This page covers the shapes an integrator actually meets: the entities behind the API and webhook payloads, and the fields on them worth knowing about. It doesn't enumerate the full set of Article 14 report fields — those live in the reporting-field guide on the CRA Single Reporting Platform page, generated directly from the same field definitions the product files from, so it can't drift from what's actually filed.

Workspace

The tenant boundary. Every other entity below belongs to exactly one workspace, and every read and write in the product and API is scoped to it — there's no cross-workspace query path.

• id — stable identifier, used to scope every other request.
• status — active workspaces can transact; a cancelled workspace's API keys stop authenticating.

Product / product version

A product is the thing you manufacture; a version is a specific release of it. Component inventory and SBOMs attach to a version, not to the product as a whole, so different releases can carry different inventories side by side.

• activeSbomId — which uploaded SBOM is currently authoritative for this version's component set. Re-uploading an SBOM to a version replaces its component set and updates this pointer.
• componentCount — a quick health signal on whether a version has an inventory at all.

Component

One entry in a version's inventory, extracted from an uploaded SBOM.

• purl — the package URL used to match this component against advisory feeds. A component without one can't be matched against anything, but is still recorded.
• depth — how many layers of dependency separate this component from the product, read from the SBOM's own graph. See Dependency depth is a hint, not reachability before treating this as more than a hint.

Alert

Raised when a component matches a known vulnerability at Tier A — Declara's own classification, not a CRA or CVSS term, meaning the match is in an active exploitation catalogue or carries a high exploitation-probability score. Tier B and C matches are recorded but don't raise an alert.

• tier — A, B, or C.
• status — open, monitoring, or closed.
• Each alert links to the advisory it matched and the product it was found in.

Case

Opened once triage on an open alert is complete. A case is the object that carries the actual Article 14 reporting obligation through its stages.

• state — one of the states in The reporting clock, explained: open, early_warning_drafting, early_warning_submitted, notification_drafting, notification_submitted, final_drafting, final_submitted, closed, or withdrawn.
• awareAt — when you recorded becoming aware. Every deadline below is computed from this, not from when the case was opened in Declara.
• dueAt per stage — the computed deadline for the stage currently in progress; null until its starting point exists. Because a live workflow run isn't the record of truth for these deadlines, the underlying Submission rows carrying dueAt are recomputed independently by a reconciliation job rather than trusted to stay in sync with anything else.
• srpReference / submittedNote — at least one is required before a stage can be marked submitted.
• withdrawnReason — required if the case's state is withdrawn.

Evidence pack

A generated, hash-chained export of a case's or workspace's audit history.

• Built from the audit log (src/lib/audit.ts), which database-level grants prevent anything from updating or deleting after the fact.
• Carries a verification code that can be checked independently at a public URL, without signing in.

Related

• The reporting clock, explained
• API v1
• Webhook event catalog