Node labels and edges.

BOM document. root document (bomFormat, specVersion, serialNumber, metadata).

• id — Stable Atlas key, e.g. cdx:bom:harborpulse-sbom
• serialNumber — CycloneDX serialNumber URN
• bomType — SBOM | SaaSBOM | HBOM | ML-BOM | CBOM | OBOM | MBOM | VDR | VEX | CDXA
• specVersion — CycloneDX spec version (1.6)
• lifecyclePhase — design | pre-build | build | post-build | operations | discovery
• name — Human title of this BOM

Annotation. annotations[].

• text — Note, review comment, or context

Component. components[] / metadata.component.

• bomRef — Document-scoped bom-ref
• componentType — application | library | framework | firmware | device | container | os | machine-learning-model | cryptographic-asset | file | platform
• name — Component name
• version — Version string
• purl — Package URL when applicable
• scope — required | optional | excluded

Service. services[].

• bomRef — Service bom-ref
• name — Service name
• authenticated — Whether callers must authenticate
• trustBoundary — true if the service sits across a trust boundary

Endpoint. services[].endpoints.

• url — URI of the endpoint

Data classification. services[].data.

• name — PII, credentials, telemetry, …
• flow — inbound | outbound | bi-directional

Cryptographic asset. components[].cryptoProperties.

• assetType — algorithm | protocol | certificate | key | related-crypto-material
• primitive — AES, ECDSA, SHA-2, TLS, …
• oid — Algorithm OID when known

Model card. components[].modelCard.

• approach — Learning approach
• problemType — anomaly-detection, classification, …
• intendedUse — Declared intended use

Dataset. components[type=data] / modelCard.trainingData.

• contentsType — records, images, telemetry, …
• classification — public | internal | confidential

Organization. metadata.supplier / manufacturer / publisher.

• name — Legal or common name
• orgType — manufacturer | supplier | publisher | operator | issuer
• url — Homepage

Person. metadata.authors, annotations.annotator.

• name — Display name
• email — Contact
• role — Author, reviewer, …

Tool. metadata.tools.

• name — Tool name
• vendor — Vendor
• version — Version

License. components[].licenses.

• spdxId — SPDX license identifier
• name — Display name

Vulnerability. vulnerabilities[].

• vulnId — CVE / GHSA identifier
• source — NVD, OSV, …
• cvssScore — Numeric CVSS
• severity — critical | high | medium | low

VEX analysis. vulnerabilities[].analysis.

• state — exploitable | in_triage | not_affected | resolved
• justification — CycloneDX justification code
• response — workaround | update | will_not_fix | can_not_fix

Formula. formulation[].

• name — Named manufacturing/deploy formula

Workflow. formulation[].workflows.

• name — Workflow name

Task. formulation[].workflows[].tasks.

• name — Task name

Configuration. components[].properties / configuration.

• keyName — Config key
• value — Observed or declared value

Standard. definitions.standards.

• name — OWASP SCVS, NIST SSDF, …
• version — Standard version

Requirement. definitions.standards[].requirements.

• identifier — Requirement id inside the standard
• text — Requirement text

Attestation. declarations.attestations.

• summary — What is being attested
• conformance — full | partial | none | unknown

Claim. declarations.claims.

• statement — The claim text

Evidence. declarations.evidence.

• description — How the claim is evidenced

BOM type. Atlas taxonomy (not a CDX class; classifies documents).

• code — Short code used in bomType
• name — Full name
• specFocus — Primary CycloneDX object-model region

Knowledge concept. Atlas extension — ontology overlay on CycloneDX.

• name — Concept name
• category — supply-chain | trust | risk | process | inventory