engineer

Data model & field glossary

Was this page helpful?

This page covers the shapes an integrator actually meets: the entities behind the API and webhook payloads, and the fields on them worth knowing about. It doesn't enumerate the full set of Article 14 report fields — those live in the reporting-field guide on the CRA Single Reporting Platform page, generated directly from the same field definitions the product files from, so it can't drift from what's actually filed.

Workspace

The tenant boundary. Every other entity below belongs to exactly one workspace, and every read and write in the product and API is scoped to it — there's no cross-workspace query path.

id — stable identifier, used to scope every other request.
status — active workspaces can transact; a cancelled workspace's API keys stop authenticating.

Product / product version

A product is the thing you manufacture; a version is a specific release of it. Component inventory and SBOMs attach to a version, not to the product as a whole, so different releases can carry different inventories side by side.

activeSbomId — which uploaded SBOM is currently authoritative for this version's component set. Re-uploading an SBOM to a version replaces its component set and updates this pointer.
componentCount — a quick health signal on whether a version has an inventory at all.
supportEndDate (version) — an optional end date of its own. When set it wins over the product's; when empty the version follows the product. The daily sweep retires a version past its own end.

Support period determination

One row per determination under Art. 13(8), never edited: the end date, whether it is under five years (isShort), the placed-on-market date it was measured from, the factors answered, the reasoning, who decided and when. The newest row feeds the technical file's section 4.

End-of-support notice

A draft notice to users for a product, or one of its versions: the body, and once sent, the channel, the time and who marked it.

User information record

One row per product holding the edits made to the Annex II items, by item identifier. An entry replaces the suggestion Declara drafts for that item. The drafted document itself is a stored generated document, downloadable as PDF, JSON and CSV.

Market-surveillance request

An authority's request for a product's documentation: the authority, their reference, received and reply-by dates, what was asked, the status (open, sent, closed), the pack generated for it, and when and how it was sent.

Component

One entry in a version's inventory, extracted from an uploaded SBOM.

purl — the package URL used to match this component against advisory feeds. A component without one can't be matched against anything, but is still recorded.
depth — how many layers of dependency separate this component from the product, read from the SBOM's own graph. See Dependency depth is a hint, not reachability before treating this as more than a hint.
supplier — who made the component, as the SBOM states it (CycloneDX supplier, manufacturer or author; SPDX supplier). Empty for components from SBOMs uploaded before it was kept.

Release gate decision

A decision recorded against a product version (Annex I Part I(2)(a)): the result (pass, blocked or acknowledged), the blockers at the time, the reason given when released anyway, and who or which API key decided. The verdict is evaluated again on the server when it is recorded. Kept as made.

Component review

One per workspace and package (Art. 13(5)): the maintenance status, last release, steward, licence, evidence links, note, decision (accepted, accepted_with_conditions, replace), conditions, a snapshot of the facts Declara held, who reviewed and when, and an optional next review day. Saving replaces it; earlier versions stay in the audit chain.

Upstream report

A vulnerability reported to the maintainers of a component (Art. 13(6)): the package, the case, alert or received report it came from, the maintainer contact and where it was found, the day reported, the status (draft, reported, acknowledged, fixed_upstream, declined), the last duplicate check, and whether the fix was shared, with a link. Practice cases are never linked.

Alert

Raised when a component matches a known vulnerability at Tier A — Declara's own classification, not a CRA or CVSS term, meaning the match is in an active exploitation catalogue or carries a high exploitation-probability score. Tier B and C matches are recorded but don't raise an alert.

tier — A, B, or C.
status — open, monitoring, or closed.
Each alert links to the advisory it matched and the product it was found in.

Case

Opened once triage on an open alert is complete. A case is the object that carries the actual Article 14 reporting obligation through its stages.

state — one of the states in The reporting clock, explained: open, early_warning_drafting, early_warning_submitted, notification_drafting, notification_submitted, final_drafting, final_submitted, closed, or withdrawn.
awareAt — when you recorded becoming aware. Every deadline below is computed from this, not from when the case was opened in Declara.
earlyWarningDueAt, notificationDueAt, finalDueAt — the computed deadlines, null until each has its starting point. They are stored on the case and recomputed every day from the case's own inputs by a reconciliation job, which also repairs the reminders.
isDrill — a practice case. Drills are never returned by the API and never delivered to integrations; see Run an Article 14 drill.
withdrawnReason — required if the case's state is withdrawn.

Case stage

One filing in a case: the early warning, the notification or the final report.

form — the answers, keyed by the report fields of the SRP glossary.
srpReference / submittedNote — at least one is required before a stage can be marked submitted. A drill records a note and never a reference.
srpStatus — what the platform says of the filing since, as you recorded it: submitted, valid, invalid or closed, with srpStatusAt and the coordinating CSIRT's csirtNote. See Track a filing.
A submitted stage is never edited; its packet is frozen at filing.

