoting when part of a file may have been originally created under another license or copied from a place with a known vulnerability.
node kind: IRI
property:
  class: File
  max count: 1
  min count: 1
  node kind: IRI
  path: snippetFromFile
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: lineRange
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: byteRange

application
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software application.

archive
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an archived collection of one or more files (.tar, .zip, etc.).

bom
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a bill of materials.

configuration
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is configuration data.

container
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a container image which can be used by a container runtime application.

data
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is data.

device
type: NamedIndividual
type: SoftwarePurpose
comment: The Element refers to a chipset, processor, or electronic board.

deviceDriver
type: NamedIndividual
type: SoftwarePurpose
comment: The Element represents software that controls hardware devices.

diskImage
type: NamedIndividual
type: SoftwarePurpose
comment: The Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.

documentation
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is documentation.

evidence
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is the evidence that a specification or requirement has been fulfilled.

executable
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an Artifact that can be run on a computer.

file
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc.).

filesystemImage
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a file system image that can be written to a disk (or virtual) partition.

firmware
type: NamedIndividual
type: SoftwarePurpose
comment: The Element provides low level control over a device's hardware.

framework
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software framework.

install
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is used to install software on disk.

library
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software library.

manifest
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software manifest.

model
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a machine learning or artificial intelligence model.

module
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a module of a piece of software.

operatingSystem
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an operating system.

other
type: NamedIndividual
type: SoftwarePurpose
comment: The Element doesn't fit into any of the other categories.

patch
type: NamedIndividual
type: SoftwarePurpose
comment: The Element contains a set of changes to update, fix, or improve another Element.

platform
type: NamedIndividual
type: SoftwarePurpose
comment: The Element represents a runtime environment.

requirement
type: NamedIndividual
type: SoftwarePurpose
comment: The Element provides a requirement needed as input for another Element.

source
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a single or a collection of source files.

specification
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a plan, guideline or strategy how to create, perform or analyze an application.

test
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a test used to verify functionality on a software element.

AssemblyAction
type: Class
type: NodeShape
comment: AssemblyAction represents the event of creating a product by assembling individual components.
subclass of: CreateAction
note: AssemblyAction refers to the process of constructing a product by putting together various components. These actions can vary depending on the purpose and requirements. In this context, the assembled product is typically designed to allow for disassembly.
node kind: IRI

AssemblyProcess
type: Class
type: NodeShape
comment: The AssemblyProcess represents the process of creating a product by assembling a set of components, potentially in a way that allows for at disassembly (at least partially).
subclass of: CreateProcess
note: The AssemblyProcess refers to the systematic method of putting together different components to create a finished product. The process of assembly is part of the manufacturing process used in industries such as automotive, electronics, aerospace, and consumer goods. Assembled products may be designed to be disassembled into components.
node kind: IRI

BoundaryCrossingAction
type: Class
type: NodeShape
comment: An action of crossing a boundary is defined in this class.
subclass of: UseAction
note: Boundary crossing occurs when an individual, object, or system moves between different defined areas, domains, or disciplines. It can apply to various fields, including education, psychology, business, logistics, and technology.
node kind: IRI

BoundaryDefinitionAction
type: Class
type: NodeShape
comment: The boundary definition is used to define boundaries.
subclass of: Action
note: Boundaries can be physical or abstract. This is the act of defining the boundaries. Relationship: For each BoundaryDefinitionAction there is one and only one /Core/Relationship class or subclass with the relationshipType of createdBy on the to and a /Core/Agent class or subclass on the from.
node kind: IRI
property:
  class: DictionaryEntry
  min count: 1
  node kind: BlankNodeOrIRI
  path: boundaryParameter

BoundaryDefinitionProcess
type: Class
type: NodeShape
comment: The Boundary Definition Process refers to the process class used to produce boundaries.
subclass of: DefinedProcess
note: This is the process of defining boundaries for the creation of a region.
node kind: IRI

ChangeAction
type: Class
type: NodeShape
comment: An actual change to a product.
subclass of: ModifyAction
note: A ChangeAction represents an alteration made to a product. Such alterations may include intentional adjustments or repairs. A repair is a corrective modification that restores a product to a functional or acceptable state following a defect, failure, or damage. Common examples of repairs are replacing worn components, correcting misalignments, sealing leaks, or reestablishing intended performance characteristics. Firmware updates performed are included, as they may correct software defects, or improve performance, or add new capabilities.
node kind: IRI

ChangeProcess
type: Class
type: NodeShape
comment: A prescribed change to a product.
subclass of: ModifyProcess
note: A ChangeProcess is a planned process causing an intentional change to a product, such as an adjustment.
node kind: IRI

DestroyAction
type: Class
type: NodeShape
comment: The record of destruction is entered in this action.
subclass of: Action
note: The action of destroying an element is recorded as part of the DestroyAction. To destroy refers to the act of completely eliminating, or rendering something unusable or irretrievable.
node kind: IRI
property:
  class: Agent
  min count: 1
  node kind: IRI
  path: destructionPerformedBy

DestroyProcess
type: Class
type: NodeShape
comment: The destruction process is defined in this process.
subclass of: DefinedProcess
note: Destroyed means to render an item useless. The destroyed process defines the method used to destroy an item.
node kind: IRI

HarvestAction
type: Class
type: NodeShape
comment: HarvestAction represents the act of creating a product by directly extracting goods or materials from nature.
subclass of: CreateAction
note: HarvestAction refers to an event where goods or products are obtained directly from natural sources. This includes activities such as mining, and fishing. In such cases, there may be no associated hasInput relationships, as the products are not assembled from other components but sourced directly.
node kind: IRI

HarvestProcess
type: Class
type: NodeShape
comment: Harvest is the process of extracting goods or products from nature.
subclass of: CreateProcess
note: Harvest is the process of extracting goods or products from nature. This includes mining, fishing and husbandry.
node kind: IRI

InspectionAction
type: Class
type: NodeShape
comment: An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system.
subclass of: UseAction
note: An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system. These actions are typically intended to identify whether the subject being inspected meets required standards, regulations, or specifications.
node kind: IRI

InspectionProcess
type: Class
type: NodeShape
comment: Inspection Process defines specific various processes needed to satisfy the inspection requirements for a specific product or service.
subclass of: UseProcess
note: Different types of products and services require different types of inspection processes. Your specific inspection process is defined in this process. You can define multiple inspection processes for goods based on requirements.
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: plannedInspectionLocation

InstantiateVirtualHardwareProcess
type: Class
type: NodeShape
comment: Class that describes an InstantiateVirtualHardwareProcess that is used to define VirtualHardware and its source.
subclass of: CreateProcess
note: InstantiateVirtualHardwareProcess is a class defining the process needed to instantiate a 'VirtualHardware' defined by running software package(s).
node kind: IRI

ManufactureAction
type: Class
type: NodeShape
comment: ManufactureAction represents the act of creating a product by a manufacturing process.
subclass of: CreateAction
note: ManufactureAction refers to an event where goods are created using materials or ingredients, typically resulting in a product that cannot be easily disassembled.
node kind: IRI

ManufactureProcess
type: Class
type: NodeShape
comment: This class represents the process involved in manufacturing products.
subclass of: CreateProcess
note: The manufacturing process encompasses the series of steps required to transform materials into finished goods. It is a fundamental operation across various industries, including automotive, electronics, pharmaceuticals, textiles, and food production.
node kind: IRI

PlanAction
type: Class
type: NodeShape
comment: A PlanAction involves the execution of a plan in relation to a PlanProcess.
subclass of: UseAction
note: A PlanAction involves the execution of a plan in relation to a PlanProcess. The description of the PlanAction is a mandatory property. Relationship: For each PlanAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'generates’ on the to and a PlanProcess class or subclass on the from.
node kind: IRI

PlanProcess
type: Class
type: NodeShape
comment: Process plans outline the stages of implementation or use related to a process.
subclass of: UseProcess
note: Complex processes require plans, therefore a process plan outlines procedures required to deliver a specified requirement.
node kind: IRI

ReproduceAction
type: Class
type: NodeShape
comment: Reproduction is the biological process by which organisms generate new individuals of the same species.
subclass of: CreateAction
note: Reproduction involves the act of replicating or reproducing a product. This includes producing new products related to husbandry, agriculture, and fishing. Relationship: For each ReproduceAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasInput’ on the from and a /Core/Element class or subclass on the to.
node kind: IRI

ReproduceProcess
type: Class
type: NodeShape
comment: Reproduction is the biological process by which living organisms produce offspring.
subclass of: CreateProcess
note: Reproduction is the biological process by which living organisms produce offspring. It occurs in plants, animals, and microorganisms.
node kind: IRI

ResponsibilityChangeAction
type: Class
type: NodeShape
comment: ResponsibilityChangeAction refers to the transfer of responsibility from one party to another.
subclass of: Action
note: Changes of responsibility are recorded in this process. Responsibility Change refers to the transfer of rights, responsibilities, and/or control of an asset, property, business, or entity from one party to another. This change can occur in various contexts, including real estate, business acquisitions, intellectual property, and assets. The startTime and endTime can be the same time.
node kind: IRI
property:
  class: Element
  min count: 1
  node kind: IRI
  path: responsibilityChangedOn
property:
  in: ownership
  in: custody
  max count: 1
  min count: 1
  path: responsibilityCategory
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: current
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: previous

ResponsibilityChangeProcess
type: Class
type: NodeShape
comment: ResponsibilityChangeProcess refers to the process of transferring responsibility from one party to another.
subclass of: DefinedProcess
note: The process changes of responsibility are recorded in this process. Responsibility Change refers to the transfer of rights, responsibilities, and/or control of an asset, property, business, or entity from one party to another.
node kind: IRI
property:
  class: Element
  node kind: IRI
  path: plannedProductOfResponsibilityChange
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: plannedPrevious
property:
  in: ownership
  in: custody
  max count: 1
  min count: 1
  path: responsibilityCategory
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: plannedCurrent

custody
type: NamedIndividual
type: ResponsibilityType
comment: Custody refers to the responsibility, control, and safekeeping of an asset, person, or legal entity. It involves both physical possession and legal authority over something or someone.

ownership
type: NamedIndividual
type: ResponsibilityType
comment: Ownership refers to the legal right to control, manage, and benefit from an asset, resource, or responsibility. It establishes authority, accountability, and entitlements over something, whether it's property, a business, intellectual property, or responsibilities.

