NoAssertionElement
type: NamedIndividual
type: IndividualElement
comment: An Individual Value for Element representing a set of Elements of unknown identity or cardinality (number).
creation info: creationInfo NoAssertionElement

NoneElement
type: NamedIndividual
type: IndividualElement
comment: An Individual Value for Element representing a set of Elements with cardinality (number/count) of zero.
creation info: creationInfo NoneElement

NoAssertionLicense
type: NamedIndividual
type: IndividualLicensingInfo
comment: An Individual Value for License when no assertion can be made about its actual value.
creation info: creationInfo NoAssertionLicense

NoneLicense
type: NamedIndividual
type: IndividualLicensingInfo
comment: An Individual Value for License where the SPDX data creator determines that no license is present.
creation info: creationInfo NoneLicense

CdxPropertiesExtension
type: Class
type: NodeShape
comment: A type of extension consisting of a list of name value pairs.
subclass of: Extension
node kind: BlankNodeOrIRI
property:
  class: CdxPropertyEntry
  min count: 1
  node kind: BlankNodeOrIRI
  path: cdxProperty

mass
type: DatatypeProperty
comment: Information related to physical hardware.
range: decimal

exportControlClassificationResult
type: DatatypeProperty
comment: Provides the result of an export control assessment.
range: ExportControlClassification

creationInfo NoAssertionElement
type: CreationInfo
comment: This individual element was defined by the spec.
created: 2026-01-23T03:01:00Z
created by: SpdxOrganization
spec version: 3.1

creationInfo NoAssertionLicense
type: CreationInfo
comment: This individual element was defined by the spec.
created: 2026-01-23T03:01:00Z
created by: SpdxOrganization
spec version: 3.1

creationInfo NoneElement
type: CreationInfo
comment: This individual element was defined by the spec.
created: 2026-01-23T03:01:00Z
created by: SpdxOrganization
spec version: 3.1

creationInfo NoneLicense
type: CreationInfo
comment: This individual element was defined by the spec.
created: 2026-01-23T03:01:00Z
created by: SpdxOrganization
spec version: 3.1

creationInfo SpdxOrganization
type: CreationInfo
comment: This individual element was defined by the spec.
created: 2026-01-23T03:01:00Z
created by: SpdxOrganization
spec version: 3.1

System Package Data Exchange™ (SPDX®) Ontology
type: Ontology
abstract: This ontology defines the terms and relationships used in the SPDX specification to describe system packages
created: 2026-01-23
creator: SPDX Project
license: Community-Spec-1.0.html
references: specifications
title: System Package Data Exchange (SPDX) Ontology
copyright: Copyright (C) 2026 SPDX Project

AIPackage
type: Class
type: NodeShape
comment: A Package that contains AI software or an AI model.
subclass of: Package
node kind: IRI
property:
  class: SafetyRiskAssessmentType
  in: serious
  in: high
  in: medium
  in: low
  max count: 1
  node kind: IRI
  path: safetyRiskAssessment
property:
  datatype: string
  node kind: Literal
  path: modelDataPreprocessing
property:
  datatype: string
  node kind: Literal
  path: typeOfModel
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: informationAboutApplication
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: informationAboutTraining
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: limitation
property:
  class: PresenceType
  in: yes
  in: no
  in: noAssertion
  max count: 1
  node kind: IRI
  path: useSensitivePersonalInformation
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metricDecisionThreshold
property:
  class: IsoAutomationLevel
  in: autonomous
  in: fullAutomation
  in: highAutomation
  in: conditionalAutomation
  in: partialAutomation
  in: assistiveAutomation
  in: notAutomated
  max count: 1
  node kind: IRI
  path: isoAutomationLevel
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metric
property:
  class: PresenceType
  in: yes
  in: no
  in: noAssertion
  max count: 1
  node kind: IRI
  path: autonomyType
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: hyperparameter
property:
  class: EnergyConsumption
  max count: 1
  node kind: BlankNodeOrIRI
  path: energyConsumption
property:
  datatype: string
  node kind: Literal
  path: standardCompliance
property:
  datatype: string
  node kind: Literal
  path: modelExplainability
property:
  datatype: string
  node kind: Literal
  path: domain

kilowattHour
type: NamedIndividual
type: EnergyUnitType
comment: Kilowatt-hour.

megajoule
type: NamedIndividual
type: EnergyUnitType
comment: Megajoule.

other
type: NamedIndividual
type: EnergyUnitType
comment: Any other units of energy measurement.

high
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The second-highest level of risk posed by an AI system.

low
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: Low/no risk is posed by an AI system.

medium
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The third-highest level of risk posed by an AI system.

serious
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The highest level of risk posed by an AI system.

autonomyType
type: ObjectProperty
comment: **DEPRECATED in SPDX 3.1.** Use [/Core/isoAutomationLevel](../../Core/Properties/isoAutomationLevel.md) instead. Indicates whether the system can perform a decision or action without human involvement or guidance.
range: PresenceType

domain
type: DatatypeProperty
comment: Domain in which the AI package can be used.
range: string

energyConsumption
type: ObjectProperty
comment: Energy consumption incurred by an AI model.
range: EnergyConsumption

energyQuantity
type: DatatypeProperty
comment: Energy quantity.
range: decimal

energyUnit
type: ObjectProperty
comment: Unit in which energy is measured.
range: EnergyUnitType

finetuningEnergyConsumption
type: ObjectProperty
comment: Energy consumed when finetuning the AI model that is being used in the AI system.
range: EnergyConsumptionDescription

hyperparameter
type: ObjectProperty
comment: Hyperparameter used to build the AI model contained in the AI package.
range: DictionaryEntry

inferenceEnergyConsumption
type: ObjectProperty
comment: Energy consumed during inference time by an AI model that is being used in the AI system.
range: EnergyConsumptionDescription

informationAboutApplication
type: DatatypeProperty
comment: Information about the AI software, not including the model description.
range: string

informationAboutTraining
type: DatatypeProperty
comment: Information about different steps of the training process.
range: string

limitation
type: DatatypeProperty
comment: Limitation of the AI software.
range: string

metric
type: ObjectProperty
comment: Metric used to evaluate the AI model.
range: DictionaryEntry

metricDecisionThreshold
type: ObjectProperty
comment: Threshold that was used for computation of a metric described in the metric field.
range: DictionaryEntry

modelDataPreprocessing
type: DatatypeProperty
comment: Preprocessing steps applied to the training data before the model training.
range: string

modelExplainability
type: DatatypeProperty
comment: Methods that can be used to explain the results from the AI model.
range: string

safetyRiskAssessment
type: ObjectProperty
comment: Results of general safety risk assessment of the AI system.
range: SafetyRiskAssessmentType

standardCompliance
type: DatatypeProperty
comment: Standard that an artifact is being complied with.
range: string

trainingEnergyConsumption
type: ObjectProperty
comment: Energy consumed when training the AI model that is being used in the AI system.
range: EnergyConsumptionDescription

typeOfModel
type: DatatypeProperty
comment: Type of the model used in the AI software.
range: string

useSensitivePersonalInformation
type: ObjectProperty
comment: Records if sensitive personal information is used during model training or could be used during the inference.
range: PresenceType

Build
type: Class
type: NodeShape
comment: Class that describes a build instance of software/artifacts.
subclass of: Element
node kind: IRI
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: parameter
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: environment
property:
  datatype: string
  node kind: Literal
  path: configSourceEntrypoint
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: buildId
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: buildType
property:
  datatype: anyURI
  node kind: Literal
  path: configSourceUri
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: buildStartTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Hash
  node kind: BlankNodeOrIRI
  path: configSourceDigest
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: buildEndTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

buildEndTime
type: DatatypeProperty
comment: Property that describes the time at which a build stops.
range: dateTimeStamp

buildId
type: DatatypeProperty
comment: A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
range: string

buildStartTime
type: DatatypeProperty
comment: Property describing the start time of a build.
range: dateTimeStamp

buildType
type: DatatypeProperty
comment: A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
range: anyURI

configSourceDigest
type: ObjectProperty
comment: Property that describes the digest of the build configuration file used to invoke a build.
range: Hash

configSourceEntrypoint
type: DatatypeProperty
comment: Property describes the invocation entrypoint of a build.
range: string

configSourceUri
type: DatatypeProperty
comment: Property that describes the URI of the build configuration source file.
range: anyURI

environment
type: ObjectProperty
comment: Property describing the session in which a build is invoked.
range: DictionaryEntry

parameter
type: ObjectProperty
comment: Property describing a parameter used in an instance of a build.
range: DictionaryEntry

Annotation
type: Class
type: NodeShape
comment: An assertion made in relation to one or more elements.
subclass of: Element
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: statement
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$
property:
  class: AnnotationType
  in: other
  in: review
  max count: 1
  min count: 1
  node kind: IRI
  path: annotationType
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: subject

other
type: NamedIndividual
type: AnnotationType
comment: Used to store extra information about an Element which is not part of a review (e.g. extra information provided during the creation of the Element).

review
type: NamedIndividual
type: AnnotationType
comment: Used when someone reviews the Element.

ContactPointRelationship
type: Class
type: NodeShape
comment: A contact point from an Artifact to an Agent.
subclass of: Relationship
node kind: IRI
property:
  class: ContactPointRelationshipType
  in: compliance
  in: other
  in: securityVulnerability
  in: support
  max count: 1
  min count: 1
  node kind: IRI
  path: contactType

compliance
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact point for compliance (i.e. export control, licensing).

other
type: NamedIndividual
type: ContactPointRelationshipType
comment: A generic contact point to be used when the contact type does not match any of the other options.

securityVulnerability
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact for reporting security vulnerabilities.

support
type: NamedIndividual
type: ContactPointRelationshipType
comment: A contact point for support.

cpe22
type: NamedIndividual
type: ExternalIdentifierType
comment: [Common Platform Enumeration Specification 2.2](https://cpe.mitre.org/files/cpe-specification_2.2.pdf).

cpe23
type: NamedIndividual
type: ExternalIdentifierType
comment: [Common Platform Enumeration: Naming Specification Version 2.3](https://csrc.nist.gov/publications/detail/nistir/7695/final).

cve
type: NamedIndividual
type: ExternalIdentifierType
comment: Common Vulnerabilities and Exposures identifiers, an identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the [CVE specification](https://csrc.nist.gov/glossary/term/cve_id).

duns
type: NamedIndividual
type: ExternalIdentifierType
comment: [Data Universal Numbering System (D-U-N-S) Number](https://www.dnb.com/en-us/smb/duns.html) is a unique nine-digit identifier, issued by Dun & Bradstreet, that identifies a business entity, often on a location-specific basis.

email
type: NamedIndividual
type: ExternalIdentifierType
comment: Email address, as defined in [RFC 3696](https://datatracker.ietf.org/doc/rfc3696/) Section 3.

evidenceUUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The UUID used by a reporting management system or any other lifecycle management tool to uniquely identify an evidence relationship item. UUID, or universally unique ID, is a standard term to refer to evidence items.

gitoid
type: NamedIndividual
type: ExternalIdentifierType
comment: [Gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid), stands for [Git Object ID](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects). A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an [Artifact Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types) for the software artifact or an [Input Manifest Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier) for the software artifact's associated [Artifact Input Manifest](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest); this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See [OmniBOR Specification](https://github.com/omnibor/spec/), a minimalistic specification for describing software [Artifact Dependency Graphs](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg).

gln
type: NamedIndividual
type: ExternalIdentifierType
comment: [Global Location Number (GLN)](https://www.gs1.org/standards/id-keys/gln) is a 13-digit number, assigned by GS1, that uniquely identifies a legal entity (e.g., a company or customer), a function within a legal entity, a physical location (e.g., a warehouse or a specific shelf in a store), or a digital location (e.g., an Electronic Data Interchange (EDI) gateway).

glue
type: NamedIndividual
type: ExternalIdentifierType
comment: [GLobal Unique Enterprise (GLUE) Identifiers](https://datatracker.ietf.org/doc/draft-ietf-spice-glue-id/), as defined by the IETF Internet-Draft, is expressed as a GLUE URI, a Uniform Resource Identifier that standardizes the representation of existing organizational entity identifiers.

gtin
type: NamedIndividual
type: ExternalIdentifierType
comment: [Global Trade Item Number (GTIN)](https://www.gs1.org/standards/id-keys/gtin) is a number, assigned by GS1, that uniquely identifies a trade item (product or service).

hsCodes
type: NamedIndividual
type: ExternalIdentifierType
comment: The [Harmonized System (HS)](https://www.wcoomd.org/en/topics/nomenclature/overview/what-is-the-harmonized-system.aspx) of tariff nomenclature is an internationally standardized system of names and numbers, defined by the World Customs Organization, used to classify traded products.

lei
type: NamedIndividual
type: ExternalIdentifierType
comment: The [Legal Entity Identifier (LEI)](https://www.gleif.org/en/organizational-identity/introducing-the-legal-entity-identifier-lei) is a 20-character, alphanumeric code based on the [ISO 17442](https://www.iso.org/standard/78829.html) standard developed by the International Organization for Standardization.

other
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when the type does not match any of the other options.

packageUrl
type: NamedIndividual
type: ExternalIdentifierType
comment: Package URL, as defined in the corresponding [Annex](../../../annexes/pkg-url-specification.md) of this document.

phoneNumber
type: NamedIndividual
type: ExternalIdentifierType
comment: Phone number; A string of decimal digits that uniquely indicates the network termination point defined in [RFC 3966](https://datatracker.ietf.org/doc/rfc3966/) Section 5.

requirementUUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The UUID used by a requirements management or any other lifecycle management tool to uniquely identify a requirement item. UUID, or universally unique ID, is a standard term in requirements engineering.

securityOther
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when there is a security related identifier of unspecified type.

swhid
type: NamedIndividual
type: ExternalIdentifierType
comment: SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the [SWHID specification](https://www.swhid.org/swhid-specification/v1.2/) ([ISO/IEC 18670](https://www.iso.org/standard/89985.html)). They typically look like `swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2`.

swid
type: NamedIndividual
type: ExternalIdentifierType
comment: Concise Software Identification (CoSWID) tag, as defined in [RFC 9393](https://datatracker.ietf.org/doc/rfc9393/) Section 2.3.

urlScheme
type: NamedIndividual
type: ExternalIdentifierType
comment: [Uniform Resource Identifier (URI) Schemes](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml). The scheme used in order to locate a resource.