Security advisory

A CSAF 2.0 advisory drafted from a vulnerability case.

trackingId — unique within the workspace, such as ACME-SA-2026-0001.
status — draft or final; revisions lists each publication.
document — the CSAF document as last published, frozen. Only this is ever served publicly or through the API, and only while isPublic is true.

Essential requirements and risk assessment

Per product: a ProductRequirement for each Annex I requirement answered (requirementId such as I.2.e, applicability, statement, evidence) and one RiskAssessment (intended purpose, foreseeable use, operating environment, assets, threats, measures, residual risk). Both are the manufacturer's record; neither carries a verdict.

Cryptographic asset

An algorithm, protocol, certificate or key material a version's SBOM declares, read from the CBOM in a CycloneDX 1.6+ document and kept apart from components.

status — disallowed, legacy, acceptable or unknown, against NIST SP 800-131A and BSI TR-02102 at parse time, with its reason and source.
quantumVulnerable — whether a large quantum computer breaks it; null where that cannot be told.

Modification decision

A product's recorded decision on whether a change was a substantial modification: the factors answered and the indication shown, the outcome (substantial or not_substantial), and the required rationale. Kept as made.

Integration link

Which external record an entity became in an integration — the Jira issue an alert or a case opened — so later events comment on it and a retried delivery does not open a second one.

Trust Center product

One per product (TrustCenterProduct): the public slug (unique within the workspace), isPublished and publishedAt, what the page shows (showClass, showSupport), whether VEX is public (publicVex), the summary, and the declaration of conformity the manufacturer attached: docBlob (an uploaded PDF) or docUrl, with docConfirmedById and docConfirmedAt. The declaration is only ever published once confirmed. The public route exposes a derived id, never the internal product id.

An expiring link to the original SBOMs of a product (SbomShareLink): the recipient, an optional email, the productVersionIds (empty means every supported version), expiresAt (at most 180 days) and revokedAt, a prefix to recognise it in the list, and lastAccessedAt with accessCount. Only the SHA-256 of the secret is stored (tokenHash); the secret is shown once.

One row for each use of a link (SbomShareAccess): at, the action (view, download or refused), the version, the user agent, and a salted hash of the caller's address. The address itself is never stored.

Customer account

A business customer with a contractual notice window (CustomerAccount): name, contacts, noticeWindowHours (1 to 720), noticeOn (vulnerability, incident), an optional contractRef, notes, and archivedAt. An archived customer is not planned for.

Customer product

Links a customer to a product it uses (CustomerProduct). Unique per customer and product.

Customer notice

A contractual notice owed to one customer for one case (CustomerNotice), unique per case and customer. windowHours, basisAt (the case's awareness time) and dueAt are fixed when it is planned. Then the draft body, recipients, and either sentAt with the channel and who sent it, or a skippedReason. lastReminderKind (t_minus_4h, due, overdue) records the last reminder. Not an Article 14 deadline; a drill never has one.

Supplier SBOM request

A manufacturer's request to a supplier for the SBOM of a component (SupplierSbomRequest): the supplierName, supplierEmail, componentLabel, the productIds it goes into, an optional message, and a status of requested, received, expired or revoked. expiresAt is at most 30 days after creation. remindersSent is 0, 1 after the 7-day reminder or 2 after the 14-day one. Only the SHA-256 of the link's secret is stored (tokenHash), with a prefix to recognise it in the list. The supplier's address is kept for the reminders and never written in full to the audit chain.

Supplier component

The component a supplier's SBOM describes (SupplierComponent), made when the file is accepted: the supplierName, the name, the productIds, the request it answers and the SBOM upload holding the file. The upload belongs to no product version; it is scored and kept, and never merged into an inventory or matched.

Integration

A connected external service (Integration) of one kind: slack, teams, webhook, jira or dependency_track. Dependency-Track is not a delivery channel: Declara pulls BOMs from it and never sends it events.

Evidence pack

A generated, hash-chained export of a case's or workspace's audit history.

Built from the audit log (src/lib/audit.ts), which database-level grants prevent anything from updating or deleting after the fact.
scope is case, workspace, supplier_attestation or market_surveillance. A market-surveillance pack belongs to a product (productId) and is a zip; its contentSha256 is the SHA-256 of its manifest.json, and title names the product and the authority.
params holds what a pack fixes when it is requested. For a supplier attestation, that is the answers typed for it and its date. jsonBlob is the attestation's JSON, kept beside the PDF; contentSha256 is the SHA-256 of that JSON. customerAccountId is the customer it was prepared for, kept even if the customer is later removed.
Carries a verification code that can be checked independently at a public URL, without signing in.