StateAction
type: Class
type: NodeShape
comment: This is the state of an affected Element at a specific moment in time.
subclass of: UseAction
note: The state of a specific Element is defined, measured or observed in this class at a specific moment in time. The StateAction is defined by the method used by the DefinedStateProcess to produce an outcome.
node kind: IRI
property:
  class: State
  max count: 1
  min count: 1
  node kind: IRI
  path: currentState
property:
  class: DefinedStateProcess
  max count: 1
  min count: 1
  node kind: IRI
  path: decisionProcess

StorageAction
type: Class
type: NodeShape
comment: Records the storage of a product.
subclass of: ModifyAction
note: A StorageAction expresses the actual storage of product in a specific location.
node kind: IRI

StorageProcess
type: Class
type: NodeShape
comment: Prescribes the storage of a product.
subclass of: ModifyProcess
note: A StorageProcess expresses the planned storage of product in an optionally-specified location.
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: plannedStorageLocation

TestAction
type: Class
type: NodeShape
comment: A test action is a specific action associated with a test.
subclass of: UseAction
note: A test action is a specific action associated with a test. The execution of a test is a test action.
node kind: IRI

TestProcess
type: Class
type: NodeShape
comment: Test Process defines the testing process for an element.
subclass of: UseProcess
note: Tests are processes based on requirements. The process's requirements are met by the test process. Relationship: For each TestProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'contains’ on the from and a Requirements class or subclass on the to.
node kind: IRI

TransportAction
type: Class
type: NodeShape
comment: An actual change to a product's location.
subclass of: ModifyAction
note: A TransportAction expresses the change in location of a product, such as a component being moved from an assembly plant to a warehouse.
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: dropoffLocation
property:
  class: Location
  min count: 1
  node kind: IRI
  path: pickupLocation
property:
  datatype: string
  path: transportRoute

TransportProcess
type: Class
type: NodeShape
comment: A prescribed change to a product's location.
subclass of: ModifyProcess
note: A TransportProcess is a process that will result in a change in location of a product, such as a component being moved from an assembly plant to a warehouse.
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: forDropoffLocation
property:
  datatype: string
  path: plannedTransportRoute
property:
  class: Location
  node kind: IRI
  path: forPickupLocation

responsibilityCategory
type: ObjectProperty
comment: responsibilityCategory classifies the nature or domain of a responsibility transfer.
range: ResponsibilityType
note: This property categorizes responsibility changes based on the type of rights, responsibilities, or control being transferred.

EnergyConsumption
type: Class
type: NodeShape
comment: A class for describing the energy consumption incurred by an AI model in different stages of its lifecycle.
note: A class to denote the known or estimated energy consumption of an AI model during its training, fine-tuning, and inference stages. *Example* { "type": "ai_EnergyConsumption", "ai_trainingEnergyConsumption": [ { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "36.5", "ai_energyUnit": "kilowattHour" } ], "ai_inferenceEnergyConsumption": [ { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "0.042", "ai_energyUnit": "kilowattHour" } ] }
node kind: BlankNodeOrIRI
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: trainingEnergyConsumption
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: finetuningEnergyConsumption
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: inferenceEnergyConsumption

AnnotationType
type: Class
comment: Specifies the type of an annotation.

ElementMap
type: Class
type: NodeShape
comment: A key with an Element.
note: The class used for implementing mapping a string key to an Element. Each ElementMap contains a key-value pair which maps the key to its associated Element. To implement a dictionary, this class is to be used in a collection with unique keys.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: key
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: elementValue

ExternalMap
type: Class
type: NodeShape
comment: A map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument.
note: An external map is a map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument. The external map provides details about the externally-defined Element such as its provenance, where to retrieve it, and how to verify its integrity.
node kind: BlankNodeOrIRI
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: externalSpdxId
property:
  class: Artifact
  max count: 1
  node kind: IRI
  path: definingArtifact
property:
  datatype: anyURI
  max count: 1
  path: locationHint

ExternalRef
type: Class
type: NodeShape
comment: A reference to a resource outside the scope of SPDX 3 content related to an Element.
note: An External Reference points to a general resource outside the scope of the SPDX 3 content that provides additional context, characteristics or related information about an Element.
node kind: BlankNodeOrIRI
property:
  datatype: string
  path: locator
property:
  datatype: string
  max count: 1
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$
property:
  in: altDownloadLocation
  in: altWebPage
  in: binaryArtifact
  in: bom
  in: bower
  in: buildMeta
  in: buildSystem
  in: chat
  in: certificationReport
  in: componentAnalysisReport
  in: cwe
  in: documentation
  in: dynamicAnalysisReport
  in: eolNotice
  in: exportControlAssessment
  in: funding
  in: issueTracker
  in: mailingList
  in: mavenCentral
  in: metrics
  in: npm
  in: nuget
  in: license
  in: other
  in: privacyAssessment
  in: productMetadata
  in: purchaseOrder
  in: qualityAssessmentReport
  in: releaseNotes
  in: releaseHistory
  in: riskAssessment
  in: runtimeAnalysisReport
  in: secureSoftwareAttestation
  in: securityAdvisory
  in: securityAdversaryModel
  in: securityFix
  in: securityOther
  in: securityPenTestReport
  in: securityPolicy
  in: securityThreatModel
  in: socialMedia
  in: sourceArtifact
  in: staticAnalysisReport
  in: support
  in: vcs
  in: vulnerabilityDisclosureReport
  in: vulnerabilityExploitabilityAssessment
  in: x509Cert
  max count: 1
  path: externalRefType
property:
  datatype: string
  max count: 1
  path: comment

MeasureOfMass
type: Class
type: NodeShape
comment: The measure of mass refers to the quantity of matter in an object or substance.
subclass of: UnitOfMeasure
note: The measure of mass refers to the quantity of matter in an object or substance. Mass is a fundamental property of matter and is typically measured in various units depending on the system of measurement being used.
node kind: BlankNodeOrIRI

NamespaceMap
type: Class
type: NodeShape
comment: A mapping between prefixes and namespace partial URIs.
note: A namespace map allows the creator of a collection of serializable Elements to suggest shorter identifiers ("prefixes") for specific namespace portions of Element IDs. This map is used in SPDX content serialization to provide a more human-readable and smaller serialized representation of the Elements. For details of how NamespaceMap content is to be serialized please refer to the Model and serializations clause and the various serialization format-specific files within the spdx-3-model repository <https://github.com/spdx/spdx-3-model/tree/main/serialization>. Namespace maps support a variety of relevant use cases such as: 1. An SPDX content producer wishing to provide clarity of their serialization of an SPDX 2.X simple style collection where all content is newly minted and a single prefix-namespace is used. The consumer of SPDX content wishes to preserve the name space mapping provided by such a producer. In this case, the consumer would record the namespace map prefixes in the NamespaceMap such that subsequent serializations could reproduce the prefixes / namespaces in the native serialization format. 2. An SPDX content producer wishing to maintain consistent prefix use and understanding across multiple different serialization formats of the produced content. For example, an SBOM producer wishes to share/publish the SBOM as JSON-LD and XML. The producer can specify the preferred prefix mappings in the native serialization format using information from a single NamespaceMap accessible local to the producer. 3. An SPDX content consumer/producer wishing to maintain consistent prefix use while round tripping from SPDX content received, deserialized, modified/extended in some way, and then reserialized in the same serialization form. In this case the prefix-namespace mappings utilized in the content are transformed from the original native namespace/prefix into the in memory NamespaceMap then transformed from the NamespaceMap back into the resultant serialization nativ…
node kind: BlankNodeOrIRI
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: namespace
property:
  datatype: string
  max count: 1
  min count: 1
  path: prefix

no
type: NamedIndividual
type: PresenceType
comment: Indicates absence of the field.

noAssertion
type: NamedIndividual
type: PresenceType
comment: Makes no assertion about the field.

yes
type: NamedIndividual
type: PresenceType
comment: Indicates presence of the field.