verificationUUID
type: NamedIndividual
type: ExternalIdentifierType
comment: The UUID used by a verification management system or any other lifecycle management tool to uniquely identify a verification item. UUID, or universally unique ID, is a standard term to refer to verification items.

webpage
type: NamedIndividual
type: ExternalIdentifierType
comment: Absolute URL that can be used to locate a resource, as defined in [RFC 7230](https://datatracker.ietf.org/doc/rfc7230/) Section 2.7.1 or Section 2.7.2.

altDownloadLocation
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative download location.

altWebPage
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative web page.

binaryArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to binary artifacts related to a package.

bower
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Bower package. The package locator format, looks like `package#version`, is defined in the "install" section of [Bower API documentation](https://bower.io/docs/api/#install).

buildMeta
type: NamedIndividual
type: ExternalRefType
comment: A reference build metadata related to a published package.

buildSystem
type: NamedIndividual
type: ExternalRefType
comment: A reference build system used to create or publish the package.

certificationReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a certification report for a package from an accredited/independent body.

chat
type: NamedIndividual
type: ExternalRefType
comment: A reference to the instant messaging system used by the maintainer for a package.

componentAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Software Composition Analysis (SCA) report.

cwe
type: NamedIndividual
type: ExternalRefType
comment: [Common Weakness Enumeration](https://csrc.nist.gov/glossary/term/common_weakness_enumeration). A reference to a source of software flaw defined within the official [CWE List](https://cwe.mitre.org/data/) that conforms to the [CWE specification](https://cwe.mitre.org/).

documentation
type: NamedIndividual
type: ExternalRefType
comment: A reference to the documentation for a package.

dynamicAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a dynamic analysis report for a package.

eolNotice
type: NamedIndividual
type: ExternalRefType
comment: A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.

exportControlAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to an export control assessment for a package.

funding
type: NamedIndividual
type: ExternalRefType
comment: A reference to funding information related to a package.

issueTracker
type: NamedIndividual
type: ExternalRefType
comment: A reference to the issue tracker for a package.

license
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional license information related to an artifact.

mailingList
type: NamedIndividual
type: ExternalRefType
comment: A reference to the mailing list used by the maintainer for a package.

mavenCentral
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Maven repository artifact. The artifact locator format is defined in the [Maven documentation](https://maven.apache.org/guides/mini/guide-naming-conventions.html) and looks like `groupId:artifactId[:version]`.

metrics
type: NamedIndividual
type: ExternalRefType
comment: A reference to metrics related to package such as OpenSSF scorecards.

npm
type: NamedIndividual
type: ExternalRefType
comment: A reference to an npm package. The package locator format is defined in the [npm documentation](https://docs.npmjs.com/cli/v10/configuring-npm/package-json) and looks like `package@version`.

nuget
type: NamedIndividual
type: ExternalRefType
comment: A reference to a NuGet package. The package locator format is defined in the [NuGet documentation](https://docs.nuget.org) and looks like `package/version`.

other
type: NamedIndividual
type: ExternalRefType
comment: Used when the type does not match any of the other options.

privacyAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a privacy assessment for a package.

productMetadata
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional product metadata such as reference within organization's product catalog.

purchaseOrder
type: NamedIndividual
type: ExternalRefType
comment: A reference to a purchase order for a package.

qualityAssessmentReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a quality assessment for a package.

releaseHistory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published list of releases for a package.

releaseNotes
type: NamedIndividual
type: ExternalRefType
comment: A reference to the release notes for a package.

riskAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a risk assessment for a package.

runtimeAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a runtime analysis report for a package.

secureSoftwareAttestation
type: NamedIndividual
type: ExternalRefType
comment: A reference to information assuring that the software is developed using security practices as defined by [NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1](https://csrc.nist.gov/pubs/sp/800/218/final) or [CISA Secure Software Development Attestation Form](https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form).

securityAdversaryModel
type: NamedIndividual
type: ExternalRefType
comment: A reference to the security adversary model for a package.

securityAdvisory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published security advisory (where advisory as defined per [ISO 29147:2018](https://www.iso.org/standard/72311.html)) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.

securityFix
type: NamedIndividual
type: ExternalRefType
comment: A reference to the patch or source code that fixes a vulnerability.

securityOther
type: NamedIndividual
type: ExternalRefType
comment: A reference to related security information of unspecified type.

securityPenTestReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a [penetration test](https://en.wikipedia.org/wiki/Penetration_test) report for a package.

securityPolicy
type: NamedIndividual
type: ExternalRefType
comment: A reference to instructions for reporting newly discovered security vulnerabilities for a package.

securityThreatModel
type: NamedIndividual
type: ExternalRefType
comment: A reference the [security threat model](https://en.wikipedia.org/wiki/Threat_model) for a package.

socialMedia
type: NamedIndividual
type: ExternalRefType
comment: A reference to a social media channel for a package.

sourceArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to an artifact containing the sources for a package.

staticAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a static analysis report for a package.

support
type: NamedIndividual
type: ExternalRefType
comment: A reference to the software support channel or other support information for a package.

vcs
type: NamedIndividual
type: ExternalRefType
comment: A reference to a version control system related to a software artifact.

vulnerabilityDisclosureReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in [NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/161/r1/final).

vulnerabilityExploitabilityAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also [NTIA VEX one-page summary](https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf).

x509Cert
type: NamedIndividual
type: ExternalRefType
comment: A reference to an X.509 certificate as defined in [RFC 1422](https://datatracker.ietf.org/doc/rfc1422/). The media type shall be one of application/x-x509-ca-cert or application/x-x509-user-cert.

assistiveAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 1 - Assistive automation. The system assists an operator.

autonomous
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 6 - Autonomous. The system is capable of modifying its intended domain of use or its goals without external intervention, control or oversight.

conditionalAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 3 - Conditional automation. The system can propose strategies and then automatically execute the approved plan, with an external agent being ready to take over when necessary.

fullAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 5 - Full automation. The system is capable of performing its entire mission without external intervention.

highAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 4 - High automation. The system performs parts of its mission without external intervention.

notAutomated
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 0 - Not automated. No automation. The operator fully controls the system.

partialAutomation
type: NamedIndividual
type: IsoAutomationLevel
comment: Level 2 - Partial automation or task automation. Some sub-functions of the system are fully automated while the system remain under control of an external agent. The system can perform actions for an approved task without requiring the agent's continuous direct control.

LifecycleScopedRelationship
type: Class
type: NodeShape
comment: Provide context for a relationship that occurs in the lifecycle.
subclass of: Relationship
node kind: IRI
property:
  class: LifecycleScopeType
  in: design
  in: development
  in: build
  in: test
  in: runtime
  in: decommission
  in: update
  in: other
  max count: 1
  node kind: IRI
  path: scope

PackageVerificationCode
type: Class
type: NodeShape
comment: An SPDX version 2.X compatible verification method for software packages.
subclass of: IntegrityMethod
node kind: BlankNodeOrIRI
property:
  datatype: string
  node kind: Literal
  path: packageVerificationCodeExcludedFile
property:
  class: HashAlgorithm
  in: adler32
  in: blake2b256
  in: blake2b384
  in: blake2b512
  in: blake3
  in: crystalsDilithium
  in: crystalsKyber
  in: falcon
  in: md2
  in: md4
  in: md5
  in: md6
  in: other
  in: sha1
  in: sha224
  in: sha256
  in: sha384
  in: sha512
  in: sha3_224
  in: sha3_256
  in: sha3_384
  in: sha3_512
  max count: 1
  min count: 1
  node kind: IRI
  path: algorithm
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: hashValue

Person
type: Class
comment: An individual human being.
subclass of: Agent
node kind: IRI

PhysicalLocation
type: Class
type: NodeShape
comment: A physical location is a tangible, geographically identifiable place where objects, people, or assets exist or operate.
subclass of: Location
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: city
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: countyCode
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: postalName
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: provinceStateCode
property:
  datatype: string
  node kind: Literal
  path: geographicPointLocation
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: country
  pattern: ^[A-Z]{3}$
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: postOfficeBoxNumber
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: streetAddress
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: postalCode

active
type: NamedIndividual
type: ProcessReadinessType
comment: in use

draft
type: NamedIndividual
type: ProcessReadinessType
comment: in production

obsolete
type: NamedIndividual
type: ProcessReadinessType
comment: superseded or not valid at present

other
type: NamedIndividual
type: ProcessReadinessType
comment: other

ai
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the AI profile specification.

build
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Build profile specification.

core
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Core profile specification.

dataset
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Dataset profile specification.

expandedLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the ExpandedLicensing profile specification.

extension
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Extension profile specification.

hardware
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Hardware profile specification.

lite
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Lite profile specification.

security
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Security profile specification.

simpleLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the SimpleLicensing profile specification.

software
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the Software profile specification.

supplyChain
type: NamedIndividual
type: ProfileIdentifierType
comment: The element follows the SupplyChain profile specification.

Regulation
type: Class
comment: Regulation represents a rule or directive maintained by an authority.
subclass of: Specification
node kind: IRI

complete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known to be exhaustive.

incomplete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known not to be exhaustive.

noAssertion
type: NamedIndividual
type: RelationshipCompleteness
comment: No assertion can be made about the completeness of the relationship.

affects
type: NamedIndividual
type: RelationshipType
comment: The `from` Vulnerability, Action or DefinedProcess affects each `to` Element.

amendedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is amended by each `to` Element.

ancestorOf
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is an ancestor of each `to` Element.

availableFrom
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is available from the additional supplier described by each `to` Element.

configures
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is a configuration applied to each `to` Element, during a LifecycleScopeType period.

conformsTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Element conforms to each `to` Specification.

contains
type: NamedIndividual
type: RelationshipType
comment: The `from` Element contains each `to` Element.

coordinatedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Vulnerability is coordinatedBy the `to` Agent(s) (vendor, researcher, or consumer agent).

copiedTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been copied to each `to` Element.

createdBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element's Action or DefinedProcess is createdBy `to` Agent(s).

delegatedTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Agent is delegating an action to the Agent of the `to` Relationship (which shall be of type invokedBy), during a LifecycleScopeType (e.g. the `to` invokedBy Relationship is being done on behalf of `from`).

dependsOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element depends on each `to` Element, during a LifecycleScopeType period.

descendantOf
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is a descendant of each `to` Element.

describes
type: NamedIndividual
type: RelationshipType
comment: The `from` Element describes each `to` Element. To denote the root(s) of a tree of elements in a collection, the rootElement property shall be used.

doesNotAffect
type: NamedIndividual
type: RelationshipType
comment: The `from` Vulnerability has no impact on each `to` Element. The use of the `doesNotAffect` is constrained to `VexNotAffectedVulnAssessmentRelationship` classed relationships.

evaluatedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been evaluated on the `to` Element(s).

expandsTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Element expands out as an artifact described by each `to` Element.

exploitCreatedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Vulnerability has had an exploit created against it by each `to` Agent.

finetunedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been finetuned on the `to` Element(s).

fixedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a `from` Vulnerability has been fixed by the `to` Agent(s).

fixedIn
type: NamedIndividual
type: RelationshipType
comment: A `from` Vulnerability has been fixed in each `to` Element. The use of the `fixedIn` type is constrained to `VexFixedVulnAssessmentRelationship` classed relationships.

follows
type: NamedIndividual
type: RelationshipType
comment: The `to` Element succeeds the `from` Element, establishing a unidirectional sequence. This succession is defined as chronological, procedural, or logical. It is used to represent either a temporal order (e.g., in a workflow) or a logical order for processing and traversal (e.g., in an ordered list).

foundBy
type: NamedIndividual
type: RelationshipType
comment: Designates a `from` Vulnerability was originally discovered by the `to` Agent(s).

generates
type: NamedIndividual
type: RelationshipType
comment: The `from` Element generates each `to` Element.

hasAddedFile
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a file added to the `from` Element (`from` hasAddedFile `to`).

hasAssessmentFor
type: NamedIndividual
type: RelationshipType
comment: Relates a `from` Vulnerability and each `to` Element with a security assessment. To be used with `VulnAssessmentRelationship` types.

hasAssociatedVulnerability
type: NamedIndividual
type: RelationshipType
comment: Used to associate a `from` Artifact with each `to` Vulnerability.

hasConcludedLicense
type: NamedIndividual
type: RelationshipType
comment: The `from` SoftwareArtifact is concluded by the SPDX data creator to be governed by each `to` AnyLicenseInfo.

hasContactPoint
type: NamedIndividual
type: RelationshipType
comment: The `from` Artifact has each `to` Agent as a contact point. The use of `hasContactPoint` type is constrained to `ContactPointRelationship` typed relationships. The type of contact (i.e. security) may be specified using a `ContactPointRelationship` element.

hasDataFile
type: NamedIndividual
type: RelationshipType
comment: The `from` Element treats each `to` Element as a data file. A data file is an artifact that stores data required or optional for the `from` Element's functionality. A data file can be a database file, an index file, a log file, an AI model file, a calibration data file, a temporary file, a backup file, and more. For AI training dataset, test dataset, test artifact, configuration data, build input data, and build output data, please consider using the more specific relationship types: `trainedOn`, `testedOn`, `hasTest`, `configures`, `hasInput`, and `hasOutput`, respectively. This relationship does not imply dependency.

hasDeclaredLicense
type: NamedIndividual
type: RelationshipType
comment: The `from` SoftwareArtifact was discovered to actually contain each `to` AnyLicenseInfo (for example, as detected by automated tooling).

hasDeletedFile
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a file deleted from the `from` Element (`from` hasDeletedFile `to`).

hasDependencyManifest
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has manifest files that contain dependency information in each `to` Element.

hasDistributionArtifact
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is distributed as an artifact in each `to` Element (e.g. an RPM or archive file).

hasDocumentation
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is documented by each `to` Element.

hasDynamicLink
type: NamedIndividual
type: RelationshipType
comment: The `from` Element dynamically links in each `to` Element, during a LifecycleScopeType period.

hasEvidence
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is considered as evidence for the `from` Element (`from` hasEvidence `to`).

hasExample
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is an example for the `from` Element (`from` hasExample `to`).

hasHost
type: NamedIndividual
type: RelationshipType
comment: The `from` Build was run on the `to` Element during a LifecycleScopeType period (e.g. the host that the build runs on).

hasInput
type: NamedIndividual
type: RelationshipType
comment: The `from` Build, DefinedProcess or Action element has each `to` Element as an input.

hasMetadata
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is metadata about the `from` Element (`from` hasMetadata `to`).