SpdxDocument
type: Class
type: NodeShape
comment: A collection of SPDX Elements that could potentially be serialized.
subclass of: ElementCollection
note: The SpdxDocument provides a convenient way to express information about collections of SPDX Elements that could potentially be serialized as complete units (e.g., all in-scope SPDX data within a single JSON-LD file). SpdxDocument is independent of any particular serialization format or instance. Information we wish to preserve about a specific instance of serialization of this SPDX content is NOT expressed using the SpdxDocument but rather using an associated Artifact representing a particular instance of SPDX data physical serialization. Any instance of serialization of SPDX data shall not contain more than one SpdxDocument element definition.
node kind: IRI
property:
  class: AnyLicenseInfo
  max count: 1
  node kind: IRI
  path: dataLicense
property:
  class: ExternalMap
  node kind: BlankNodeOrIRI
  path: import
property:
  class: NamespaceMap
  node kind: BlankNodeOrIRI
  path: namespaceMap

contentType
type: DatatypeProperty
comment: Provides information about the content type of an Element or a property.
range: string
note: This field is a reasonable estimation of the content type of the Element or the property, from a creator perspective. Content type is intrinsic to the Element or the property, independent of how it is being used.

CdxPropertyEntry
type: Class
type: NodeShape
comment: A property name with an associated value.
note: Each CdxPropertyEntry contains a name-value pair which maps the name to its associated value. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values. This class can be used to implement CycloneDX compatible properties.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: cdxPropName
property:
  datatype: string
  max count: 1
  path: cdxPropValue

Extension
type: Class
type: NodeShape
comment: A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.
note: An Extension is a characterization of some aspect of an Element that is associated with the Element in a generalized fashion. Rather than being associated with a particular Element through the typical use of a purpose-specific object property an Extension is associated with the Element it characterizes using a single common generalized object property. This approach serves multiple purposes: 1. Support profile-based extended characterization of Elements. Enables specification and expression of Element characterization extensions within any profile and namespace of SPDX without requiring changes to other profiles or namespaces and without requiring local subclassing of remote classes (which could inhibit ecosystem interoperability in some cases). 2. Support extension of SPDX by adopting individuals or communities with Element characterization details uniquely specialized to their particular context. Enables adopting individuals or communities to utilize SPDX expressive capabilities along with expressing more arcane Element characterization details specific to them and not appropriate for standardization across SPDX. 3. Support structured capture of expressive solutions for gaps in SPDX coverage from real-world use. Enables adopting individuals or communities to express Element characterization details they require that are not currently defined in SPDX but likely should be. Enables a practical pipeline that: - identifies gaps in SPDX that should be filled, - expresses solutions to those gaps in a way that allows the identifying adopters to use the extended solutions with SPDX and does not conflict with current SPDX, - can be clearly detected among the SPDX content exchange ecosystem, - provides a clear and structured definition of gap solution that can be used as submission for revision to SPDX standard
node kind: BlankNodeOrIRI
property:
  message: https://spdx.org/rdf/3/terms/Extension/Extension is abstract and must not be instantiated directly.
  not:
    has value: Extension
  path: type

Project
type: Class
type: NodeShape
comment: Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result.
subclass of: Bundle
note: Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result. Based on the Project Management Body of Knowledge (PMBOK), 3rd edition. startTime is the time at which a project starts or is planned to start. endTime is the time at which a project ends or is planned to end.
node kind: IRI
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: projectOwner
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: projectContract
property:
  datatype: dateTimeStamp
  max count: 1
  path: endTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Agent
  node kind: IRI
  path: projectSponsor
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  path: startTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: string
  max count: 1
  min count: 1
  path: projectTitle

ExploitCatalogType
type: Class
comment: Specifies the exploit catalog type.

VexFixedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
subclass of: VexVulnAssessmentRelationship
note: VexFixedVulnAssessmentRelationship links a vulnerability to a number of elements representing VEX products where a vulnerability has been fixed and are no longer affected. It represents the VEX fixed status. *Constraints* When linking elements using a VexFixedVulnAssessmentRelationship, the following requirements shall be observed: - Elements linked with a VulnVexFixedAssessmentRelationship are constrained to using the fixedIn relationship type. *Example* { "type": "security_VexFixedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-fixed-in-1", "relationshipType": "fixedIn", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.4", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI

VexNotAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
note: VexNotAffectedVulnAssessmentRelationship connects a vulnerability and a number of elements designating them as products not affected by the vulnerability. This relationship corresponds to the VEX not_affected status. *Constraints* When linking elements using a VexNotVulnAffectedAssessmentRelationship, the following requirements shall be observed: - Relating elements with a VexNotAffectedVulnAssessmentRelationship is restricted to the doesNotAffect relationship type. - Both impactStatement and justificationType properties have a cardinality of 0..1 making them optional. Nevertheless, to produce a valid VEX not_affected statement, one of them shall be defined. This is specified in the Minimum Elements for VEX. *Example* { "type": "security_VexNotAffectedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-not-affected-1", "relationshipType": "doesNotAffect", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "security_justificationType": "componentNotPresent", "security_impactStatement": "Not using this vulnerable part of this library.", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI
property:
  in: componentNotPresent
  in: vulnerableCodeNotPresent
  in: vulnerableCodeCannotBeControlledByAdversary
  in: vulnerableCodeNotInExecutePath
  in: inlineMitigationsAlreadyExist
  max count: 1
  path: justificationType
property:
  datatype: dateTimeStamp
  max count: 1
  path: impactStatementTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: string
  max count: 1
  path: impactStatement

VexUnderInvestigationVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Designates elements as products where the impact of a vulnerability is being investigated.
subclass of: VexVulnAssessmentRelationship
note: VexUnderInvestigationVulnAssessmentRelationship links a vulnerability to a number of products stating the vulnerability's impact on them is being investigated. It represents the VEX under_investigation status. *Constraints* When linking elements using a VexUnderInvestigationVulnAssessmentRelationship the following requirements shall be observed: - Elements linked with a VexUnderInvestigationVulnAssessmentRelationship are constrained to using the underInvestigationFor relationship type. *Example* { "type": "security_VexUnderInvestigationVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-underInvestigation-1", "relationshipType": "underInvestigationFor", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
node kind: IRI

score
type: DatatypeProperty
comment: Provides a numerical (0-10) representation of the severity of a vulnerability.
range: decimal
note: The score provides information on the severity of a vulnerability per the Common Vulnerability Scoring System as defined by Forum of Incident Response and Security Teams <https://www.first.org/cvss/>.

vectorString
type: DatatypeProperty
comment: Specifies the CVSS vector string for a vulnerability.
range: string
note: Specifies any combination of the CVSS Base, Temporal, Threat, Environmental, and/or Supplemental vector string values for a vulnerability. Supports vectorStrings specified in all CVSS versions. *Constraints* String values for the vectorString range shall only include the abbreviated form of metric names specified in CVSS specifications, e.g. Common Vulnerability Scoring System Vector String <https://www.first.org/cvss/v4.0/specification-document#Vector-String>.

ContentIdentifierType
type: Class
comment: Specifies the type of a content identifier.

OutOfSpecAction
type: Class
type: NodeShape
comment: An out of specification action is defined in this class.
subclass of: UseAction
note: OutOfSpecAction refers to a situation where a product, material, environment, or process fails to meet the established standards or predefined specifications or exceeds specification parameters. Any result or condition that goes beyond these predefined parameters or thresholds is considered "out of specification," indicating a non-conformance or deviation that must be investigated and addressed to maintain product quality and regulatory compliance. This term is often used in industries like manufacturing, pharmaceuticals, quality control, and regulatory compliance
node kind: IRI

ResolutionAction
type: Class
type: NodeShape
comment: Products out of specification require a resolution action. This is the action of resolution.
subclass of: UseAction
note: Products out of specification require a resolution action. This is the action of resolution. Relationship: For each ResolutionAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'resolved’ on the from and an OutOfSpecAction class or subclass on the to.
node kind: IRI

ResponsibilityType
type: Class
comment: Specifies the type of responsibility held over an asset, property, or entity.

EnergyUnitType
type: Class
comment: Unit of energy consumption.

Bundle
type: Class
type: NodeShape
comment: A collection of Elements that have a shared context.
subclass of: ElementCollection
note: A bundle is a collection of Elements that have a shared context.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: context

ElementCollection
type: Class
type: NodeShape
comment: A collection of Elements, not necessarily with unifying context.
subclass of: Element
note: An ElementCollection is a collection of Elements, not necessarily with unifying context. All ElementCollections shall conform to the Core profile even if the Core profile is not specified in the profileConformance property. If the profileConformance property is not provided, it shall be evaluated as a list containing the "core" profile identifier. The inclusion of a profile identifier within the profileConformance property shall constitute a declaration that all constituent elements conform to the restrictions specified by that profile. *Constraints* - If the ElementCollection has at least 1 element, it shall also have at least 1 rootElement. - The element shall not be of type SpdxDocument. - The rootElement shall not be of type SpdxDocument.
node kind: IRI
property:
  in: core
  in: software
  in: simpleLicensing
  in: expandedLicensing
  in: security
  in: build
  in: ai
  in: dataset
  in: extension
  in: lite
  in: hardware
  in: supplyChain
  in: operations
  in: functionalSafety
  in: service
  path: profileConformance
property:
  class: Element
  node kind: IRI
  path: rootElement
property:
  class: Element
  node kind: IRI
  path: element
property:
  message: https://spdx.org/rdf/3/terms/Core/ElementCollection is abstract and must not be instantiated directly.
  not:
    has value: ElementCollection
  path: type

Hash
type: Class
type: NodeShape
comment: A mathematically calculated representation of a grouping of data.
subclass of: IntegrityMethod
note: A hash is a grouping of characteristics unique to the result of applying a mathematical algorithm that maps data of arbitrary size to a bit string (the hash) and is a one-way function, that is, a function which is practically infeasible to invert. This is commonly used for integrity checking of data. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.
node kind: BlankNodeOrIRI
property:
  in: adler32
  in: blake2b256
  in: blake2b384
  in: blake2b512
  in: blake3
  in: crystalsDilithium
  in: crystalsKyber
  in: falcon
  in: md2
  in: md4
  in: md5
  in: md6
  in: other
  in: sha1
  in: sha224
  in: sha256
  in: sha384
  in: sha512
  in: sha3_224
  in: sha3_256
  in: sha3_384
  in: sha3_512
  max count: 1
  min count: 1
  path: algorithm
property:
  datatype: string
  max count: 1
  min count: 1
  path: hashValue

IndividualElement
type: Class
type: NodeShape
comment: A concrete subclass of Element used by Individuals in the Core profile.
subclass of: Element
note: Individuals, such as NoneElement and NoAssertionElement, need to reference a concrete subclass of Element. This class provides the type used by the individuals defined in the Core profile.
node kind: IRI

RelationshipCompleteness
type: Class
comment: Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.

Role
type: Class
type: NodeShape
comment: A Role defines a specific position, function, or capacity that an entity may assume within any relevant context.
subclass of: Element
note: A Role defines a specific position, function, or capacity that an entity may assume within any relevant context. This context is intentionally broad and adaptable, capable of representing environments including, but not limited to, software builds, system architectures, project management structures, distribution channels, supply chain operations, lifecycle stages, or any other domain where entities perform specific functions. The Role class provides a structured mechanism to model these functional assignments independently of the entities themselves, allowing for reusable and standardized definitions of responsibilities and privileges across different SPDX documents and ecosystems.
node kind: IRI
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: referenceSpecification
property:
  datatype: string
  path: authorization
property:
  class: Requirement
  min count: 1
  node kind: IRI
  path: roleQualification
property:
  class: Requirement
  node kind: IRI
  path: responsibility

Tool
type: Class
type: NodeShape
comment: An element of hardware and/or software utilized to carry out a particular function.
subclass of: Element
note: A Tool is an element of hardware and/or software utilized to carry out a particular function.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: version

endTime
type: DatatypeProperty
comment: The point in time when an element or an action ends, becomes no longer applicable, or becomes no longer valid.
range: dateTimeStamp
note: A timestamp marking the conclusion of an action, the ending of an element's relevance, or the intended or unintended termination of either. It encompasses the moment of completion or cessation of processes, such as build finishes, service shutdowns, or system failures, as well as the point in time when an element or a relationship between elements becomes deprecated, expired, terminated, or inactive.

startTime
type: DatatypeProperty
comment: The point in time when an element or an action starts, becomes applicable, or becomes valid.
range: dateTimeStamp
note: A timestamp marking the commencement of an action, the beginning of an element's relevance, or the intended start of either. It encompasses the moment of triggering processes, such as build executions or service instantiations, as well as the point in time when an element or a relationship between elements becomes effective or active.

IndividualLicensingInfo
type: Class
type: NodeShape
comment: A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
subclass of: AnyLicenseInfo
note: Individuals, such as NoneLicense and NoAssertionLicense, need to reference a concrete subclass of AnyLicenseInfo. This class provides the type used by the individuals.
node kind: IRI

Assumption
type: Class
type: NodeShape
comment: A distinct unit representing a constraint associated with an item's use in a system.
subclass of: Element
note: An assumption element is a distinct unit that defines a design constraint. This constraint is imposed by the intended design, the requirement context, or the operational context. It ensures the item operates correctly within a system context.
node kind: IRI
property:
  datatype: string
  path: rationale
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: assumptionUID
property:
  datatype: string
  max count: 1
  min count: 1
  path: assumptionStatement

EvaluationResultType
type: Class
comment: Specifies the outcome of an evaluation or verification process.

VirtualHardwareModelType
type: Class
comment: Specifies the type of simulation model used to represent virtual hardware.

ExportControlClassification
type: Class
type: NodeShape
comment: Assessment of an Element for export control classification.
note: Assessment of an Element for export control classification according to the classification schema of one or multiple countries.
node kind: BlankNodeOrIRI
property:
  datatype: positiveInteger
  max count: 1
  path: weight
property:
  datatype: string
  max count: 1
  min count: 1
  path: exportingCountry
  pattern: ^[A-Z]{3}$
property:
  class: Specification
  max count: 1
  min count: 1
  node kind: IRI
  path: exportControlSpecification
property:
  datatype: string
  max count: 1
  min count: 1
  path: exportClassification
property:
  datatype: string
  max count: 1
  path: comment

ContentIdentifier
type: Class
type: NodeShape
comment: A canonical, unique, immutable identifier.
subclass of: IntegrityMethod
note: A ContentIdentifier is a canonical, unique, immutable identifier of the content of a software artifact, such as a package, a file, or a snippet. It can be used for verifying its identity and integrity.
node kind: BlankNodeOrIRI
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: contentIdentifierValue
property:
  in: gitoid
  in: swhid
  max count: 1
  min count: 1
  path: contentIdentifierType

File
type: Class
type: NodeShape
comment: Refers to any object that stores content on a computer.
subclass of: SoftwareArtifact
note: Refers to any object that stores content on a computer. The type of content can optionally be provided in the contentType property. The fileKind property can be set to directory to indicate the file represents a directory and all content stored in that directory. The fileKind property can be set to symlink to indicate the file represents a link to another file or directory, it does not represent the file or directory referenced by the symlink.
node kind: IRI
property:
  in: file
  in: directory
  in: symlink
  max count: 1
  path: fileKind
property:
  datatype: string
  max count: 1
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$

FileKindType
type: Class
comment: Enumeration of the different kinds of SPDX file.

Package
type: Class
type: NodeShape
comment: Refers to any unit of content that can be associated with a distribution of software.
subclass of: SoftwareArtifact
note: A package refers to any unit of content that can be associated with a distribution of software. Typically, a package is composed of one or more files. Any of the following non-limiting examples may be (but are not required to be) represented in SPDX as a package: - a tarball, zip file or other archive - a directory or sub-directory - a separately distributed piece of software which another Package or File uses or depends upon (e.g., a Python package, a Go module, ...) - a container image, and/or each image layer within a container image - a collection of one or more sub-packages - a Git repository snapshot from a particular point in time Note that some of these could be represented in SPDX as a file as well.
node kind: IRI
property:
  datatype: anyURI
  max count: 1
  path: homePage
property:
  datatype: string
  max count: 1
  path: packageVersion
property:
  datatype: anyURI
  max count: 1
  path: packageUrl
property:
  datatype: string
  max count: 1
  path: sourceInfo
property:
  datatype: string
  max count: 1
  path: version

DefinedStateProcess
type: Class
type: NodeShape
comment: This process is used to determine the state of an affected Element.
subclass of: UseProcess
note: This process is used to determine the state of an affected Element. The DefinedStateProcess is used to define a list of valid states of an affected Element. A DefinedStateProcess may describe the steps or conditions required to move an entity from one state to another.
node kind: IRI
property:
  class: State
  min count: 1
  node kind: IRI
  path: validState

SafetyRiskAssessmentType
type: Class
comment: Safety risk level.

Build
type: Class
type: NodeShape
comment: Class that describes a build instance of software/artifacts.
subclass of: Element
note: A build is a representation of the process in which a piece of software or artifact is built. It encapsulates information related to a build process and provides an element from which relationships can be created to describe the build's inputs, outputs, and related entities (e.g. builders, identities, etc.). ExternalIdentifier of type "urlScheme" may be used to identify build logs. In this case, the comment of the ExternalIdentifier shall be "LogReference". Note that startTime and endTime are optional, and may be omitted to simplify creating reproducible builds. buildStartTime and buildEndTime are deprecated. Migrate to startTime and endTime buildStartTime and buildEndTime will be removed in a future release.
node kind: IRI
property:
  datatype: string
  path: configSourceEntrypoint
property:
  datatype: string
  max count: 1
  path: buildId
property:
  datatype: anyURI
  path: configSourceUri
property:
  datatype: anyURI
  max count: 1
  min count: 1
  path: buildType
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: environment
property:
  datatype: dateTimeStamp
  max count: 1
  path: startTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: buildStartTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: buildEndTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: parameter
property:
  datatype: dateTimeStamp
  max count: 1
  path: endTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Hash
  node kind: BlankNodeOrIRI
  path: configSourceDigest

ContactPointRelationshipType
type: Class
comment: Information about the type of contact point for ContactPointRelationships.

PositiveIntegerRange
type: Class
type: NodeShape
comment: A tuple of two positive integers that define a range.
note: PositiveIntegerRange is a tuple of two positive integers that define a range. "beginIntegerRange" shall be less than or equal to "endIntegerRange".
node kind: BlankNodeOrIRI
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  path: beginIntegerRange
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  path: endIntegerRange

ProcessReadinessType
type: Class
comment: The ProcessReadinessType is defined by the enumeration.

SpdxOrganization
type: NamedIndividual
type: Organization
comment: An Organization representing the SPDX Project.
creationInfo: creationInfo SpdxOrganization

SpecificationType
type: Class
comment: A specification type defines the nature of a specification.