hasOptionalComponent
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is an optional component of the `from` Element (`from` hasOptionalComponent `to`).

hasOptionalDependency
type: NamedIndividual
type: RelationshipType
comment: The `from` Element optionally depends on each `to` Element, during a LifecycleScopeType period.

hasOutput
type: NamedIndividual
type: RelationshipType
comment: The `from` Build, DefinedProcess or Action element generates each `to` Element as an output.

hasPrerequisite
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a prerequisite on each `to` Element, during a LifecycleScopeType period.

hasProvidedDependency
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a dependency on each `to` Element, dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period.

hasRequirement
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a requirement on each `to` Element, during a LifecycleScopeType period.

hasResolution
type: NamedIndividual
type: RelationshipType
comment: The `from` ResolutionAction point to the `to` OutOfSpecAction that is addressed.

hasSpecification
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a specification for the `from` Element (`from` hasSpecification `to`), during a LifecycleScopeType period.

hasStaticLink
type: NamedIndividual
type: RelationshipType
comment: The `from` Element statically links in each `to` Element, during a LifecycleScopeType period.

hasTest
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a test artifact for the `from` Element (`from` hasTest `to`), during a LifecycleScopeType period.

hasTestCase
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a test case for the `from` Element (`from` hasTestCase `to`).

hasVariant
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a variant the `from` Element (`from` hasVariant `to`).

implementedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Requirement is implemented in the `to` Element(s).

invokedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element was invoked by the `to` Agent, during a LifecycleScopeType period (for example, a Build element that describes a build step).

locatedAt
type: NamedIndividual
type: RelationshipType
comment: `from` element located at a specific `to` location. A time period is optional.

modifiedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is modified by each `to` Element.

other
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is related to the `from` Element where the relationship type is not described by any of the SPDX relationship types (this relationship is directionless).

packagedBy
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a packaged instance of the `from` Element (`from` packagedBy `to`).

patchedBy
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a patch for the `from` Element (`from` patchedBy `to`).

performedBy
type: NamedIndividual
type: RelationshipType
comment: Every `from` action is performedBy `to` Agent.

pretrainedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been pretrained on the `to` Element(s).

providesSupportFor
type: NamedIndividual
type: RelationshipType
comment: The `from` Agent provides support for each `to` Artifact. Shall be a `SupportRelationship` type.

publishedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a `from` Vulnerability was made available for public use or reference by each `to` Agent.

reportedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a `from` Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each `to` Agent.

republishedBy
type: NamedIndividual
type: RelationshipType
comment: Designates a `from` Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by each `to` Agent.

resolved
type: NamedIndividual
type: RelationshipType
comment: The `to` OutOfSpecAction is resolved in the `from` ResolutionAction.

runsOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element (the instructions) of runs on each `to` Hardware (processing element), during a LifecycleScopeType period.

serializedInArtifact
type: NamedIndividual
type: RelationshipType
comment: The `from` SpdxDocument can be found in a serialized form in each `to` Artifact.

testedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been tested on the `to` Element(s).

tracedToDetail
type: NamedIndividual
type: RelationshipType
comment: the `from` Requirement is refined and further elaborated by each `to` Requirement, which contains more detailed implementation information.

trainedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been trained on the `to` Element(s).

underInvestigationFor
type: NamedIndividual
type: RelationshipType
comment: The `from` Vulnerability impact is being investigated for each `to` Element. The use of the `underInvestigationFor` type is constrained to `VexUnderInvestigationVulnAssessmentRelationship` classed relationships.

usesTool
type: NamedIndividual
type: RelationshipType
comment: The `from` Element uses each `to` Element as a tool, during a LifecycleScopeType period.

validatedOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been validated on the `to` Element(s).

verifiedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Requirement that has verification (test, review, analysis etc.) details defined in the `to` RequirementVerification.

Requirement
type: Class
type: NodeShape
comment: A distinct unit representing a requirement, as used in systems, software, and hardware engineering.
subclass of: Element
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: requirementStatement
property:
  class: LifecycleScopeType
  in: design
  in: development
  in: build
  in: test
  in: runtime
  in: decommission
  in: update
  in: other
  node kind: IRI
  path: devLifecycleStage
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: requirementUUID
property:
  datatype: string
  node kind: Literal
  path: requirementRationale

SoftwareAgent
type: Class
comment: A software agent.
subclass of: Agent
node kind: IRI

SpdxDocument
type: Class
type: NodeShape
comment: A collection of SPDX Elements that could potentially be serialized.
subclass of: ElementCollection
node kind: IRI
property:
  class: AnyLicenseInfo
  max count: 1
  node kind: IRI
  path: dataLicense
property:
  class: NamespaceMap
  node kind: BlankNodeOrIRI
  path: namespaceMap
property:
  class: ExternalMap
  node kind: BlankNodeOrIRI
  path: import

formalStandard
type: NamedIndividual
type: SpecificationType
comment: A formal standard is a standard ratified by a recognized standards-development organization and published as a normative reference.

other
type: NamedIndividual
type: SpecificationType
comment: Any specification that does not fall under any of the other entries.

regulation
type: NamedIndividual
type: SpecificationType
comment: A mandatory legal specification issued by a governmental or regulatory authority. Compliance is enforceable by law.

specification
type: NamedIndividual
type: SpecificationType
comment: A specification is a detailed document (or set of documents) that describes the requirements, design, behavior, or other characteristics of a system, component, or process so that all stakeholders have a clear, unambiguous reference.

SupportRelationship
type: Class
type: NodeShape
comment: Describes how an Agent provides support for an Artifact.
subclass of: Relationship
node kind: IRI
property:
  class: SupportType
  in: development
  in: support
  in: deployed
  in: limitedSupport
  in: endOfSupport
  in: noSupport
  in: noAssertion
  max count: 1
  min count: 1
  node kind: IRI
  path: supportLevel

actionEndTime
type: DatatypeProperty
comment: Property that describes the time at which an action stops.
range: dateTimeStamp

actionLocation
type: ObjectProperty
comment: Location of a specific action.
range: Location

actionStartTime
type: DatatypeProperty
comment: Property describing the start time of an action.
range: dateTimeStamp

additionalInformation
type: ObjectProperty
comment: Additional relevance information.
range: DictionaryEntry

annotationType
type: ObjectProperty
comment: Describes the type of annotation.
range: AnnotationType

beginIntegerRange
type: DatatypeProperty
comment: Defines the beginning of a range.
range: positiveInteger

builtTime
type: DatatypeProperty
comment: Specifies the time an artifact was built.
range: dateTimeStamp

city
type: DatatypeProperty
comment: City is a specific name used to define a locality.
range: string

completeness
type: ObjectProperty
comment: Provides information about the completeness of relationships.
range: RelationshipCompleteness

contactType
type: ObjectProperty
comment: Identifies the nature of the contactPointRelationship.
range: ContactPointRelationshipType

context
type: DatatypeProperty
comment: Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
range: string

country
type: DatatypeProperty
comment: Specifies a country code of the location.
range: string

countyCode
type: DatatypeProperty
comment: A code that identifies a county.
range: string

created
type: DatatypeProperty
comment: Identifies when the Element was originally created.
range: dateTimeStamp

createdBy
type: ObjectProperty
comment: Identifies who or what created the Element.
range: Agent

createdUsing
type: ObjectProperty
comment: Identifies the tooling that was used during the creation of the Element.
range: Tool

creationInfo
type: ObjectProperty
comment: Provides information about the creation of the Element.
range: CreationInfo

dataLicense
type: ObjectProperty
comment: Provides the license under which the SPDX documentation of the Element can be used.
range: AnyLicenseInfo

definingArtifact
type: ObjectProperty
comment: Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
range: Artifact

definitionSource
type: ObjectProperty
comment: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization.
range: Specification

description
type: DatatypeProperty
comment: Provides a detailed description of the Element.
range: string

devLifecycleStage
type: DatatypeProperty
comment: The product lifecycle phase, the requirement is applicable for.
range: LifecycleScopeType

element
type: ObjectProperty
comment: Refers to one or more Elements that are part of an ElementCollection.
range: Element

elementValue
type: ObjectProperty
comment: A value used in a key-value pair with a generic key that refers to an Element
range: Element

endIntegerRange
type: DatatypeProperty
comment: Defines the end of a range.
range: positiveInteger

endTime
type: DatatypeProperty
comment: Specifies the time from which an element is no longer applicable / valid.
range: dateTimeStamp

externalIdentifier
type: ObjectProperty
comment: Provides a reference to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.
range: ExternalIdentifier

externalIdentifierType
type: ObjectProperty
comment: Specifies the type of the external identifier.
range: ExternalIdentifierType

externalRef
type: ObjectProperty
comment: Points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.
range: ExternalRef

externalRefType
type: ObjectProperty
comment: Specifies the type of the external reference.
range: ExternalRefType

externalSpdxId
type: DatatypeProperty
comment: Identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.
range: anyURI

from
type: ObjectProperty
comment: References the Element on the left-hand side of a relationship.
range: Element

geographicPointLocation
type: DatatypeProperty
comment: This is a set of point coordinates as defined in by the GPS standard.
range: string

headquartersLocation
type: ObjectProperty
comment: The headquartersLocation defines the location of the organization's headquarters.
range: Location

identifier
type: DatatypeProperty
comment: Uniquely identifies an external element.
range: string

identifierLocator
type: DatatypeProperty
comment: Provides the location for more information regarding an external identifier.
range: anyURI

import
type: ObjectProperty
comment: Provides an ExternalMap of Element identifiers.
range: ExternalMap

inLanguage
type: DatatypeProperty
comment: Specifies a human language used within the content of an Element or a property.
range: string

intendedUse
type: DatatypeProperty
comment: The intendedUse property is designed to capture a summary of how or for what item or artifact is meant to be used for.
range: string

isoAutomationLevel
type: ObjectProperty
comment: ISO level of automation.
range: IsoAutomationLevel

issuingAuthority
type: DatatypeProperty
comment: An entity that is authorized to issue identification credentials.
range: string

locationHint
type: DatatypeProperty
comment: Provides an indication of where to retrieve an external Element.
range: anyURI

locationTime
type: DatatypeProperty
comment: A known location is specified at this time.
range: dateTimeStamp

locator
type: DatatypeProperty
comment: Provides the location of an external reference.
range: string

name
type: DatatypeProperty
comment: Identifies the name of an Element as designated by the creator.
range: string

namespace
type: DatatypeProperty
comment: Provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.
range: anyURI

namespaceMap
type: ObjectProperty
comment: Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
range: NamespaceMap

originatedBy
type: ObjectProperty
comment: Identifies from where or whom the Element originally came.
range: Agent

packageVerificationCodeExcludedFile
type: DatatypeProperty
comment: The relative file name of a file to be excluded from the `PackageVerificationCode`.
range: string

postOfficeBoxNumber
type: DatatypeProperty
comment: The number that identifies a PO box. A PO box is a box in a post office or other postal service location assigned to an organization where postal items may be kept.
range: string

postalCode
type: DatatypeProperty
comment: Text specifying the postal code for an address.
range: string

postalName
type: DatatypeProperty
comment: The name of the recipient expressed in text.
range: string

prefix
type: DatatypeProperty
comment: A substitute for a URI.
range: string

processRationale
type: DatatypeProperty
comment: The reason a process exists.
range: string

processReadiness
type: DatatypeProperty
comment: processReadiness describes the readiness of a process.
range: ProcessReadinessType

processVersion
type: DatatypeProperty
comment: Defines the version of a specific process.
range: string

profileConformance
type: ObjectProperty
comment: Describes one a profile which the creator of this ElementCollection intends to conform to.
range: ProfileIdentifierType

provinceStateCode
type: DatatypeProperty
comment: Text specifying a province or state.
range: string

quantity
type: DatatypeProperty
comment: Quantity is the amount in the selected QUDT unit.
range: string

relationshipType
type: ObjectProperty
comment: Information about the relationship between two Elements.
range: RelationshipType

releaseTime
type: DatatypeProperty
comment: Specifies the time an artifact was released.
range: dateTimeStamp

requirementRationale
type: DatatypeProperty
comment: Text used to define the rationale or additional information.
range: string

requirementStatement
type: DatatypeProperty
comment: A text describing the actual need defined by the requirement.
range: string

requirementUUID
type: DatatypeProperty
comment: Provides a universally unique Requirement ID.
range: ExternalIdentifier

rootElement
type: ObjectProperty
comment: This property is used to denote the root Element(s) of a tree of elements contained in a BOM.
range: Element

scope
type: ObjectProperty
comment: Capture the scope of information about a specific relationship between elements.
range: LifecycleScopeType

specType
type: DatatypeProperty
comment: A specification type defines the nature of a specification.
range: SpecificationType

specVersion
type: DatatypeProperty
comment: Provides a reference number that can be used to understand how to parse and interpret an Element.
range: string

standardName
type: DatatypeProperty
comment: The name of a relevant standard that may apply to an artifact.
range: string

startTime
type: DatatypeProperty
comment: Specifies the time from which an element is applicable / valid.
range: dateTimeStamp

statement
type: DatatypeProperty
comment: Commentary on an assertion that an annotator has made.
range: string

streetAddress
type: DatatypeProperty
comment: Street address includes a street number, name and unit ID to identify a specific street.
range: string

subject
type: ObjectProperty
comment: An Element an annotator has made an assertion about.
range: Element

summary
type: DatatypeProperty
comment: A short description of an Element.
range: string

to
type: ObjectProperty
comment: References an Element on the right-hand side of a relationship.
range: Element

typeFromSource
type: DatatypeProperty
comment: typeFromSource is a value used to define an item within the definitionSource.
range: string

unitQUDT
type: DatatypeProperty
comment: QUDT unit is used for measurement criteria based on product type, region and use.
range: string

validUntilTime
type: DatatypeProperty
comment: Specifies until when the artifact can be used before its usage needs to be reassessed.
range: dateTimeStamp

value
type: DatatypeProperty
comment: A value used in a generic key-value pair.
range: string

amber
type: NamedIndividual
type: ConfidentialityLevelType
comment: Data points in the dataset can be shared only with specific organizations and their clients on a need to know basis.

clear
type: NamedIndividual
type: ConfidentialityLevelType
comment: Dataset may be distributed freely, without restriction.

green
type: NamedIndividual
type: ConfidentialityLevelType
comment: Dataset can be shared within a community of peers and partners.

red
type: NamedIndividual
type: ConfidentialityLevelType
comment: Data points in the dataset are highly confidential and can only be shared with named recipients.

clickthrough
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.

directDownload
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is publicly available and can be downloaded directly.

query
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.

registration
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.

scrapingScript
type: NamedIndividual
type: DatasetAvailabilityType
comment: Dataset provider is not making available the underlying data and the dataset shall be reassembled, typically using the provided script for scraping the data.