UnitOfMeasure
type: Class
type: NodeShape
comment: UnitOfMeasure specify information structures through industry standards for Units of Measure, Quantity Kinds, Dimensions and Data Types.
note: The QUDT, or "Quantity, Unit, Dimension and Type" schema defines the base classes properties, and restrictions used for modeling physical quantities, units of measure, and their dimensions in various measurement systems.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: unitQUDT
property:
  datatype: string
  max count: 1
  min count: 1
  path: quantity

rationale
type: DatatypeProperty
comment: A rationale is supporting information that provides the underlying justification or reasoning for an associated element, decision, or process.
range: string
note: A rationale is a detailed explanation that documents the logic and intent behind a specific element, decision, or process. It provides the justification for why an item exists or why a particular conclusion was reached, often citing evidence, criteria, or analysis methods. This context ensures transparency in the decision-making process by accounting for the considerations, risks, or motivations that inform the primary statement.

version
type: DatatypeProperty
comment: Version string for an Element.
range: string
note: Describes the specific version of an Element.

RequirementVerification
type: Class
type: NodeShape
comment: RequirementVerification class defines the base properties of a verification.
subclass of: Element
note: RequirementVerification class describes the method of verification. With this class it is possible to identify verification items, such as testcases, checklists or analysis frameworks, etc. It allows to add information for the verification preconditions (what needs to be present before even starting a verification task, run the test case etc.) and what are the postconditions (what has to have happened, what is the state of the item under verification, to be confident the verification task is completed). Verification typically checks if a requirement has been implemented or refined by more details correctly by a subsequent work product (like a technical specification needs to be verified if it correctly refines a functional specification, or that code correctly implements the state machine defined in a software component design requirement). A rationale is supporting information that adds more context on how verification needs to be performed, justifies the chosen verification method, etc.
node kind: IRI
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: verificationUID
property:
  in: analysis
  in: assessment
  in: audit
  in: demonstration
  in: inspection
  in: other
  in: review
  in: test
  path: verificationMethod
property:
  datatype: string
  max count: 1
  path: rationale
property:
  datatype: string
  path: verificationPrecondition
property:
  datatype: string
  path: verificationPostcondition

Dimensions
type: Class
type: NodeShape
comment: Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept.
note: Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept. The Z axis is the height of the object.
node kind: BlankNodeOrIRI
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: zAxisLength
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: yAxisLength
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: xAxisLength

SsvcDecisionType
type: Class
comment: Specifies the SSVC decision type.

AuthenticationProtocolType
type: Class
comment: Protocols which support authentication.

SoftwareArtifact
type: Class
type: NodeShape
comment: A distinct article or unit related to Software.
subclass of: Artifact
note: A software artifact is a distinct article or unit related to software such as a package, a file, or a snippet.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/Software/SoftwareArtifact is abstract and must not be instantiated directly.
  not:
    has value: SoftwareArtifact
  path: type
property:
  in: application
  in: archive
  in: bom
  in: configuration
  in: container
  in: data
  in: device
  in: diskImage
  in: deviceDriver
  in: documentation
  in: evidence
  in: executable
  in: file
  in: filesystemImage
  in: firmware
  in: framework
  in: install
  in: library
  in: manifest
  in: model
  in: module
  in: operatingSystem
  in: other
  in: patch
  in: platform
  in: requirement
  in: source
  in: specification
  in: test
  path: additionalPurpose
property:
  datatype: string
  path: attributionText
property:
  datatype: nonNegativeInteger
  max count: 1
  path: artifactSize
property:
  datatype: anyURI
  max count: 1
  path: downloadLocation
property:
  datatype: string
  max count: 1
  path: copyrightText
property:
  in: application
  in: archive
  in: bom
  in: configuration
  in: container
  in: data
  in: device
  in: diskImage
  in: deviceDriver
  in: documentation
  in: evidence
  in: executable
  in: file
  in: filesystemImage
  in: firmware
  in: framework
  in: install
  in: library
  in: manifest
  in: model
  in: module
  in: operatingSystem
  in: other
  in: patch
  in: platform
  in: requirement
  in: source
  in: specification
  in: test
  max count: 1
  path: primaryPurpose
property:
  class: ContentIdentifier
  node kind: BlankNodeOrIRI
  path: contentIdentifier

ModifyAction
type: Class
type: NodeShape
comment: An actual alteration of a product.
subclass of: Action
note: A ModifyAction is an action that alters a product, such as a change to its configuration or its location. Relationship: For each ModifyAction there is at least one /Core/Relationship class or subclass with the relationshipType of hasOutput on the from and a /Core/Element subclass on the to. For each ModifyAction there is at least one /Core/Relationship class or subclass with the relationshipType of performedBy on the from and a /Core/Element subclass on the to.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/ModifyAction is abstract and must not be instantiated directly.
  not:
    has value: ModifyAction
  path: type

ModifyProcess
type: Class
type: NodeShape
comment: A prescribed alteration of a product.
subclass of: DefinedProcess
note: A ModifyProcess is a process that will result in the alteration of a product, such as a change to its configuration or its location. Relationship: For each ModifyProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasOutput’ on the from and a /Core/Element subclass on the to. For each ModifyProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasInput’ on the from and a /Core/Element subclass on the to.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/ModifyProcess is abstract and must not be instantiated directly.
  not:
    has value: ModifyProcess
  path: type

PresenceType
type: Class
comment: Categories of presence or absence.

RequirementStatusType
type: Class
comment: Provide an enumerated set of requirement statuses that can provide state to a requirement.

comment
type: DatatypeProperty
comment: Provide consumers with comments by the creator of the Element about the Element.
range: string
note: A comment is an optional field for creators of the Element to provide comments to the readers/reviewers of the document.

ConfidentialityLevelType
type: Class
comment: Confidentiality level.

DatasetAvailabilityType
type: Class
comment: Availability of dataset.

ExtendableLicense
type: Class
type: NodeShape
comment: Abstract class representing a License or an OrLaterOperator.
subclass of: AnyLicenseInfo
note: The WithAdditionOperator can have a License or an OrLaterOperator as the license property value. This class is used for the value.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/ExpandedLicensing/ExtendableLicense is abstract and must not be instantiated directly.
  not:
    has value: ExtendableLicense
  path: type

License
type: Class
type: NodeShape
comment: Abstract class for the portion of an AnyLicenseInfo representing a license.
subclass of: ExtendableLicense
note: A License represents a license text, whether listed on the SPDX License List <https://spdx.org/licenses/> (ListedLicense) or defined by an SPDX data creator (CustomLicense).
node kind: IRI
property:
  datatype: string
  max count: 1
  path: obsoletedBy
property:
  datatype: boolean
  max count: 1
  path: isDeprecatedLicenseId
property:
  datatype: string
  max count: 1
  path: standardLicenseHeader
property:
  datatype: anyURI
  path: seeAlso
property:
  datatype: string
  max count: 1
  path: licenseXml
property:
  message: https://spdx.org/rdf/3/terms/ExpandedLicensing/License is abstract and must not be instantiated directly.
  not:
    has value: License
  path: type
property:
  datatype: string
  max count: 1
  min count: 1
  path: licenseText
property:
  datatype: boolean
  max count: 1
  path: isOsiApproved
property:
  datatype: string
  max count: 1
  path: standardLicenseTemplate
property:
  datatype: boolean
  max count: 1
  path: isFsfLibre

LicenseAddition
type: Class
type: NodeShape
comment: Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
subclass of: Element
note: A LicenseAddition represents text which is intended to be added to a License as additional text, but which is not itself intended to be a standalone License. It may be an exception which is listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html> (ListedLicenseException), or may be any other additional text (as an exception or otherwise) which is defined by an SPDX data creator (CustomLicenseAddition).
node kind: IRI
property:
  datatype: boolean
  max count: 1
  path: isDeprecatedAdditionId
property:
  datatype: string
  max count: 1
  path: licenseXml
property:
  datatype: anyURI
  path: seeAlso
property:
  message: https://spdx.org/rdf/3/terms/ExpandedLicensing/LicenseAddition is abstract and must not be instantiated directly.
  not:
    has value: LicenseAddition
  path: type
property:
  datatype: string
  max count: 1
  min count: 1
  path: additionText
property:
  datatype: string
  max count: 1
  path: standardAdditionTemplate
property:
  datatype: string
  max count: 1
  path: obsoletedBy

Extension
preferred namespace prefix: spdx-extension

EvidenceType
type: Class
comment: EvidenceType refers to categories of documented or observable proof used to verify compliance, qualification, or performance

Hardware
type: Class
type: NodeShape
comment: Class that describes an instance of Hardware.
subclass of: Artifact
note: A hardware artifact is a distinct unit related to hardware.
node kind: IRI
property:
  class: Specification
  node kind: IRI
  path: additionalInformationSpecification
property:
  datatype: string
  max count: 1
  path: batchNumber
property:
  datatype: string
  max count: 1
  path: version
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: hazard
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: productAgent
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: additionalInformation
property:
  message: https://spdx.org/rdf/3/terms/Hardware/Hardware is abstract and must not be instantiated directly.
  not:
    has value: Hardware
  path: type
property:
  datatype: dateTimeStamp
  max count: 1
  path: releaseDate
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: string
  max count: 1
  path: serialNumber
property:
  datatype: string
  max count: 1
  min count: 1
  path: partNumber
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: category

CvssSeverityType
type: Class
comment: Specifies the CVSS base, temporal, threat, or environmental severity type.

VexJustificationType
type: Class
comment: Specifies the VEX justification type.

VexVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Abstract ancestor class for all VEX relationships.
subclass of: VulnAssessmentRelationship
note: VexVulnAssessmentRelationship is an abstract subclass that defined the common properties shared by all the SPDX-VEX status relationships. *Constraints* When linking elements using a VexVulnAssessmentRelationship, the following requirements shall be observed: - The to: end shall point to elements representing the VEX *products*. To specify a different element where the vulnerability was detected, the VEX relationship can optionally specify *subcomponents* using the assessedElement property. VEX inherits information from the document level down to its statements. When a statement is missing information it can be completed by reading the equivalent field from the containing document. For example, if a VEX relationship is missing data in its createdBy property, tools shall consider the entity listed in the CreationInfo section of the document as the VEX author. In the same way, when a VEX relationship does not have a created property, the document's date shall be considered as authoritative.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/Security/VexVulnAssessmentRelationship is abstract and must not be instantiated directly.
  not:
    has value: VexVulnAssessmentRelationship
  path: type
property:
  datatype: string
  max count: 1
  path: statusNotes
property:
  datatype: string
  max count: 1
  path: vexVersion

CreateAction
type: Class
type: NodeShape
comment: CreationAction represents an event of product creation.
subclass of: Action
note: CreationAction represents the lifecycle event of Product creation. A product could be manufactured, assembled, mined/extracted directly from the nature etc. Relationship: For each CreateAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasOutput’ on the from and a /Core/Element class or subclass on the to.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/CreateAction is abstract and must not be instantiated directly.
  not:
    has value: CreateAction
  path: type

State
type: Class
type: NodeShape
comment: A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time.
subclass of: Artifact
note: A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time. States are used to describe different conditions within a system and provide information about its current status. They help us understand the behavior of systems or product by showing their progression through various states over time. States describe what a project has achieved (or not) as opposed to describing actions taken by people involved with the project, or activities performed during development of that project.
node kind: IRI

UseProcess
type: Class
type: NodeShape
comment: Use Process defines actions used by elements.
subclass of: DefinedProcess
note: The UseProcess is an abstract class used to define processes that interact with key elements. Plan, state, and inspection processes plus managing boundaries are critical processes used by elements. Relationship: For each UseProcess or subclass except the PlanProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'affects’ on the from and a /Core/Element class or subclass on the to.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/UseProcess is abstract and must not be instantiated directly.
  not:
    has value: UseProcess
  path: type

EnergyConsumptionDescription
type: Class
type: NodeShape
comment: The class that helps note down the quantity of energy consumption and the unit used for measurement.
note: This class is designed to store energy consumption data, including the quantity and the unit of measurement. The energyQuantity property stores the amount of energy consumed, and the energyUnit property stores the unit used for measurement. For example, 0.042 kilowatt-hour of energy will have 0.042 as a value for property energyQuantity, and "kilowattHour" as a value for property energyUnit. *Example* { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "0.042", "ai_energyUnit": "kilowattHour" }
node kind: BlankNodeOrIRI
property:
  in: kilowattHour
  in: megajoule
  in: other
  max count: 1
  min count: 1
  path: energyUnit
property:
  datatype: decimal
  max count: 1
  min count: 1
  path: energyQuantity

IntegrityMethod
type: Class
type: NodeShape
comment: Provides an independently reproducible mechanism that permits verification of a specific Element.
note: An IntegrityMethod provides an independently reproducible mechanism that permits verification of a specific Element that correlates to the data in this SPDX document. This identifier enables a recipient to determine if anything in the original Element has been changed and eliminates confusion over which version or modification of a specific Element is referenced. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.
node kind: BlankNodeOrIRI
property:
  message: https://spdx.org/rdf/3/terms/Core/IntegrityMethod is abstract and must not be instantiated directly.
  not:
    has value: IntegrityMethod
  path: type
property:
  datatype: string
  max count: 1
  path: comment

MeasureOfLength
type: Class
type: NodeShape
comment: The measure of length refers to the dimension of an object or space that describes how long it is, typically expressed in various units depending on the system of measurement being used.
subclass of: UnitOfMeasure
note: The measure of length refers to the dimension of an object or space that describes how long it is, typically expressed in various units depending on the system of measurement being used.
node kind: BlankNodeOrIRI

SbomType
type: Class
comment: Provides a set of values to be used to describe the common types of SBOMs that tools may create.

CreateProcess
type: Class
type: NodeShape
comment: The CreateProcess refers to the abstract process class that can be used to represent the process of creation of a product.
subclass of: DefinedProcess
note: The creation process refers to the systematic steps involved in bringing something new into existence. This can apply to products, ideas, businesses, art, software, and even life itself. Relationship: For every CreateProcess, there exists at least one /Core/Relationship class or subclass with a relationshipType of 'hasOutput', connecting the CreateProcess (from) to a /Core/Element class or subclass (to).
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/CreateProcess is abstract and must not be instantiated directly.
  not:
    has value: CreateProcess
  path: type

CreationInfo
type: Class
type: NodeShape
comment: Provides information about the creation of the Element.
note: The CreationInfo provides information about who created the Element, and when and how it was created. The dateTime created is often the date of last change (e.g., a git commit date), not the date when the SPDX data was created, as doing so supports reproducible builds.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  path: comment
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  path: created
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Agent
  min count: 1
  node kind: IRI
  path: createdBy
property:
  datatype: string
  max count: 1
  min count: 1
  path: specVersion
  pattern: ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))?$
property:
  class: Tool
  node kind: IRI
  path: createdUsing

DefinedType
type: Class
type: NodeShape
comment: The DefinedType class associates a specific type with its defined source.
note: The DefinedType class associates a specific type with its defined source. It provides a structured way to represent defined types, holds information about the type's identity and the source specification that defines its structure and semantics.
node kind: BlankNodeOrIRI
property:
  class: Specification
  max count: 1
  min count: 1
  node kind: IRI
  path: definitionSource
property:
  datatype: string
  max count: 1
  min count: 1
  path: typeFromSource

IsoAutomationLevel
type: Class
comment: Defines the level of automation a system possesses.

SupportType
type: Class
comment: Type of support that is associated with an artifact.

Service
preferred namespace prefix: spdx-service

SimpleLicensing
preferred namespace prefix: spdx-simplelicensing

Relationship
type: Class
type: NodeShape
comment: Describes a relationship between one or more elements.
subclass of: Element
note: A Relationship is a grouping of characteristics unique to an assertion that one Element is related to one or more other Elements in some way. To explicitly assert that no such relationships exist, the to property shall contain the NoneElement individual and no other elements. A relationship that contains NoneElement and additional elements in the to property is not valid. To explicitly assert that no assertions are being made regarding the existence of such relationships, the to property shall contain the NoAssertionElement individual.
node kind: IRI
or:
  not:
    property:
      has value: invokedBy
      path: relationshipType
or:
  class: LifecycleScopedRelationship
  property:
    class: Agent
    path: to
or:
  not:
    property:
      has value: assumes
      path: relationshipType
or:
  property:
    class: Assumption
    path: to
or:
  not:
    property:
      has value: hasDynamicLink
      path: relationshipType
or:
  class: LifecycleScopedRelationship
or:
  not:
    property:
      has value: hasHost
      path: relationshipType
or:
  class: LifecycleScopedRelationship
  property:
    class: Build
    path: from
or:
  not:
    property:
      has value: performedBy
      path: relationshipType
or:
  property:
    class: Agent
    path: to
  property:
    class: Action
    path: from
or:
  not:
    property:
      has value: implementedBy
      path: relationshipType
or:
  property:
    class: Requirement
    path: from
or:
  not:
    property:
      has value: tracedToDetail
      path: relationshipType
or:
  property:
    class: Requirement
    path: from
  property:
    class: Requirement
    path: to
or:
  not:
    property:
      has value: locatedAt
      path: relationshipType
or:
  property:
    class: Location
    path: to
or:
  not:
    property:
      has value: usesTool
      path: relationshipType
or:
  class: LifecycleScopedRelationship
or:
  not:
    property:
      has value: serializedInArtifact
      path: relationshipType
or:
  property:
    class: Artifact
    path: to
  property:
    class: SpdxDocument
    path: from
or:
  not:
    property:
      has value: hasProvidedDependency
      path: relationshipType
or:
  class: LifecycleScopedRelationship
or:
  not:
    property:
      has value: reportedBy
      path: relationshipType
or:
  property:
    class: Agent
    path: to
  property:
    class: Vulnerability
    path: from
or:
  not:
    property:
      has value: hasRoleIn
      path: relationshipType
or:
  class: RoleRelationship
or:
  not:
    property:
      has value: hasSpecification
      path: relationshipType
or:
  class: LifecycleScopedRelationship
or:
  not:
    property:
      has value: hasAssociatedVulnerability
      path: relationshipType
or:
  property:
    class: Artifact
    path: from
  property:
    class: Vulnerability
    path: to
or:
  not:
    property:
      has value: providesSupportFor
      path: relationshipType
or:
  class: SupportRelationship
  property:
    class: Artifact
    path: to
  property:
    class: Agent
    path: from
or:
  not:
    property:
      has value: hasContactPoint
      path: relationshipType
or:
  class: ContactPointRelationship
  property:
    class: Agent
    path: to
  property:
    class: Artifact
    path: from
or:
  not:
    property:
      has value: publishedBy
      path: relationshipType
or:
  property:
    class: Agent
    path: to
  property:
    class: Vulnerability
    path: from
or:
  not:
    property:
      has value: hasInput
      path: relationshipType
or:
  property:
    or:
      class: Build
    or:
      class: DefinedProcess
    or:
      class: Action
    path: from

VerificationType
type: Class
comment: Enumeration of verification types.

VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Abstract ancestor class for all vulnerability assessments.
subclass of: Relationship
note: VulnAssessmentRelationship is the ancestor class common to all vulnerability assessment relationships. It factors out the common properties shared by them.
node kind: IRI
property:
  class: Artifact
  max count: 1
  node kind: IRI
  path: assessedElement
property:
  datatype: dateTimeStamp
  max count: 1
  path: withdrawnTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: modifiedTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: publishedTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: suppliedBy
property:
  message: https://spdx.org/rdf/3/terms/Security/VulnAssessmentRelationship is abstract and must not be instantiated directly.
  not:
    has value: VulnAssessmentRelationship
  path: type

UseAction
type: Class
type: NodeShape
comment: The action of product use.
subclass of: Action
note: This is the specific action of product use. Relationship: For each UseAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'performedBy’ on the from and a /Core/Agent class or subclass on the to. For each UseAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'affects’ on the from and a /Core/Element class or subclass on the to.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SupplyChain/UseAction is abstract and must not be instantiated directly.
  not:
    has value: UseAction
  path: type

Build
preferred namespace prefix: spdx-build

LifecycleScopeType
type: Class
comment: Provide an enumerated set of lifecycle phases that can provide context to relationships.

Requirement
type: Class
type: NodeShape
comment: A distinct unit representing a requirement, as used in systems, software, and hardware engineering.
subclass of: Element
note: A requirement element is a distinct unit that defines an expectation, need, behavior, or design intent of an item that either already exists or is to be created in accordance with this requirement. A rationale is an additional detail used to define the reason or justification for the existence of the requirement. The rationale is usually less formal than the wording of the requirement statement itself.
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: requirementStatement
property:
  datatype: string
  path: rationale
property:
  in: design
  in: development
  in: build
  in: test
  in: runtime
  in: decommission
  in: update
  in: other
  path: devLifecycleStage
property:
  in: draft
  in: reviewable
  in: active
  in: retired
  in: backlog
  max count: 1
  path: requirementStatus
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: requirementUID

ExternalIdentifier
type: Class
type: NodeShape
comment: A reference to a resource identifier defined outside the scope of SPDX 3 content that uniquely identifies an Element.
note: An ExternalIdentifier is a reference to a resource outside the scope of SPDX 3 content that provides a unique key within an established domain that can uniquely identify an Element.
node kind: BlankNodeOrIRI
property:
  datatype: anyURI
  path: identifierLocator
property:
  in: ark
  in: bic
  in: cpe22
  in: cpe23
  in: cve
  in: doi
  in: duns
  in: ecli
  in: eli
  in: email
  in: eori
  in: evidenceUID
  in: gitoid
  in: gln
  in: glue
  in: gtin
  in: hsCodes
  in: iban
  in: ibid
  in: ibrn
  in: isan
  in: isbn
  in: iscc
  in: isci
  in: isil
  in: ismn
  in: isni
  in: isrc
  in: issn
  in: iswc
  in: lei
  in: lexid
  in: nli
  in: orcidid
  in: other
  in: packageUrl
  in: phoneNumber
  in: requirementUID
  in: rorid
  in: securityOther
  in: swhid
  in: swid
  in: urlScheme
  in: vatNumber
  in: verificationUID
  in: webpage
  max count: 1
  min count: 1
  path: externalIdentifierType
property:
  datatype: string
  max count: 1
  path: comment
property:
  datatype: string
  max count: 1
  path: issuingAuthority
property:
  datatype: string
  max count: 1
  min count: 1
  path: identifier

Specification
type: Class
type: NodeShape
comment: A specification is a detailed description of the design, requirements, or features of a product, process, or system.
subclass of: Artifact
note: A specification (spec) is a detailed document that outlines the design, requirements, or features for a product, process, or system. Requirements, standards, specifications and processes can be referenced in this class.
node kind: IRI
property:
  in: formalStandard
  in: regulation
  in: specification
  in: other
  max count: 1
  path: specType

DefinedProcess
type: Class
type: NodeShape
comment: Class that describes a process.
subclass of: Artifact
note: Processes are composed of systematic task(s) required to achieve a goal.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/Core/DefinedProcess is abstract and must not be instantiated directly.
  not:
    has value: DefinedProcess
  path: type
property:
  datatype: string
  max count: 1
  path: rationale
property:
  datatype: string
  max count: 1
  min count: 1
  path: version
property:
  in: draft
  in: active
  in: obsoleted
  in: other
  max count: 1
  path: processReadiness

Action
type: Class
type: NodeShape
comment: Class that describes an action that has occurred.
subclass of: Artifact
note: Action defines an event that has occurred. This is an Abstract Action. startTime is the time at which an action starts or triggered. endTime is the time at which an action stops or finishes.
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  path: startTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: additionalInformation
property:
  message: https://spdx.org/rdf/3/terms/Core/Action is abstract and must not be instantiated directly.
  not:
    has value: Action
  path: type
property:
  class: Location
  node kind: IRI
  path: actionLocation
property:
  datatype: dateTimeStamp
  max count: 1
  path: endTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$

Vulnerability
type: Class
type: NodeShape
comment: Specifies a vulnerability and its associated information.
subclass of: Artifact
note: Specifies a vulnerability and its associated information. *Example* { "type": "security_Vulnerability", "spdxId": "urn:spdx.dev:vuln-1", "summary": "Use of a Broken or Risky Cryptographic Algorithm", "description": "The package elliptic before version 6.5.4 are vulnerable to ...", "security_modifiedTime": "2021-03-08T16:06:43Z", "security_publishedTime": "2021-03-08T16:02:50Z", "externalIdentifier": [ { "type": "ExternalIdentifier", "externalIdentifierType": "cve", "identifier": "CVE-2020-28498", "identifierLocator": [ "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498", "https://www.cve.org/CVERecord?id=CVE-2020-28498" ], "issuingAuthority": "urn:spdx.dev:agent-cve.org" }, { "type": "ExternalIdentifier", "externalIdentifierType": "securityOther", "identifier": "GHSA-r9p9-mrjm-926w", "identifierLocator": [ "https://github.com/advisories/GHSA-r9p9-mrjm-926w" ] }, { "type": "ExternalIdentifier", "externalIdentifierType": "securityOther", "identifier": "SNYK-JS-ELLIPTIC-1064899", "identifierLocator": [ "https://security.snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" ] } ], "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" ] }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": [ "https://ubuntu.com/security/CVE-2020-28498" ] }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": [ "https://github.com/indutny/elliptic/pull/244/commits" ] }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": [ "https://github.com/christianlundkvist/blog/2020_05_26_secp256k1_twist_attacks.md" ] } ] }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnRelationship-1", "relationshipType": "hasAssociatedVulnerability", "from": "urn:npm-elliptic-6.5.2", "to": [ "urn:spdx.dev:vuln-1" ], "startTime": "2021-03-08T16:06:50Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "fro…
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  path: publishedTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: modifiedTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: withdrawnTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$

DatasetType
type: Class
comment: Enumeration of dataset types.

AnyLicenseInfo
type: Class
type: NodeShape
comment: Abstract class representing a license combination consisting of one or more licenses.
subclass of: Element
note: AnyLicenseInfo is an abstract class representing a license combination consisting of one or more licenses (optionally including additional text), which may be combined according to the SPDX license expression syntax. An AnyLicenseInfo is used by licensing properties of software artifacts. It can be: - a NoneLicense; - a NoAssertionLicense; - a single license (either on the SPDX License List <https://spdx.org/licenses/> or a custom-defined license); - a single license with an "or later" operator applied; - the foregoing with additional text applied; or - a set of licenses combined by applying "AND" and "OR" operators recursively.
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/SimpleLicensing/AnyLicenseInfo is abstract and must not be instantiated directly.
  not:
    has value: AnyLicenseInfo
  path: type

LifecycleScopedRelationship
type: Class
type: NodeShape
comment: Provide context for a relationship that occurs in the lifecycle.
subclass of: Relationship
note: Certain relationships are sensitive to where they occur in the lifecycle. This parameter lets us avoid a proliferation of relationships, by parameterizing this context information for a relationship.
node kind: IRI
property:
  in: design
  in: development
  in: build
  in: test
  in: runtime
  in: decommission
  in: update
  in: other
  max count: 1
  path: scope

ProfileIdentifierType
type: Class
comment: Enumeration of valid profile identifiers.