DatasetPackage
type: Class
type: NodeShape
comment: A Package that contains a dataset.
subclass of: Package
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: datasetUpdateMechanism
property:
  datatype: string
  node kind: Literal
  path: dataPreprocessing
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: intendedUse
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: sensor
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: dataCollectionProcess
property:
  datatype: string
  node kind: Literal
  path: inLanguage
  pattern: ^[a-zA-Z]{2,8}(-[a-zA-Z0-9]{1,8})*$
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: datasetNoise
property:
  class: DatasetAvailabilityType
  in: clickthrough
  in: directDownload
  in: query
  in: registration
  in: scrapingScript
  max count: 1
  node kind: IRI
  path: datasetAvailability
property:
  class: DatasetType
  in: audio
  in: categorical
  in: graph
  in: image
  in: noAssertion
  in: numeric
  in: other
  in: sensor
  in: structured
  in: syntactic
  in: text
  in: timeseries
  in: timestamp
  in: video
  min count: 1
  node kind: IRI
  path: datasetType
property:
  datatype: string
  node kind: Literal
  path: knownBias
property:
  class: ConfidentialityLevelType
  in: red
  in: amber
  in: green
  in: clear
  max count: 1
  node kind: IRI
  path: confidentialityLevel
property:
  class: PresenceType
  in: yes
  in: no
  in: noAssertion
  max count: 1
  node kind: IRI
  path: hasSensitivePersonalInformation
property:
  datatype: nonNegativeInteger
  max count: 1
  node kind: Literal
  path: datasetSize
property:
  datatype: string
  node kind: Literal
  path: anonymizationMethodUsed

audio
type: NamedIndividual
type: DatasetType
comment: Data is audio based, such as a collection of music from the 80s.

categorical
type: NamedIndividual
type: DatasetType
comment: Data that is classified into a discrete number of categories, such as the eye color of a population of people.

graph
type: NamedIndividual
type: DatasetType
comment: Data is in the form of a graph where entries are somehow related to each other through edges, such a social network of friends.

image
type: NamedIndividual
type: DatasetType
comment: Data is a collection of images such as pictures of animals.

noAssertion
type: NamedIndividual
type: DatasetType
comment: Data type is not known.

numeric
type: NamedIndividual
type: DatasetType
comment: Data consists only of numeric entries.

other
type: NamedIndividual
type: DatasetType
comment: Data is of a type not included in this list.

sensor
type: NamedIndividual
type: DatasetType
comment: Data is recorded from a physical sensor, such as a thermometer reading or biometric device.

structured
type: NamedIndividual
type: DatasetType
comment: Data is stored in tabular format or retrieved from a relational database.

syntactic
type: NamedIndividual
type: DatasetType
comment: Data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.

text
type: NamedIndividual
type: DatasetType
comment: Data consists of unstructured text, such as a book, a Wikipedia article (without images), or a transcript.

timeseries
type: NamedIndividual
type: DatasetType
comment: Data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.

timestamp
type: NamedIndividual
type: DatasetType
comment: Data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.

video
type: NamedIndividual
type: DatasetType
comment: Data is video based, such as a collection of movie clips featuring Tom Hanks.

anonymizationMethodUsed
type: DatatypeProperty
comment: Anonymization methods used.
range: string

confidentialityLevel
type: ObjectProperty
comment: Confidentiality level of the data points contained in the dataset.
range: ConfidentialityLevelType

dataCollectionProcess
type: DatatypeProperty
comment: How the dataset was collected.
range: string

dataPreprocessing
type: DatatypeProperty
comment: Preprocessing steps that were applied to the raw data to create the given dataset.
range: string

datasetAvailability
type: ObjectProperty
comment: Availability of a dataset.
range: DatasetAvailabilityType

datasetNoise
type: DatatypeProperty
comment: Potentially noisy elements of the dataset.
range: string

datasetSize
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use [/Software/artifactSize](../../Software/Properties/artifactSize.md) instead. Size of the dataset.
range: nonNegativeInteger

datasetType
type: ObjectProperty
comment: Type of data in a dataset.
range: DatasetType

datasetUpdateMechanism
type: DatatypeProperty
comment: Mechanism to update the dataset.
range: string

hasSensitivePersonalInformation
type: ObjectProperty
comment: Describes if any sensitive personal information is present in the dataset.
range: PresenceType

intendedUse
type: DatatypeProperty
comment: **DEPRECATED in SPDX 3.1.** Use [/Core/intendedUse](../../Core/Properties/intendedUse.md) instead. The intended use of a given dataset.
range: string

knownBias
type: DatatypeProperty
comment: Records the biases that the dataset is known to encompass.
range: string

sensor
type: ObjectProperty
comment: Describes a sensor used for collecting the data.
range: DictionaryEntry

ConjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
subclass of: AnyLicenseInfo
node kind: IRI
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: IRI
  path: member

CustomLicense
type: Class
comment: A license that is not listed on the SPDX License List.
subclass of: License
node kind: IRI

CustomLicenseAddition
type: Class
comment: A license addition that is not listed on the SPDX Exceptions List.
subclass of: LicenseAddition
node kind: IRI

DisjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
subclass of: AnyLicenseInfo
node kind: IRI
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: IRI
  path: member

ListedLicense
type: Class
type: NodeShape
comment: A license that is listed on the SPDX License List.
subclass of: License
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: deprecatedVersion
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: listVersionAdded

ListedLicenseException
type: Class
type: NodeShape
comment: A license exception that is listed on the SPDX Exceptions list.
subclass of: LicenseAddition
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: deprecatedVersion
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: listVersionAdded

OrLaterOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
subclass of: ExtendableLicense
node kind: IRI
property:
  class: License
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectLicense

WithAdditionOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
subclass of: AnyLicenseInfo
node kind: IRI
property:
  class: LicenseAddition
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectAddition
property:
  class: ExtendableLicense
  max count: 1
  min count: 1
  node kind: IRI
  path: subjectExtendableLicense

additionText
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition.
range: string

isDeprecatedAdditionId
type: DatatypeProperty
comment: Specifies whether an additional text identifier has been marked as deprecated.
range: boolean

isDeprecatedLicenseId
type: DatatypeProperty
comment: Specifies whether a license or additional text identifier has been marked as deprecated.
range: boolean

isFsfLibre
type: DatatypeProperty
comment: Specifies whether the License is listed as free by the Free Software Foundation (FSF).
range: boolean

isOsiApproved
type: DatatypeProperty
comment: Specifies whether the License is listed as approved by the Open Source Initiative (OSI).
range: boolean

standardAdditionTemplate
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition, in SPDX templating format.
range: string

standardLicenseHeader
type: DatatypeProperty
comment: Provides a License author's preferred text to indicate that a file is covered by the License.
range: string

standardLicenseTemplate
type: DatatypeProperty
comment: Identifies the full text of a License, in SPDX templating format.
range: string

subjectAddition
type: ObjectProperty
comment: A LicenseAddition participating in a 'with addition' model.
range: LicenseAddition

subjectExtendableLicense
type: ObjectProperty
comment: A License participating in a 'with addition' model.
range: ExtendableLicense

subjectLicense
type: ObjectProperty
comment: A License participating in an 'or later' model.
range: License

cdxPropName
type: DatatypeProperty
comment: A name used in a CdxPropertyEntry name-value pair.
range: string

cdxPropValue
type: DatatypeProperty
comment: A value used in a CdxPropertyEntry name-value pair.
range: string

cdxProperty
type: ObjectProperty
comment: Provides a map of a property name to a value.
range: CdxPropertyEntry

EvaluationResult
type: Class
type: NodeShape
comment: EvaluationResult is the result of an evaluation.
subclass of: Element
node kind: IRI
property:
  class: RequirementVerification
  max count: 1
  min count: 1
  node kind: IRI
  path: evaluationBasedOn
property:
  class: EvaluationResultType
  in: pass
  in: fail
  in: inconclusive
  max count: 1
  min count: 1
  node kind: IRI
  path: evaluation
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: evaluationRationale

fail
type: NamedIndividual
type: EvaluationResultType
comment: Indicates a failed evaluation where the requirement or condition is not met.

inconclusive
type: NamedIndividual
type: EvaluationResultType
comment: Inconclusive refers to a result or outcome from a verification, test, or analysis that cannot be clearly classified as either positive (successful, pass) or negative (failed, reject). An inconclusive result means there was not enough clear evidence, data, or signal to make a definitive determination, and further investigation or additional testing is necessary. An inconclusive result always shall need a comment on it.

pass
type: NamedIndividual
type: EvaluationResultType
comment: Indicates a successful evaluation where the requirement or condition is clearly met.

EvidenceRelationship
type: Class
type: NodeShape
comment: EvidenceRelationship defines the association between pieces of evidence and EvaluationResult.
subclass of: Relationship
node kind: IRI
property:
  class: EvidenceType
  in: report
  in: log
  in: recording
  in: observation
  in: other
  node kind: IRI
  path: evidenceCategory
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: evidenceUUID

log
type: NamedIndividual
type: EvidenceType
comment: Time-stamped records capturing system or operational data recorded as usually as a response to specific triggers in a specified environment.

observation
type: NamedIndividual
type: EvidenceType
comment: Documentation of direct monitoring or witnessing of the demonstration of processes, tests, or any kind of system responses during a specified timeframe under specified environmental conditions.

other
type: NamedIndividual
type: EvidenceType
comment: Any other relevant type of proof or documentation not covered above.

recording
type: NamedIndividual
type: EvidenceType
comment: Captured datastream like audio, video, or any other kind of continuous electronic capture of events, behavior or conditions.

report
type: NamedIndividual
type: EvidenceType
comment: Structured documentation of test results, inspections, or analyses.

analysis
type: NamedIndividual
type: VerificationType
comment: Analytical evaluating of data, designs, or processes methodically to verify correctness against standards or expectations. Typical analysis methods are FMEA, FTA, STPA, static analysis for MISRA compliance etc.

assessment
type: NamedIndividual
type: VerificationType
comment: A systematic examination of a system, process, or outcome to evaluate compliance of specific work products with a specific expectation with a specification, regulation or standard. Often involves judgement and a rationale of this judgement.

audit
type: NamedIndividual
type: VerificationType
comment: An examination typically focusing on compliance with policies, standards, or regulations. Usually this is done during an audit meeting, while the assessment also involves deep and detailed reviews of work products (e.g. requirements, verification specifications, reports etc.)

demonstration
type: NamedIndividual
type: VerificationType
comment: Demonstrating and monitoring or recording that the item under verification to confirm that a requirement is met by the item under verification.

inspection
type: NamedIndividual
type: VerificationType
comment: A thorough examination or checking of documentation, records, processes, or systems to confirm compliance or adherence. An inspection needs to have a defined set of acceptance criteria (e.g. a checklist), a documentation of roles involved in the inspection (e.g. to document the inspector's independence) and a clear documentation of when and how it was performed.

other
type: NamedIndividual
type: VerificationType
comment: Any other specialized or custom verification method that fits the context.

review
type: NamedIndividual
type: VerificationType
comment: A examination or checking of documentation, records, processes, or systems to confirm compliance or adherence with an upper level requirement. Typically done as peer review, offline review or review meeting.

test
type: NamedIndividual
type: VerificationType
comment: Conducting controlled tests, experiments or simulations to verify that specific requirements regarding performance, functionality, robustness, etc. are met.

evaluation
type: DatatypeProperty
comment: Evaluation is an outcome considering results of a verification.
range: EvaluationResultType

evaluationBasedOn
type: ObjectProperty
comment: Indicates the specific RequirementVerification instance on which the EvaluationResult is based.
range: RequirementVerification

evaluationRationale
type: DatatypeProperty
comment: Detailed explanation or reasoning that supports the EvaluationResult.
range: string

evidenceCategory
type: ObjectProperty
comment: evidenceCategory refers to a category of documented or observable proof.
range: EvidenceType

evidenceUUID
type: ObjectProperty
comment: A evidenceUUID is a universally unique identifier (UUID) assigned to an entity, item, or requirement.
range: ExternalIdentifier

verificationMethod
type: DatatypeProperty
comment: verificationMethod refers to the specific approach used for a checking an element's conformance with its requirements.
range: VerificationType

verificationPostcondition
type: DatatypeProperty
comment: Verification postcondition that are true immediately after a verification method has been performed
range: string

verificationPrecondition
type: DatatypeProperty
comment: Verification preconditions are initial criteria that are to be met prior to initiating the verification method.
range: string

verificationRationale
type: DatatypeProperty
comment: A verificationRationale is supporting information that justifies the verification details.
range: string

verificationUUID
type: ObjectProperty
comment: A verificationUUID is a universally unique identifier (UUID) assigned to a Verification item.
range: ExternalIdentifier

BulkHardware
type: Class
type: NodeShape
comment: Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk.
subclass of: Hardware
node kind: IRI
property:
  class: UnitOfMeasure
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: bulkQuantity

PhysicalHardware
type: Class
type: NodeShape
comment: Class that describes a physical instance of Hardware.
subclass of: Hardware
node kind: IRI
property:
  class: Dimensions
  max count: 1
  node kind: BlankNodeOrIRI
  path: dimensions
property:
  class: Dimensions
  max count: 1
  node kind: BlankNodeOrIRI
  path: centerOfMass
property:
  class: MeasureOfMass
  max count: 1
  node kind: BlankNodeOrIRI
  path: massOfHardware

ProductSpecification
type: Class
type: NodeShape
comment: A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product.
subclass of: Specification
node kind: IRI
property:
  datatype: string
  min count: 1
  node kind: Literal
  path: partNumber
property:
  datatype: string
  node kind: Literal
  path: itemVersion
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: hazard

VirtualHardware
type: Class
type: NodeShape
comment: Class that describes an instance of VirtualHardware.
subclass of: Hardware
node kind: IRI
property:
  class: VirtualHardwareModelType
  in: function
  in: cycle
  in: other
  max count: 1
  node kind: IRI
  path: virtualHardwareModel

cycle
type: NamedIndividual
type: VirtualHardwareModelType
comment: Simulation architectures with precise cycle-level accuracy.

function
type: NamedIndividual
type: VirtualHardwareModelType
comment: Simulation the function of the hardware.

other
type: NamedIndividual
type: VirtualHardwareModelType
comment: All other simulation types.

additionalInformation
type: ObjectProperty
comment: Additional relevance information.
range: DictionaryEntry

additionalInformationSpecification
type: ObjectProperty
comment: It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization.
range: Specification

batchNumber
type: DatatypeProperty
comment: Identifier for product production batch.
range: string

bulkQuantity
type: ObjectProperty
comment: The amount or measure of a bulk product.
range: UnitOfMeasure

category
type: ObjectProperty
comment: The category describes the hardware item in a DefinedType.
range: DefinedType

centerOfMass
type: ObjectProperty
comment: A point representing the mean position of the matter in a body or system.
range: Dimensions

dimensions
type: ObjectProperty
comment: Information related to hardware dimension.
range: Dimensions

hardwareVersion
type: DatatypeProperty
comment: Version identifier for the hardware product.
range: string

itemVersion
type: DatatypeProperty
comment: Version identifier for the item.
range: string

massOfHardware
type: DatatypeProperty
comment: Information related to massOfHardware physical hardware.
range: MeasureOfMass

productAgent
type: ObjectProperty
comment: The Agent who is responsible for product branding such as an OEM.
range: Agent

releaseDate
type: ObjectProperty
comment: Date of product release.
range: dateTimeStamp

serialNumber
type: DatatypeProperty
comment: Identifier for specific product is called a serial number.
range: string

virtualHardwareModel
type: DatatypeProperty
comment: Information related to virtual hardware simulation.
range: VirtualHardwareModelType

xAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength

yAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength

zAxisLength
type: ObjectProperty
comment: Information related to hardware dimension.
range: MeasureOfLength

ExportControlClassificationAssessment
type: Class
type: NodeShape
comment: Assement of an Element for export control classification.
subclass of: Artifact
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: assessmentTimestamp
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: ExportControlClassification
  min count: 1
  node kind: BlankNodeOrIRI
  path: assessmentResult
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: assessor
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: assessedElement
property:
  class: Project
  max count: 1
  node kind: IRI
  path: assessmentContext

assessedElement
type: DatatypeProperty
comment: Specifies an Element as subject of an assessment.
range: Element

assessmentContext
type: DatatypeProperty
comment: Sets the context for an assessment iby specifying the related project.
range: Project

assessmentResult
type: DatatypeProperty
comment: Specifies an Element as subject of an assessment.
range: ExportControlClassification

assessmentTimestamp
type: DatatypeProperty
comment: Timestamp, when an assessment was conducted.
range: dateTimeStamp

assessor
type: DatatypeProperty
comment: An entity providing an assessment.
range: Agent

exportClassification
type: DatatypeProperty
comment: Expression for the export control classification.
range: string

exportControlSpecification
type: DatatypeProperty
comment: Specification basis for the export control classification.
range: Specification

exportingCountry
type: DatatypeProperty
comment: Country for which export controls must be taken into account.
range: string

projectContract
type: DatatypeProperty
comment: Link to the project contract.
range: anyURI

projectEndTime
type: DatatypeProperty
comment: Time when the project ends or is planned to end.
range: dateTimeStamp

projectOwner
type: DatatypeProperty
comment: Owner or Lead of the project.
range: Agent

projectSponsor
type: DatatypeProperty
comment: Sponsor of the project.
range: Agent

projectStartTime
type: DatatypeProperty
comment: Time when the project starts or is planned to start.
range: dateTimeStamp

projectTitle
type: DatatypeProperty
comment: Title of the project.
range: string

weight
type: ObjectProperty
comment: Weight to express relevance in de minimis consideration.
range: positiveInteger

CvssV2VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 2.0 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score

CvssV3VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 3 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score
property:
  class: CvssSeverityType
  in: critical
  in: high
  in: medium
  in: low
  in: none
  max count: 1
  min count: 1
  node kind: IRI
  path: severity
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString

CvssV4VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 4 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score
property:
  class: CvssSeverityType
  in: critical
  in: high
  in: medium
  in: low
  in: none
  max count: 1
  min count: 1
  node kind: IRI
  path: severity

EpssVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an EPSS assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: percentile
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: probability

kev
type: NamedIndividual
type: ExploitCatalogType
comment: CISA's Known Exploited Vulnerability (KEV) catalog.

other
type: NamedIndividual
type: ExploitCatalogType
comment: Other exploit catalogs.

ExploitCatalogVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an exploit assessment of a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  class: ExploitCatalogType
  in: kev
  in: other
  max count: 1
  min count: 1
  node kind: IRI
  path: catalogType
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: locator
property:
  datatype: boolean
  max count: 1
  min count: 1
  node kind: Literal
  path: exploited

act
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.

attend
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.

track
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.

trackStar
type: NamedIndividual
type: SsvcDecisionType
comment: ("Track\*" in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track\* vulnerabilities within standard update timelines.

SsvcVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an SSVC assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  class: SsvcDecisionType
  in: act
  in: attend
  in: track
  in: trackStar
  max count: 1
  min count: 1
  node kind: IRI
  path: decisionType

VexAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: actionStatement
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: actionStatementTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

VexFixedVulnAssessmentRelationship
type: Class
comment: Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
subclass of: VexVulnAssessmentRelationship
node kind: IRI

componentNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The software is not affected because the vulnerable component is not in the product.

inlineMitigationsAlreadyExist
type: NamedIndividual
type: VexJustificationType
comment: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.

vulnerableCodeCannotBeControlledByAdversary
type: NamedIndividual
type: VexJustificationType
comment: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.

vulnerableCodeNotInExecutePath
type: NamedIndividual
type: VexJustificationType
comment: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.

vulnerableCodeNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The product is not affected because the code underlying the vulnerability is not present in the product.

VexNotAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: impactStatement
property:
  class: VexJustificationType
  in: componentNotPresent
  in: vulnerableCodeNotPresent
  in: vulnerableCodeCannotBeControlledByAdversary
  in: vulnerableCodeNotInExecutePath
  in: inlineMitigationsAlreadyExist
  max count: 1
  node kind: IRI
  path: justificationType
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: impactStatementTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

VexUnderInvestigationVulnAssessmentRelationship
type: Class
comment: Designates elements as products where the impact of a vulnerability is being investigated.
subclass of: VexVulnAssessmentRelationship
node kind: IRI

Vulnerability
type: Class
type: NodeShape
comment: Specifies a vulnerability and its associated information.
subclass of: Artifact
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: withdrawnTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: publishedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: modifiedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

actionStatement
type: DatatypeProperty
comment: Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
range: string

actionStatementTime
type: DatatypeProperty
comment: Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
range: dateTimeStamp

assessedElement
type: ObjectProperty
comment: Specifies an Element contained in a piece of software where a vulnerability was found.
range: SoftwareArtifact

catalogType
type: ObjectProperty
comment: Specifies the exploit catalog type.
range: ExploitCatalogType

decisionType
type: ObjectProperty
comment: Provide the enumeration of possible decisions in the [Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree](https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc).
range: SsvcDecisionType

exploited
type: DatatypeProperty
comment: Denote whether a CVE is present in an exploit catalog.
range: boolean

impactStatement
type: DatatypeProperty
comment: Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
range: string

impactStatementTime
type: DatatypeProperty
comment: Timestamp of impact statement.
range: dateTimeStamp

justificationType
type: ObjectProperty
comment: Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
range: VexJustificationType

locator
type: DatatypeProperty
comment: Provides the location of an exploit catalog.
range: anyURI

percentile
type: DatatypeProperty
comment: The percentile of the current probability score.
range: decimal

probability
type: DatatypeProperty
comment: A probability score between 0 and 1 of a vulnerability being exploited.
range: decimal

statusNotes
type: DatatypeProperty
comment: Conveys information about how VEX status was determined.
range: string

vexVersion
type: DatatypeProperty
comment: Specifies the version of a VEX statement.
range: string

crl
type: NamedIndividual
type: AuthenticationProtocolType
comment: Certificate Revocation List, or CRL, is a list of revoked certificates that is downloaded from the Certificate Authority (CA).

ocsp
type: NamedIndividual
type: AuthenticationProtocolType
comment: Online Certificate Status Protocol, or OCSP, is a common scheme used to maintain the security of a server and other network resources.

other
type: NamedIndividual
type: AuthenticationProtocolType
comment: An authentication protocol not covered by one of the other AuthenticationProtocolTypes.

tls
type: NamedIndividual
type: AuthenticationProtocolType
comment: Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.

SoftwareService
type: Class
type: NodeShape
comment: Software provided as a service over a network.
subclass of: Element
node kind: IRI
property:
  class: AuthenticationProtocolType
  in: tls
  in: ocsp
  in: crl
  in: other
  node kind: IRI
  path: serverAuthenticationProtocol
property:
  class: Agent
  min count: 1
  node kind: IRI
  path: provider
property:
  datatype: string
  node kind: Literal
  path: serviceHostingCountry
  pattern: ^[A-Z]{3}$

provider
type: ObjectProperty
comment: The provider of a SoftwareService.
range: Agent

serverAuthenticationProtocol
type: ObjectProperty
comment: Authentication protocol used by a server.
range: AuthenticationProtocolType

serviceHostingCountry
type: DatatypeProperty
comment: Specifies a country code where a software service is hosted.
range: string

LicenseExpression
type: Class
type: NodeShape
comment: An SPDX Element containing an SPDX license expression string.
subclass of: AnyLicenseInfo
node kind: IRI
property:
  class: ElementMap
  node kind: BlankNodeOrIRI
  path: customIdToLicense
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseExpression
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: customIdToUri
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseListVersion
  pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$

SimpleLicensingText
type: Class
type: NodeShape
comment: A license or addition that is not listed on the SPDX License List.
subclass of: Element
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseText

customIdToLicense
type: ObjectProperty
comment: Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to a `CustomLicense`, a `CustomLicenseAddition`, or a `SimpleLicensingText`.
range: ElementMap

customIdToUri
type: ObjectProperty
comment: **DEPRECATED in SPDX 3.1.** Use [customIdToLicense](./customIdToLicense.md) instead. Maps a LicenseRef or AdditionRef string for a Custom License or a Custom License Addition to its URI ID. **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use [customIdToLicense](./customIdToLicense.md) instead.
range: DictionaryEntry

licenseExpression
type: DatatypeProperty
comment: A string in the license expression format.
range: string

licenseListVersion
type: DatatypeProperty
comment: The version of the SPDX License List used in the license expression.
range: string

gitoid
type: NamedIndividual
type: ContentIdentifierType
comment: [Gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid), stands for [Git Object ID](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects). A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an [Artifact Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types) for the software artifact or an [Input Manifest Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier) for the software artifact's associated [Artifact Input Manifest](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest); this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See [OmniBOR Specification](https://github.com/omnibor/spec/), a minimalistic specification for describing software [Artifact Dependency Graphs](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg).

swhid
type: NamedIndividual
type: ContentIdentifierType
comment: SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the [SWHID specification](https://www.swhid.org/swhid-specification/v1.2/) ([ISO/IEC 18670](https://www.iso.org/standard/89985.html)). They typically look like `swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2`.

directory
type: NamedIndividual
type: FileKindType
comment: The file represents a directory and all content stored in that directory.

file
type: NamedIndividual
type: FileKindType
comment: The file represents a single file (default).

Sbom
type: Class
type: NodeShape
comment: A collection of SPDX Elements describing a single package.
subclass of: Bom
node kind: IRI
property:
  class: SbomType
  in: design
  in: source
  in: build
  in: deployed
  in: runtime
  in: analyzed
  node kind: IRI
  path: sbomType

analyzed
type: NamedIndividual
type: SbomType
comment: SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a "3rd party" SBOM.

build
type: NamedIndividual
type: SbomType
comment: SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.

deployed
type: NamedIndividual
type: SbomType
comment: SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.

design
type: NamedIndividual
type: SbomType
comment: SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.

runtime
type: NamedIndividual
type: SbomType
comment: SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an "Instrumented" or "Dynamic" SBOM.

source
type: NamedIndividual
type: SbomType
comment: SBOM created directly from the development environment, source files, and included dependencies used to build a product artifact.

Snippet
type: Class
type: NodeShape
comment: Describes a certain part of a file.
subclass of: SoftwareArtifact
node kind: IRI
property:
  class: File
  max count: 1
  min count: 1
  node kind: IRI
  path: snippetFromFile
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: lineRange
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: byteRange

additionalPurpose
type: ObjectProperty
comment: Provides additional purpose information of the software artifact.
range: SoftwarePurpose

artifactSize
type: DatatypeProperty
comment: Identifies the size of a software Artifact, in bytes.
range: nonNegativeInteger

attributionText
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
range: string

byteRange
type: DatatypeProperty
comment: Defines the byte range in the original host file that the snippet information applies to.
range: PositiveIntegerRange

contentIdentifier
type: DatatypeProperty
comment: A canonical, unique, immutable identifier of the artifact content, that may be used for verifying its identity and/or integrity.
range: ContentIdentifier

contentIdentifierType
type: ObjectProperty
comment: Specifies the type of the content identifier.
range: ContentIdentifierType

contentIdentifierValue
type: DatatypeProperty
comment: Specifies the value of the content identifier.
range: anyURI

copyrightText
type: DatatypeProperty
comment: Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
range: string

downloadLocation
type: DatatypeProperty
comment: Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
range: anyURI

fileKind
type: ObjectProperty
comment: Describes if a given file is a directory or non-directory kind of file.
range: FileKindType

homePage
type: DatatypeProperty
comment: A place for the SPDX document creator to record a website that serves as the package's home page.
range: anyURI

lineRange
type: DatatypeProperty
comment: Defines the line range in the original host file that the snippet information applies to.
range: PositiveIntegerRange

packageUrl
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record the package URL string (in accordance with the Package URL specification) for a software Package.
range: anyURI

packageVersion
type: DatatypeProperty
comment: Identify the version of a package.
range: string

primaryPurpose
type: ObjectProperty
comment: Provides information about the primary purpose of the software artifact.
range: SoftwarePurpose

sbomType
type: ObjectProperty
comment: Provides information about the type of an SBOM.
range: SbomType

snippetFromFile
type: ObjectProperty
comment: Defines the original host file that the snippet information applies to.
range: File

sourceInfo
type: DatatypeProperty
comment: Records any relevant background information or additional comments about the origin of the package.
range: string

AssemblyAction
type: Class
comment: AssemblyAction represents the event of creating a product by assembling individual components.
subclass of: CreateAction
node kind: IRI