Operations
preferred namespace prefix: spdx-operations

Location
type: Class
type: NodeShape
comment: Location is used to define the location, address or coordinates of a place.
subclass of: Element
note: Location is used to define the location, address or coordinates of a place. Location data may include latitude and longitude (for geographical locations), IP addresses for network locations, MAC addresses for computer networks, or other identifiers that specify where something exists within a system. There is often a need to provide context about where each one is located in relation to other things around it (e.g., which city, country).
node kind: IRI
property:
  message: https://spdx.org/rdf/3/terms/Core/Location is abstract and must not be instantiated directly.
  not:
    has value: Location
  path: type
property:
  datatype: dateTimeStamp
  max count: 1
  path: locationTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$

Artifact
type: Class
type: NodeShape
comment: A distinct article or unit within the domain.
subclass of: Element
note: An artifact is a distinct article or unit within the domain, such as an electronic file, a software package, a software service, a device or an element of data.
node kind: IRI
property:
  datatype: string
  path: standardName
property:
  datatype: string
  max count: 1
  path: intendedUse
property:
  datatype: dateTimeStamp
  max count: 1
  path: releaseTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  datatype: dateTimeStamp
  max count: 1
  path: builtTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: suppliedBy
property:
  datatype: dateTimeStamp
  max count: 1
  path: validUntilTime
  pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$
property:
  class: Agent
  node kind: IRI
  path: originatedBy
property:
  message: https://spdx.org/rdf/3/terms/Core/Artifact is abstract and must not be instantiated directly.
  not:
    has value: Artifact
  path: type
property:
  in: development
  in: support
  in: deployed
  in: limitedSupport
  in: endOfSupport
  in: noSupport
  in: noAssertion
  path: supportLevel

DictionaryEntry
type: Class
type: NodeShape
comment: A key with an associated value.
note: The class used for implementing a generic string mapping (also known as associative array, dictionary, or hash map) in SPDX. Each DictionaryEntry contains a key-value pair which maps the key to its associated value. To implement a dictionary, this class is to be used in a collection with unique keys.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  path: key
property:
  datatype: string
  max count: 1
  path: value

HashAlgorithm
type: Class
comment: A mathematical algorithm that maps data of arbitrary size to a bit string.

to
type: ObjectProperty
comment: References an Element on the right-hand side of a relationship.
range: Element
note: This field references an Element on the right-hand side of a relationship. If it is not provided, it indicates that there are no known relationships of the given type.

from
type: ObjectProperty
comment: References the Element on the left-hand side of a relationship.
range: Element
note: This field references the Element on the left-hand side of a relationship.

Hardware
preferred namespace prefix: spdx-hardware

ExpandedLicensing
preferred namespace prefix: spdx-expandedlicensing

SoftwarePurpose
type: Class
comment: Provides information about the primary purpose of an Element.

AI
preferred namespace prefix: spdx-ai

FunctionalSafety
preferred namespace prefix: spdx-functionalsafety

Element
type: Class
type: NodeShape
comment: Base domain class from which all other SPDX 3 domain classes derive.
note: An Element is a representation of a fundamental concept either directly inherent to the Bill of Materials (BOM) domain or indirectly related to the BOM domain and necessary for contextually characterizing BOM concepts and relationships. Within SPDX 3 structure this is the base class acting as a consistent, unifying, and interoperable foundation for all explicit and inter-relatable content objects.
node kind: IRI
property:
  datatype: string
  max count: 1
  path: comment
property:
  message: Class is known to not derive from Extension and cannot be used
  not:
    or:
      class: ContentIdentifier
    or:
      class: Snippet
    or:
      class: Sbom
    or:
      class: Package
    or:
      class: File
    or:
      class: SimpleLicensingText
    or:
      class: LicenseExpression
    or:
      class: EvidenceRelationship
    or:
      class: EvaluationResult
    or:
      class: Assumption
    or:
      class: RequirementVerification
    or:
      class: CustomLicenseAddition
    or:
      class: CustomLicense
    or:
      class: WithAdditionOperator
    or:
      class: ListedLicense
    or:
      class: DisjunctiveLicenseSet
    or:
      class: ListedLicenseException
    or:
      class: ConjunctiveLicenseSet
    or:
      class: IndividualLicensingInfo
    or:
      class: OrLaterOperator
    or:
      class: ExternalMap
    or:
      class: SoftwareAgent
    or:
      class: Hash
    or:
      class: Person
    or:
      class: PackageVerificationCode
    or:
      class: PhysicalLocation
    or:
      class: Agent
    or:
      class: MeasureOfMass
    or:
      class: ExternalIdentifier
    or:
      class: Regulation
    or:
      class: SpdxDocument
    or:
      class: LifecycleScopedRelationship
    or:
      class: Specification
    or:
      class: Bom
    or:
      class: DictionaryEntry
    or:
      class: IndividualElement
    or:
      class: SupportRelationship
    or:
      class: ElementMap
    or:
      class: Relationship
    or:
      class: Requirement
    or:
      class: Role
    or:
      class: ContactPointRelationship
    or:
      class: PositiveIntegerRange
    or:
      class: RoleRelationship
    or:
      class: UnitOfMeasure
    or:
      class: MeasureOfLength
    or:
      class: Bundle
    or:
      class: Annotation
    or:
      class: Organization
    or:
      class: DefinedType
    or:
      class: NamespaceMap
    or:
      class: ExternalRef
    or:
      class: Tool
    or:
      class: CreationInfo
    or:
      class: Project
    or:
      class: ExportControlClassificationAssessment
    or:
      class: ExportControlClassification
    or:
      class: StorageAction
    or:
      class: DefinedStateProcess
    or:
      class: ManufactureAction
    or:
      class: BoundaryDefinitionAction
    or:
      class: TestProcess
    or:
      class: BoundaryCrossingAction
    or:
      class: TransportAction
    or:
      class: ReproduceAction
    or:
      class: ResolutionAction
    or:
      class: State
    or:
      class: StateAction
    or:
      class: DestroyAction
    or:
      class: AssemblyProcess
    or:
      class: BoundaryDefinitionProcess
    or:
      class: ResponsibilityChangeAction
    or:
      class: AssemblyAction
    or:
      class: ChangeAction
    or:
      class: ReproduceProcess
    or:
      class: PlanAction
    or:
      class: TransportProcess
    or:
      class: HarvestProcess
    or:
      class: DestroyProcess
    or:
      class: InstantiateVirtualHardwareProcess
  path: extension
property:
  class: ExternalRef
  node kind: BlankNodeOrIRI
  path: externalRef
property:
  datatype: string
  max count: 1
  path: name
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  class: ExternalIdentifier
  node kind: BlankNodeOrIRI
  path: externalIdentifier
property:
  datatype: string
  max count: 1
  path: description
property:
  message: https://spdx.org/rdf/3/terms/Core/Element is abstract and must not be instantiated directly.
  not:
    has value: Element
  path: type
property:
  class: CreationInfo
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: creationInfo

Dataset
preferred namespace prefix: spdx-dataset

Agent
type: Class
type: NodeShape
comment: Agent represents anything with the potential to act on a system.
subclass of: Element
note: The Agent class represents anything that has the potential to act on a system. This could be a person, organization, software agent, etc. This is not to be confused with tools that are used to perform tasks.
node kind: IRI

relationshipType
type: ObjectProperty
comment: Information about the relationship between two Elements.
range: RelationshipType
note: This field provides information about the relationship between two Elements. For example, you can represent a relationship between two different Files, between a Package and a File, between two Packages, or between one SpdxDocument and another SpdxDocument.

ExternalIdentifierType
type: Class
comment: Specifies the type of an external identifier.

ExternalRefType
type: Class
comment: The type of external reference.

Security
preferred namespace prefix: spdx-security

SupplyChain
preferred namespace prefix: spdx-supplychain

Software
preferred namespace prefix: spdx-software

RelationshipType
type: Class
comment: Information about the relationship between two Elements.

Core
preferred namespace prefix: spdx-core

class: Element
min count: 1
node kind: IRI
path: to

datatype: dateTimeStamp
max count: 1
path: endTime
pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$

in: affects
in: amendedBy
in: ancestorOf
in: assumes
in: availableFrom
in: configures
in: conformsTo
in: contains
in: coordinatedBy
in: copiedTo
in: createdBy
in: delegatedTo
in: dependsOn
in: descendantOf
in: describes
in: doesNotAffect
in: evaluatedOn
in: expandsTo
in: exploitCreatedBy
in: finetunedOn
in: fixedBy
in: fixedIn
in: follows
in: foundBy
in: generates
in: hasAddedFile
in: hasAssessmentFor
in: hasAssociatedVulnerability
in: hasConcludedLicense
in: hasContactPoint
in: hasDataFile
in: hasDeclaredLicense
in: hasDeletedFile
in: hasDependencyManifest
in: hasDistributionArtifact
in: hasDocumentation
in: hasDynamicLink
in: hasEvidence
in: hasExample
in: hasHost
in: hasInput
in: hasMetadata
in: hasOptionalComponent
in: hasOptionalDependency
in: hasOutput
in: hasPrerequisite
in: hasProvidedDependency
in: hasRequirement
in: hasResolution
in: hasRoleIn
in: hasSpecification
in: hasStaticLink
in: hasTest
in: hasTestCase
in: hasVariant
in: implementedBy
in: invokedBy
in: locatedAt
in: modifiedBy
in: other
in: packagedBy
in: patchedBy
in: performedBy
in: pretrainedOn
in: providesSupportFor
in: publishedBy
in: reportedBy
in: republishedBy
in: resolved
in: runsOn
in: serializedInArtifact
in: testedOn
in: tracedToDetail
in: trainedOn
in: underInvestigationFor
in: usesTool
in: validatedOn
in: verifiedBy
max count: 1
min count: 1

class: Element
max count: 1
min count: 1
node kind: IRI
path: from

datatype: dateTimeStamp
max count: 1
path: startTime
pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$

in: incomplete
in: complete
in: noAssertion
max count: 1
path: completeness

datatype: string
max count: 1
path: summary