AssemblyProcess
type: Class
comment: The AssemblyProcess represents the process of creating a product by assembling a set of components, potentially in a way that allows for at disassembly (at least partially).
subclass of: CreateProcess
node kind: IRI

BoundaryCrossingAction
type: Class
comment: An action of crossing a boundary is defined in this class.
subclass of: UseAction
node kind: IRI

BoundaryDefinitionAction
type: Class
type: NodeShape
comment: The boundary definition is used to define boundaries.
subclass of: Action
node kind: IRI
property:
  class: DictionaryEntry
  min count: 1
  node kind: BlankNodeOrIRI
  path: boundaryParameter

BoundaryDefinitionProcess
type: Class
comment: The Boundary Definition Process refers to the process class used to produce boundaries.
subclass of: DefinedProcess
node kind: IRI

ChangeAction
type: Class
comment: An actual change to a product.
subclass of: ModifyAction
node kind: IRI

ChangeProcess
type: Class
comment: A prescribed change to a product.
subclass of: ModifyProcess
node kind: IRI

DestroyAction
type: Class
type: NodeShape
comment: The record of destruction is entered in this action.
subclass of: Action
node kind: IRI
property:
  class: Agent
  min count: 1
  node kind: IRI
  path: destructionPerformedBy

DestroyProcess
type: Class
comment: The destruction process is defined in this process.
subclass of: DefinedProcess
node kind: IRI

HarvestAction
type: Class
comment: HarvestAction represents the act of creating a product by directly extracting goods or materials from nature.
subclass of: CreateAction
node kind: IRI

HarvestProcess
type: Class
comment: Harvest is the process of extracting goods or products from nature.
subclass of: CreateProcess
node kind: IRI

InspectionAction
type: Class
comment: An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system.
subclass of: UseAction
node kind: IRI

InspectionProcess
type: Class
type: NodeShape
comment: Inspection Process defines specific various processes needed to satisfy the inspection requirements for a specific product or service.
subclass of: UseProcess
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: plannedInspectionLocation

InstantiateVirtualHardwareProcess
type: Class
comment: Class that describes an InstantiateVirtualHardwareProcess that is used to define VirtualHardware and its source.
subclass of: CreateProcess
node kind: IRI

ManufactureAction
type: Class
comment: ManufactureAction represents the act of creating a product by a manufacturing process.
subclass of: CreateAction
node kind: IRI

ManufactureProcess
type: Class
comment: This class represents the process involved in manufacturing products.
subclass of: CreateProcess
node kind: IRI

OutOfSpecAction
type: Class
comment: An out of specification action is defined in this class.
subclass of: UseAction
node kind: IRI

PlanAction
type: Class
comment: A PlanAction involves the execution of a plan in relation to a PlanProcess.
subclass of: UseAction
node kind: IRI

PlanProcess
type: Class
comment: Process plans outline the stages of implementation or use related to a process.
subclass of: UseProcess
node kind: IRI

ReproduceAction
type: Class
comment: Reproduction is the biological process by which organisms generate new individuals of the same species.
subclass of: CreateAction
node kind: IRI

ReproduceProcess
type: Class
comment: Reproduction is the biological process by which living organisms produce offspring.
subclass of: CreateProcess
node kind: IRI

ResolutionAction
type: Class
comment: Products out of specification require a resolution action. This is the action of resolution.
subclass of: UseAction
node kind: IRI

ResponsibilityChangeAction
type: Class
type: NodeShape
comment: ResponsibilityChangeAction refers to the transfer of responsibility from one party to another.
subclass of: Action
node kind: IRI
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: current
property:
  class: Element
  min count: 1
  node kind: IRI
  path: responsibilityChangedOn
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: previous
property:
  class: ResponsibilityType
  in: ownership
  in: custody
  max count: 1
  min count: 1
  node kind: IRI
  path: responsibilityCategory

ResponsibilityChangeProcess
type: Class
type: NodeShape
comment: ResponsibilityChangeProcess refers to the process of transferring responsibility from one party to another.
subclass of: DefinedProcess
node kind: IRI
property:
  class: ResponsibilityType
  in: ownership
  in: custody
  max count: 1
  min count: 1
  node kind: IRI
  path: responsibilityCategory
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: plannedCurrent
property:
  class: Element
  node kind: IRI
  path: plannedProductOfResponsibilityChange
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: plannedPrevious

StateAction
type: Class
type: NodeShape
comment: This is the state of an affected Element at a specific moment in time.
subclass of: UseAction
node kind: IRI
property:
  class: State
  max count: 1
  min count: 1
  node kind: IRI
  path: currentState
property:
  class: DefinedStateProcess
  max count: 1
  min count: 1
  node kind: IRI
  path: decisionProcess

StorageAction
type: Class
comment: Records the storage of a product.
subclass of: ModifyAction
node kind: IRI

StorageProcess
type: Class
type: NodeShape
comment: Prescribes the storage of a product.
subclass of: ModifyProcess
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: plannedStorageLocation

TestAction
type: Class
comment: A test action is a specific action associated with a test.
subclass of: UseAction
node kind: IRI

TestProcess
type: Class
comment: Test Process defines the testing process for an element.
subclass of: UseProcess
node kind: IRI

TransportAction
type: Class
type: NodeShape
comment: An actual change to a product's location.
subclass of: ModifyAction
node kind: IRI
property:
  class: Location
  min count: 1
  node kind: IRI
  path: pickupLocation
property:
  class: Location
  node kind: IRI
  path: dropoffLocation
property:
  datatype: string
  node kind: Literal
  path: transportRoute

TransportProcess
type: Class
type: NodeShape
comment: A prescribed change to a product's location.
subclass of: ModifyProcess
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: forPickupLocation
property:
  datatype: string
  node kind: Literal
  path: plannedTransportRoutes
property:
  class: Location
  node kind: IRI
  path: forDropoffLocation

boundaryParameter
type: ObjectProperty
comment: The boundary parameters define the area or region needed to describe a boundary.
range: DictionaryEntry

current
type: ObjectProperty
comment: This is the individual, business, or organization who currently manages goods, services, or assets.
range: Agent

currentState
type: ObjectProperty
comment: This is the state of an affected Element.
range: State

decisionProcess
type: ObjectProperty
comment: This is how the currentState of an affected Element is found.
range: DefinedStateProcess

destructionPerformedBy
type: ObjectProperty
comment: This is the agent that performed the act of destroying the item.
range: Agent

dropoffLocation
type: ObjectProperty
comment: The location for dropping off or delivering a package or item.
range: Location

forDropoffLocation
type: ObjectProperty
comment: The location that an item will be dropping off or delivered.
range: Location

forPickupLocation
type: ObjectProperty
comment: The location for picking up a package or item.
range: Location

pickupLocation
type: ObjectProperty
comment: The location for picking up a package or item.
range: Location

plannedCurrent
type: ObjectProperty
comment: This is the planned individual, business, or organization who currently manages goods, services, or assets.
range: Agent

plannedInspectionLocation
type: ObjectProperty
comment: The planned location that a good, product or material is inspected.
range: Location

plannedPrevious
type: ObjectProperty
comment: This is the planned individual, business, or organization who was previously managing goods, services, or assets.
range: Agent

plannedProductOfResponsibilityChange
type: ObjectProperty
comment: This is the planned product associated with the change of responsibility.
range: Element

plannedStorageLocation
type: ObjectProperty
comment: The planned location that a good, product or material is stored.
range: Location

plannedTransportRoutes
type: DatatypeProperty
comment: A transport route refers to the planned path or network used to move people, goods, data, or resources from one location to another.
range: string

previous
type: ObjectProperty
comment: This is the individual, business, or organization who was previously managing goods, services, or assets.
range: Agent

responsibilityChangedOn
type: ObjectProperty
comment: The element that has it's responsibility changed.
range: Element

transportRoute
type: DatatypeProperty
comment: A transport route refers to the specific path or network used to move people, goods, data, or resources from one location to another.
range: string

validState
type: ObjectProperty
comment: The valid state for DefinedStateProcess.
range: State

Bom
type: Class
comment: A container for a grouping of SPDX 3 content characterizing details (provenance, composition, licensing, etc.) about a product.
subclass of: Bundle
node kind: IRI

adler32
type: NamedIndividual
type: HashAlgorithm
comment: Adler-32 checksum is part of the widely used zlib compression library as defined in [RFC 1950](https://datatracker.ietf.org/doc/rfc1950/) Section 2.3.

blake2b256
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 256, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.

blake2b384
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 384, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.

blake2b512
type: NamedIndividual
type: HashAlgorithm
comment: BLAKE2b algorithm with a digest size of 512, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.

blake3
type: NamedIndividual
type: HashAlgorithm
comment: [BLAKE3](https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf)

crystalsDilithium
type: NamedIndividual
type: HashAlgorithm
comment: [Dilithium](https://pq-crystals.org/dilithium/)

crystalsKyber
type: NamedIndividual
type: HashAlgorithm
comment: [Kyber](https://pq-crystals.org/kyber/)

falcon
type: NamedIndividual
type: HashAlgorithm
comment: [FALCON](https://falcon-sign.info/falcon.pdf)

md2
type: NamedIndividual
type: HashAlgorithm
comment: MD2 message-digest algorithm, as defined in [RFC 1319](https://datatracker.ietf.org/doc/rfc1319/).

md4
type: NamedIndividual
type: HashAlgorithm
comment: MD4 message-digest algorithm, as defined in [RFC 1186](https://datatracker.ietf.org/doc/rfc1186/).

md5
type: NamedIndividual
type: HashAlgorithm
comment: MD5 message-digest algorithm, as defined in [RFC 1321](https://datatracker.ietf.org/doc/rfc1321/).

md6
type: NamedIndividual
type: HashAlgorithm
comment: [MD6 hash function](https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf)

other
type: NamedIndividual
type: HashAlgorithm
comment: any hashing algorithm that does not exist in this list of entries

sha1
type: NamedIndividual
type: HashAlgorithm
comment: SHA-1, a secure hashing algorithm, as defined in [RFC 3174](https://datatracker.ietf.org/doc/rfc3174/).

sha224
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 224, as defined in [RFC 3874](https://datatracker.ietf.org/doc/rfc3874/).

sha256
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 256, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).

sha384
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 384, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).

sha3_224
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 224, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).

sha3_256
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 256, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).

sha3_384
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 384, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).

sha3_512
type: NamedIndividual
type: HashAlgorithm
comment: SHA-3 with a digest length of 512, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).

sha512
type: NamedIndividual
type: HashAlgorithm
comment: SHA-2 with a digest length of 512, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).

build
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's build phase, during development.

decommission
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications for a product's retirement and/or decommissioning.

design
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's design.

development
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during development phase of an element.

other
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.

runtime
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during the execution phase of an element.

test
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's testing phase, during development.

update
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications for a product update.

Organization
type: Class
type: NodeShape
comment: A group of people who work together in an organized way for a shared purpose.
subclass of: Agent
node kind: IRI
property:
  class: Location
  node kind: IRI
  path: headquartersLocation

deployed
type: NamedIndividual
type: SupportType
comment: In addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.

development
type: NamedIndividual
type: SupportType
comment: The artifact is in active development and is not considered ready for formal support from the supplier.

endOfSupport
type: NamedIndividual
type: SupportType
comment: There is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.

limitedSupport
type: NamedIndividual
type: SupportType
comment: The artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

noAssertion
type: NamedIndividual
type: SupportType
comment: No assertion about the type of support is made. This is considered the default if no other support type is used.

noSupport
type: NamedIndividual
type: SupportType
comment: There is no support for the artifact from the supplier, consumer assumes any support obligations.

support
type: NamedIndividual
type: SupportType
comment: The artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

algorithm
type: ObjectProperty
comment: Specifies the algorithm used for calculating the hash value.
range: HashAlgorithm

extension
type: ObjectProperty
comment: Specifies an Extension characterization of some aspect of an Element.
range: Extension

hashValue
type: DatatypeProperty
comment: The result of applying a hash algorithm to an Element.
range: string

key
type: DatatypeProperty
comment: A key used in a generic key-value pair.
range: string

suppliedBy
type: ObjectProperty
comment: Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
range: Agent

supportLevel
type: ObjectProperty
comment: Specifies the level of support associated with an artifact.
range: SupportType

verifiedUsing
type: ObjectProperty
comment: Provides an IntegrityMethod with which the integrity of an Element can be asserted.
range: IntegrityMethod

deprecatedVersion
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this license or exception identifier was deprecated.
range: string

licenseXml
type: DatatypeProperty
comment: Identifies all the text and metadata associated with a license in the license XML format.
range: string

listVersionAdded
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
range: string

member
type: ObjectProperty
comment: A license expression participating in a license set.
range: AnyLicenseInfo

obsoletedBy
type: DatatypeProperty
comment: Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
range: string

seeAlso
type: DatatypeProperty
comment: Contains a URL where the License or LicenseAddition can be found in use.
range: anyURI

hazard
type: ObjectProperty
comment: Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware.
range: DefinedType

partNumber
type: DatatypeProperty
comment: Product Part Number as defined by OEM.
range: string

critical
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 9.0 - 10.0.

high
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 7.0 - 8.9.

low
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 0.1 - 3.9.

medium
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 4.0 - 6.9.

none
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is 0.0.

modifiedTime
type: DatatypeProperty
comment: Specifies a time when a vulnerability assessment was modified
range: dateTimeStamp

publishedTime
type: DatatypeProperty
comment: Specifies the time when a vulnerability was published.
range: dateTimeStamp

severity
type: ObjectProperty
comment: Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
range: CvssSeverityType

withdrawnTime
type: DatatypeProperty
comment: Specified the time and date when a vulnerability was withdrawn.
range: dateTimeStamp

licenseText
type: DatatypeProperty
comment: Identifies the full text of a License or Addition.
range: string

application
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software application.

archive
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an archived collection of one or more files (.tar, .zip, etc.).

bom
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a bill of materials.

configuration
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is configuration data.

container
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a container image which can be used by a container runtime application.

data
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is data.

device
type: NamedIndividual
type: SoftwarePurpose
comment: The Element refers to a chipset, processor, or electronic board.

deviceDriver
type: NamedIndividual
type: SoftwarePurpose
comment: The Element represents software that controls hardware devices.

diskImage
type: NamedIndividual
type: SoftwarePurpose
comment: The Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.

documentation
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is documentation.

evidence
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is the evidence that a specification or requirement has been fulfilled.

executable
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an Artifact that can be run on a computer.

file
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc.).

filesystemImage
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a file system image that can be written to a disk (or virtual) partition.

firmware
type: NamedIndividual
type: SoftwarePurpose
comment: The Element provides low level control over a device's hardware.

framework
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software framework.

install
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is used to install software on disk.

library
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software library.

manifest
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a software manifest.

model
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a machine learning or artificial intelligence model.

module
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a module of a piece of software.

operatingSystem
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is an operating system.

other
type: NamedIndividual
type: SoftwarePurpose
comment: The Element doesn't fit into any of the other categories.

patch
type: NamedIndividual
type: SoftwarePurpose
comment: The Element contains a set of changes to update, fix, or improve another Element.

platform
type: NamedIndividual
type: SoftwarePurpose
comment: The Element represents a runtime environment.

requirement
type: NamedIndividual
type: SoftwarePurpose
comment: The Element provides a requirement needed as input for another Element.

source
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a single or a collection of source files.

specification
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a plan, guideline or strategy how to create, perform or analyze an application.

test
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a test used to verify functionality on a software element.

custody
type: NamedIndividual
type: ResponsibilityType
comment: Custody refers to the responsibility, control, and safekeeping of an asset, person, or legal entity. It involves both physical possession and legal authority over something or someone.

ownership
type: NamedIndividual
type: ResponsibilityType
comment: Ownership refers to the legal right to control, manage, and benefit from an asset, resource, or responsibility. It establishes authority, accountability, and entitlements over something, whether it's property, a business, intellectual property, or responsibilities.

responsibilityCategory
type: ObjectProperty
comment: Requirements can be categorized into various types based on their focus, purpose, and scope.
range: ResponsibilityType

EnergyConsumption
type: Class
type: NodeShape
comment: A class for describing the energy consumption incurred by an AI model in different stages of its lifecycle.
node kind: BlankNodeOrIRI
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: finetuningEnergyConsumption
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: trainingEnergyConsumption
property:
  class: EnergyConsumptionDescription
  node kind: BlankNodeOrIRI
  path: inferenceEnergyConsumption

Bundle
type: Class
type: NodeShape
comment: A collection of Elements that have a shared context.
subclass of: ElementCollection
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: context

ElementCollection
type: Class
type: NodeShape
comment: A collection of Elements, not necessarily with unifying context.
subclass of: Element
node kind: IRI
property:
  class: Element
  node kind: IRI
  path: rootElement
property:
  class: Element
  node kind: IRI
  path: element
property:
  message: https://spdx.org/rdf/3.1/terms/Core/ElementCollection is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: ElementCollection
  path: type
property:
  class: ProfileIdentifierType
  in: core
  in: software
  in: simpleLicensing
  in: expandedLicensing
  in: security
  in: build
  in: ai
  in: dataset
  in: extension
  in: lite
  in: hardware
  in: supplyChain
  node kind: IRI
  path: profileConformance

ElementMap
type: Class
type: NodeShape
comment: A key with an Element.
node kind: BlankNodeOrIRI
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: elementValue
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: key

ExternalMap
type: Class
type: NodeShape
comment: A map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument.
node kind: BlankNodeOrIRI
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: externalSpdxId
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: locationHint
property:
  class: Artifact
  max count: 1
  node kind: IRI
  path: definingArtifact

ExternalRef
type: Class
type: NodeShape
comment: A reference to a resource outside the scope of SPDX 3 content related to an Element.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$
property:
  class: ExternalRefType
  in: altDownloadLocation
  in: altWebPage
  in: binaryArtifact
  in: bower
  in: buildMeta
  in: buildSystem
  in: chat
  in: certificationReport
  in: componentAnalysisReport
  in: cwe
  in: documentation
  in: dynamicAnalysisReport
  in: eolNotice
  in: exportControlAssessment
  in: funding
  in: issueTracker
  in: mailingList
  in: mavenCentral
  in: metrics
  in: npm
  in: nuget
  in: license
  in: other
  in: privacyAssessment
  in: productMetadata
  in: purchaseOrder
  in: qualityAssessmentReport
  in: releaseNotes
  in: releaseHistory
  in: riskAssessment
  in: runtimeAnalysisReport
  in: secureSoftwareAttestation
  in: securityAdvisory
  in: securityAdversaryModel
  in: securityFix
  in: securityOther
  in: securityPenTestReport
  in: securityPolicy
  in: securityThreatModel
  in: socialMedia
  in: sourceArtifact
  in: staticAnalysisReport
  in: support
  in: vcs
  in: vulnerabilityDisclosureReport
  in: vulnerabilityExploitabilityAssessment
  in: x509Cert
  max count: 1
  node kind: IRI
  path: externalRefType
property:
  datatype: string
  node kind: Literal
  path: locator

Hash
type: Class
type: NodeShape
comment: A mathematically calculated representation of a grouping of data.
subclass of: IntegrityMethod
node kind: BlankNodeOrIRI
property:
  class: HashAlgorithm
  in: adler32
  in: blake2b256
  in: blake2b384
  in: blake2b512
  in: blake3
  in: crystalsDilithium
  in: crystalsKyber
  in: falcon
  in: md2
  in: md4
  in: md5
  in: md6
  in: other
  in: sha1
  in: sha224
  in: sha256
  in: sha384
  in: sha512
  in: sha3_224
  in: sha3_256
  in: sha3_384
  in: sha3_512
  max count: 1
  min count: 1
  node kind: IRI
  path: algorithm
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: hashValue

IndividualElement
type: Class
comment: A concrete subclass of Element used by Individuals in the Core profile.
subclass of: Element
node kind: IRI

MeasureOfMass
type: Class
comment: The measure of mass refers to the quantity of matter in an object or substance.
subclass of: UnitOfMeasure
node kind: BlankNodeOrIRI

NamespaceMap
type: Class
type: NodeShape
comment: A mapping between prefixes and namespace partial URIs.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: prefix
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: namespace

no
type: NamedIndividual
type: PresenceType
comment: Indicates absence of the field.

noAssertion
type: NamedIndividual
type: PresenceType
comment: Makes no assertion about the field.

yes
type: NamedIndividual
type: PresenceType
comment: Indicates presence of the field.

Tool
type: Class
comment: An element of hardware and/or software utilized to carry out a particular function.
subclass of: Element
node kind: IRI

contentType
type: DatatypeProperty
comment: Provides information about the content type of an Element or a property.
range: string

IndividualLicensingInfo
type: Class
comment: A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
subclass of: AnyLicenseInfo
node kind: IRI

CdxPropertyEntry
type: Class
type: NodeShape
comment: A property name with an associated value.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: cdxPropName
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: cdxPropValue

Extension
type: Class
comment: A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.
node kind: BlankNodeOrIRI
property:
  message: https://spdx.org/rdf/3.1/terms/Extension/Extension is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Extension
  path: type

RequirementVerification
type: Class
type: NodeShape
comment: RequirementVerification class defines the base properties of a verification.
subclass of: Element
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: verificationRationale
property:
  datatype: string
  node kind: Literal
  path: verificationPrecondition
property:
  class: ExternalIdentifier
  max count: 1
  node kind: BlankNodeOrIRI
  path: verificationUUID
property:
  class: VerificationType
  in: analysis
  in: assessment
  in: audit
  in: demonstration
  in: inspection
  in: other
  in: review
  in: test
  node kind: IRI
  path: verificationMethod
property:
  datatype: string
  node kind: Literal
  path: verificationPostcondition

Project
type: Class
type: NodeShape
comment: Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result.
subclass of: Bundle
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  node kind: Literal
  path: projectStartTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: projectEndTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: projectOwner
property:
  class: Agent
  node kind: IRI
  path: projectSponsor
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: projectContract
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: projectTitle

score
type: DatatypeProperty
comment: Provides a numerical (0-10) representation of the severity of a vulnerability.
range: decimal

vectorString
type: DatatypeProperty
comment: Specifies the CVSS vector string for a vulnerability.
range: string

ContentIdentifier
type: Class
type: NodeShape
comment: A canonical, unique, immutable identifier.
subclass of: IntegrityMethod
node kind: BlankNodeOrIRI
property:
  class: ContentIdentifierType
  in: gitoid
  in: swhid
  max count: 1
  min count: 1
  node kind: IRI
  path: contentIdentifierType
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: contentIdentifierValue

File
type: Class
type: NodeShape
comment: Refers to any object that stores content on a computer.
subclass of: SoftwareArtifact
node kind: IRI
property:
  class: FileKindType
  in: file
  in: directory
  max count: 1
  node kind: IRI
  path: fileKind
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$

Package
type: Class
type: NodeShape
comment: Refers to any unit of content that can be associated with a distribution of software.
subclass of: SoftwareArtifact
node kind: IRI
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: packageUrl
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: sourceInfo
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: packageVersion
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: homePage
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: downloadLocation

DefinedStateProcess
type: Class
type: NodeShape
comment: This process is used to determine the state of an affected Element.
subclass of: UseProcess
node kind: IRI
property:
  class: State
  min count: 1
  node kind: IRI
  path: validState

AnnotationType
type: Class
comment: Specifies the type of an annotation.

Hardware
type: Class
type: NodeShape
comment: Class that describes an instance of Hardware.
subclass of: Artifact
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/Hardware/Hardware is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Hardware
  path: type
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: hazard
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: additionalInformation
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: serialNumber
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: partNumber
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: releaseDate
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Agent
  max count: 1
  min count: 1
  node kind: IRI
  path: productAgent
property:
  class: DefinedType
  node kind: BlankNodeOrIRI
  path: category
property:
  class: Specification
  node kind: IRI
  path: additionalInformationSpecification
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: hardwareVersion
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: batchNumber

ExportControlClassification
type: Class
type: NodeShape
comment: Assement of an Element for export control classification.
node kind: BlankNodeOrIRI
property:
  class: Specification
  max count: 1
  min count: 1
  node kind: IRI
  path: exportControlSpecification
property:
  datatype: positiveInteger
  max count: 1
  node kind: Literal
  path: weight
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: exportClassification
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: exportingCountry
  pattern: ^[A-Z]{3}$

ExploitCatalogType
type: Class
comment: Specifies the exploit catalog type.

ContentIdentifierType
type: Class
comment: Specifies the type of a content identifier.

FileKindType
type: Class
comment: Enumeration of the different kinds of SPDX file.

ModifyAction
type: Class
comment: An actual alteration of a product.
subclass of: Action
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/ModifyAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: ModifyAction
  path: type

ModifyProcess
type: Class
comment: A prescribed alteration of a product.
subclass of: DefinedProcess
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/ModifyProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: ModifyProcess
  path: type

EnergyUnitType
type: Class
comment: Unit of energy consumption.

PositiveIntegerRange
type: Class
type: NodeShape
comment: A tuple of two positive integers that define a range.
node kind: BlankNodeOrIRI
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  node kind: Literal
  path: endIntegerRange
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  node kind: Literal
  path: beginIntegerRange

RelationshipCompleteness
type: Class
comment: Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.

SpdxOrganization
type: NamedIndividual
type: Organization
comment: An Organization representing the SPDX Project.
creation info: creationInfo SpdxOrganization

UnitOfMeasure
type: Class
type: NodeShape
comment: UnitofMeasure specify information structures through industry standards for Units of Measure, Quantity Kinds, Dimensions and Data Types.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: quantity
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: unitQUDT

ExtendableLicense
type: Class
comment: Abstract class representing a License or an OrLaterOperator.
subclass of: AnyLicenseInfo
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/ExpandedLicensing/ExtendableLicense is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: ExtendableLicense
  path: type

License
type: Class
type: NodeShape
comment: Abstract class for the portion of an AnyLicenseInfo representing a license.
subclass of: ExtendableLicense
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseText
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isOsiApproved
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: obsoletedBy
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseXml
property:
  message: https://spdx.org/rdf/3.1/terms/ExpandedLicensing/License is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: License
  path: type
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isDeprecatedLicenseId
property:
  datatype: anyURI
  node kind: Literal
  path: seeAlso
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isFsfLibre
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardLicenseTemplate
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardLicenseHeader

LicenseAddition
type: Class
type: NodeShape
comment: Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
subclass of: Element
node kind: IRI
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isDeprecatedAdditionId
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseXml
property:
  datatype: anyURI
  node kind: Literal
  path: seeAlso
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardAdditionTemplate
property:
  message: https://spdx.org/rdf/3.1/terms/ExpandedLicensing/LicenseAddition is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: LicenseAddition
  path: type
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: additionText
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: obsoletedBy

EvaluationResultType
type: Class
comment: EvaluationResultType describes the outcome of an evaluation or verification process with.

Dimensions
type: Class
type: NodeShape
comment: Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept.
node kind: BlankNodeOrIRI
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: yAxisLength
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: zAxisLength
property:
  class: MeasureOfLength
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: xAxisLength

VirtualHardwareModelType
type: Class
comment: VirtualHardwareModelType sets the VirtualHardware Model Type.

VexVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Abstract ancestor class for all VEX relationships.
subclass of: VulnAssessmentRelationship
node kind: IRI
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: statusNotes
property:
  message: https://spdx.org/rdf/3.1/terms/Security/VexVulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: VexVulnAssessmentRelationship
  path: type
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: vexVersion

CreateAction
type: Class
comment: CreationAction represents an event of product creation.
subclass of: Action
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/CreateAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: CreateAction
  path: type

ResponsibilityType
type: Class
comment: These categories help define sets Responsibility Type.

State
type: Class
comment: A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time.
subclass of: Artifact
node kind: IRI

UseProcess
type: Class
comment: Use Process defines actions used by elements.
subclass of: DefinedProcess
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/UseProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: UseProcess
  path: type

SafetyRiskAssessmentType
type: Class
comment: Safety risk level.

ContactPointRelationshipType
type: Class
comment: Information about the type of contact point for `ContactPointRelationship`s.

DefinedType
type: Class
type: NodeShape
comment: The DefinedType class associates a specific type with its defined source.
node kind: BlankNodeOrIRI
property:
  class: Specification
  max count: 1
  min count: 1
  node kind: IRI
  path: definitionSource
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: typeFromSource

ProcessReadinessType
type: Class
comment: The ProcessReadinessType is defined by the enumeration.

Relationship
type: Class
type: NodeShape
comment: Describes a relationship between one or more elements.
subclass of: Element
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: endTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Element
  max count: 1
  min count: 1
  node kind: IRI
  path: from
property:
  class: Element
  min count: 1
  node kind: IRI
  path: to
property:
  class: RelationshipType
  in: affects
  in: amendedBy
  in: ancestorOf
  in: availableFrom
  in: configures
  in: conformsTo
  in: contains
  in: coordinatedBy
  in: copiedTo
  in: createdBy
  in: delegatedTo
  in: dependsOn
  in: descendantOf
  in: describes
  in: doesNotAffect
  in: evaluatedOn
  in: expandsTo
  in: exploitCreatedBy
  in: finetunedOn
  in: fixedBy
  in: fixedIn
  in: follows
  in: foundBy
  in: generates
  in: hasAddedFile
  in: hasAssessmentFor
  in: hasAssociatedVulnerability
  in: hasConcludedLicense
  in: hasContactPoint
  in: hasDataFile
  in: hasDeclaredLicense
  in: hasDeletedFile
  in: hasDependencyManifest
  in: hasDistributionArtifact
  in: hasDocumentation
  in: hasDynamicLink
  in: hasEvidence
  in: hasExample
  in: hasHost
  in: hasInput
  in: hasMetadata
  in: hasOptionalComponent
  in: hasOptionalDependency
  in: hasOutput
  in: hasPrerequisite
  in: hasProvidedDependency
  in: hasRequirement
  in: hasResolution
  in: hasSpecification
  in: hasStaticLink
  in: hasTest
  in: hasTestCase
  in: hasVariant
  in: implementedBy
  in: invokedBy
  in: locatedAt
  in: modifiedBy
  in: other
  in: packagedBy
  in: patchedBy
  in: pretrainedOn
  in: providesSupportFor
  in: performedBy
  in: publishedBy
  in: reportedBy
  in: republishedBy
  in: resolved
  in: runsOn
  in: serializedInArtifact
  in: testedOn
  in: tracedToDetail
  in: trainedOn
  in: underInvestigationFor
  in: usesTool
  in: validatedOn
  in: verifiedBy
  max count: 1
  min count: 1
  node kind: IRI
property:
  class: RelationshipCompleteness
  in: incomplete
  in: complete
  in: noAssertion
  max count: 1
  node kind: IRI
  path: completeness
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: startTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

SpecificationType
type: Class
comment: A specification type defines the nature of a specification.

comment
type: DatatypeProperty
comment: Provide consumers with comments by the creator of the Element about the Element.
range: string

ConfidentialityLevelType
type: Class
comment: Confidentiality level.

SsvcDecisionType
type: Class
comment: Specifies the SSVC decision type.

AuthenticationProtocolType
type: Class
comment: Protocols which support authentication.

SoftwareArtifact
type: Class
type: NodeShape
comment: A distinct article or unit related to Software.
subclass of: Artifact
node kind: IRI
property:
  class: SoftwarePurpose
  in: application
  in: archive
  in: bom
  in: configuration
  in: container
  in: data
  in: device
  in: diskImage
  in: deviceDriver
  in: documentation
  in: evidence
  in: executable
  in: file
  in: filesystemImage
  in: firmware
  in: framework
  in: install
  in: library
  in: manifest
  in: model
  in: module
  in: operatingSystem
  in: other
  in: patch
  in: platform
  in: requirement
  in: source
  in: specification
  in: test
  max count: 1
  node kind: IRI
  path: primaryPurpose
property:
  class: ContentIdentifier
  node kind: BlankNodeOrIRI
  path: contentIdentifier
property:
  message: https://spdx.org/rdf/3.1/terms/Software/SoftwareArtifact is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: SoftwareArtifact
  path: type
property:
  class: SoftwarePurpose
  in: application
  in: archive
  in: bom
  in: configuration
  in: container
  in: data
  in: device
  in: diskImage
  in: deviceDriver
  in: documentation
  in: evidence
  in: executable
  in: file
  in: filesystemImage
  in: firmware
  in: framework
  in: install
  in: library
  in: manifest
  in: model
  in: module
  in: operatingSystem
  in: other
  in: patch
  in: platform
  in: requirement
  in: source
  in: specification
  in: test
  node kind: IRI
  path: additionalPurpose
property:
  datatype: nonNegativeInteger
  max count: 1
  node kind: Literal
  path: artifactSize
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: copyrightText
property:
  datatype: string
  node kind: Literal
  path: attributionText

CreateProcess
type: Class
comment: The CreateProcess refers to the abstract process class that can be used to represent the process of creation of a product.
subclass of: DefinedProcess
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/CreateProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: CreateProcess
  path: type

EnergyConsumptionDescription
type: Class
type: NodeShape
comment: The class that helps note down the quantity of energy consumption and the unit used for measurement.
node kind: BlankNodeOrIRI
property:
  class: EnergyUnitType
  in: kilowattHour
  in: megajoule
  in: other
  max count: 1
  min count: 1
  node kind: IRI
  path: energyUnit
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: energyQuantity

Action
type: Class
type: NodeShape
comment: Class that describes an action that has occurred.
subclass of: Artifact
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: actionStartTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: additionalInformation
property:
  message: https://spdx.org/rdf/3.1/terms/Core/Action is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Action
  path: type
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: actionEndTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Location
  node kind: IRI
  path: actionLocation

DefinedProcess
type: Class
type: NodeShape
comment: Class that describes a process.
subclass of: Artifact
node kind: IRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: processVersion
property:
  class: ProcessReadinessType
  in: draft
  in: active
  in: obsolete
  in: other
  max count: 1
  node kind: IRI
  path: processReadiness
property:
  message: https://spdx.org/rdf/3.1/terms/Core/DefinedProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: DefinedProcess
  path: type
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: processRationale

IntegrityMethod
type: Class
type: NodeShape
comment: Provides an independently reproducible mechanism that permits verification of a specific Element.
node kind: BlankNodeOrIRI
property:
  message: https://spdx.org/rdf/3.1/terms/Core/IntegrityMethod is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: IntegrityMethod
  path: type
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment

MeasureOfLength
type: Class
comment: The measure of length refers to the dimension of an object or space that describes how long it is, typically expressed in various units depending on the system of measurement being used.
subclass of: UnitOfMeasure
node kind: BlankNodeOrIRI

DatasetAvailabilityType
type: Class
comment: Availability of dataset.

EvidenceType
type: Class
comment: EvidenceType refers to categories of documented or observable proof used to verify compliance, qualification, or performance

VexJustificationType
type: Class
comment: Specifies the VEX justification type.

CreationInfo
type: Class
type: NodeShape
comment: Provides information about the creation of the Element.
node kind: BlankNodeOrIRI
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  node kind: Literal
  path: created
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  class: Tool
  node kind: IRI
  path: createdUsing
property:
  class: Agent
  min count: 1
  node kind: IRI
  path: createdBy
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: specVersion
  pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$

CvssSeverityType
type: Class
comment: Specifies the CVSS base, temporal, threat, or environmental severity type.

VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Abstract ancestor class for all vulnerability assessments.
subclass of: Relationship
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: modifiedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: publishedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: withdrawnTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: SoftwareArtifact
  max count: 1
  node kind: IRI
  path: assessedElement
property:
  message: https://spdx.org/rdf/3.1/terms/Security/VulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: VulnAssessmentRelationship
  path: type
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: suppliedBy

SbomType
type: Class
comment: Provides a set of values to be used to describe the common types of SBOMs that tools may create.

UseAction
type: Class
comment: The action of product use.
subclass of: Action
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SupplyChain/UseAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: UseAction
  path: type

ExternalIdentifier
type: Class
type: NodeShape
comment: A reference to a resource identifier defined outside the scope of SPDX 3 content that uniquely identifies an Element.
node kind: BlankNodeOrIRI
property:
  datatype: anyURI
  node kind: Literal
  path: identifierLocator
property:
  class: ExternalIdentifierType
  in: cpe22
  in: cpe23
  in: cve
  in: duns
  in: email
  in: evidenceUUID
  in: gitoid
  in: gln
  in: glue
  in: gtin
  in: hsCodes
  in: lei
  in: other
  in: packageUrl
  in: phoneNumber
  in: requirementUUID
  in: securityOther
  in: swhid
  in: swid
  in: urlScheme
  in: verificationUUID
  in: webpage
  max count: 1
  min count: 1
  node kind: IRI
  path: externalIdentifierType
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: identifier
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: issuingAuthority

IsoAutomationLevel
type: Class
comment: Defines the level of automation a system possesses.

PresenceType
type: Class
comment: Categories of presence or absence.

Specification
type: Class
type: NodeShape
comment: A specification is a detailed description of the design, requirements, or features of a product, process, or system.
subclass of: Artifact
node kind: IRI
property:
  class: SpecificationType
  in: formalStandard
  in: regulation
  in: specification
  in: other
  max count: 1
  node kind: IRI
  path: specType

SupportType
type: Class
comment: Type of support that is associated with an artifact.

VerificationType
type: Class
comment: Enumeration of verification types.

Artifact
type: Class
type: NodeShape
comment: A distinct article or unit within the domain.
subclass of: Element
node kind: IRI
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: builtTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Agent
  max count: 1
  node kind: IRI
  path: suppliedBy
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: validUntilTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: intendedUse
property:
  class: Agent
  node kind: IRI
  path: originatedBy
property:
  datatype: string
  node kind: Literal
  path: standardName
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: releaseTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: SupportType
  in: development
  in: support
  in: deployed
  in: limitedSupport
  in: endOfSupport
  in: noSupport
  in: noAssertion
  node kind: IRI
  path: supportLevel
property:
  message: https://spdx.org/rdf/3.1/terms/Core/Artifact is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Artifact
  path: type

LifecycleScopeType
type: Class
comment: Provide an enumerated set of lifecycle phases that can provide context to relationships.

AnyLicenseInfo
type: Class
comment: Abstract class representing a license combination consisting of one or more licenses.
subclass of: Element
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/SimpleLicensing/AnyLicenseInfo is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: AnyLicenseInfo
  path: type

ProfileIdentifierType
type: Class
comment: Enumeration of the valid profiles.

DatasetType
type: Class
comment: Enumeration of dataset types.

Location
type: Class
type: NodeShape
comment: Location is used to define the location, address or coordinates of a place.
subclass of: Element
node kind: IRI
property:
  message: https://spdx.org/rdf/3.1/terms/Core/Location is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Location
  path: type
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: locationTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

DictionaryEntry
type: Class
type: NodeShape
comment: A key with an associated value.
node kind: BlankNodeOrIRI
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: key
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: value

ExternalIdentifierType
type: Class
comment: Specifies the type of an external identifier.

HashAlgorithm
type: Class
comment: A mathematical algorithm that maps data of arbitrary size to a bit string.

Agent
type: Class
comment: Agent represents anything with the potential to act on a system.
subclass of: Element
node kind: IRI

SoftwarePurpose
type: Class
comment: Provides information about the primary purpose of an Element.

Element
type: Class
type: NodeShape
comment: Base domain class from which all other SPDX 3 domain classes derive.
node kind: IRI
property:
  class: ExternalRef
  node kind: BlankNodeOrIRI
  path: externalRef
property:
  message: https://spdx.org/rdf/3.1/terms/Core/Element is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
  not:
    has value: Element
  path: type
property:
  class: CreationInfo
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: creationInfo
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: summary
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: name
property:
  class: ExternalIdentifier
  node kind: BlankNodeOrIRI
  path: externalIdentifier
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: description
property:
  message: Class is known to not derive from Extension and cannot be used
  not:
    or:
      class: RequirementVerification
    or:
      class: EvidenceRelationship
    or:
      class: EvaluationResult
    or:
      class: SsvcVulnAssessmentRelationship
    or:
      class: CvssV2VulnAssessmentRelationship
    or:
      class: ExploitCatalogVulnAssessmentRelationship
    or:
      class: CvssV4VulnAssessmentRelationship
    or:
      class: VexAffectedVulnAssessmentRelationship
    or:
      class: VexNotAffectedVulnAssessmentRelationship
    or:
      class: CvssV3VulnAssessmentRelationship
    or:
      class: Vulnerability
    or:
      class: VexUnderInvestigationVulnAssessmentRelationship
    or:
      class: EpssVulnAssessmentRelationship
    or:
      class: VexFixedVulnAssessmentRelationship
    or:
      class: NamespaceMap
    or:
      class: LifecycleScopedRelationship
    or:
      class: ElementMap
    or:
      class: SupportRelationship
    or:
      class: Hash
    or:
      class: Agent
    or:
      class: MeasureOfLength
    or:
      class: CreationInfo
    or:
      class: ContactPointRelationship
    or:
      class: ExternalRef
    or:
      class: Specification
    or:
      class: Bom
    or:
      class: IndividualElement
    or:
      class: Relationship
    or:
      class: UnitOfMeasure
    or:
      class: PositiveIntegerRange
    or:
      class: DictionaryEntry
    or:
      class: ExternalMap
    or:
      class: Annotation
    or:
      class: DefinedType
    or:
      class: SpdxDocument
    or:
      class: Person
    or:
      class: Organization
    or:
      class: MeasureOfMass
    or:
      class: Bundle
    or:
      class: Tool
    or:
      class: Requirement
    or:
      class: ExternalIdentifier
    or:
      class: SoftwareAgent
    or:
      class: PackageVerificationCode
    or:
      class: PhysicalLocation
    or:
      class: Regulation
    or:
      class: AIPackage
    or:
      class: EnergyConsumptionDescription
    or:
      class: EnergyConsumption
    or:
      class: Build
    or:
      class: DatasetPackage
    or:
      class: CustomLicense
    or:
      class: OrLaterOperator
    or:
      class: ListedLicense
    or:
      class: DisjunctiveLicenseSet
    or:
      class: ListedLicenseException
    or:
      class: WithAdditionOperator
    or:
      class: IndividualLicensingInfo
    or:
      class: CustomLicenseAddition
    or:
      class: ConjunctiveLicenseSet
    or:
      class: LicenseExpression
    or:
      class: SimpleLicensingText
    or:
      class: CdxPropertyEntry
    or:
      class: Project
    or:
      class: ExportControlClassificationAssessment
    or:
      class: ExportControlClassification
    or:
      class: StateAction
    or:
      class: State
    or:
      class: AssemblyAction
    or:
      class: BoundaryDefinitionProcess
    or:
      class: DestroyProcess
    or:
      class: ResponsibilityChangeAction
    or:
      class: PlanAction
    or:
      class: DestroyAction
    or:
      class: ChangeAction
    or:
      class: TransportProcess
  path: extension

ExternalRefType
type: Class
comment: Specifies the type of an external reference.

RelationshipType
type: Class
comment: Information about the relationship between two Elements.