Skip to main content
A project report is a project’s posture written down for a reader: its merge gate, vulnerabilities, licence obligations, cryptography and export, and AI provenance, as a PDF, a CSV bundle, or both. Attach one when someone asks where a project stands. A project report isn’t the same as a snapshot report. A snapshot report describes one SBOM snapshot’s inventory. A project report describes the project’s posture at its latest completed scan. Before you start:
  • The project needs a completed full scan. A project whose posture comes from declared components only, such as an imported SBOM, can’t have a report. Until there’s a full scan, the dialog says “Run a full scan first: a report is frozen at a completed full scan.”
  • You need the Operator or Admin role to generate a report. Viewers can see and download reports but can’t generate them.

​
Generating a report

1

Open the dialog

On the project’s Dashboard, select Report, on the right beside Edit. You can also select Generate report on the project’s Reports page.
2

Choose a template

Under Template, choose Compliance (the default), Executive, or Operator. The template sets who the document is written for and how many rows of the licence table the PDF prints: 5 for Executive, 15 for Compliance, and 40 for Operator. The CSV always has every row.
3

Check the anchor scan

Anchor scan is read-only. It names the scan the Dashboard describes, with its short ID, the day it completed, and its coverage. The report’s numbers, verdicts, and dataset versions come from this scan. You don’t choose it.
4

Choose sections and formats

Under Sections, every section you can see is on. Keep at least one. A section appears only when your organisation has the scanner behind it:Under Formats, keep PDF, CSV, or both. Both are on to start with.
5

Generate

Select Generate. It stays disabled while Earnie generates the report. When it finishes, the dialog closes and a message offers View reports.
Frozen and anchored. Earnie draws a report once, when you generate it, and stores its files. Downloading it later returns those same files, so a report shows what was true at its anchor scan even after newer scans and decisions have moved the Dashboard on. If a newer scan completes while the dialog is open, Earnie tells you, shows the new anchor scan, and asks you to generate again, so you never freeze a scan you didn’t look at.

​
What’s in the files

  • PDF is an A4 portrait document.
  • CSV is a ZIP of CSV files. 00-report.csv holds the header, the figures at a glance, the headlines, and the dataset versions. Each section adds a file of its figures and, where the section has a chart by scan, a file with one row per scan.
A figure nobody measured reads “not measured” in a figures file and is an empty cell in a by-scan file, never a zero. As in snapshot reports, a cell a spreadsheet would read as a formula starts with an apostrophe, so opening the CSV never runs anything.

​
The Reports page

Select Reports in the project’s sidebar to see every report for the project, newest first. Each row shows:
  • Template: Compliance, Executive, or Operator
  • Anchor: the anchor scan’s short ID and date, linking to that scan
  • Date: the day the report was generated
  • Formats: the formats it was generated in
  • By: who generated it
  • Download: a button for each format
You can’t edit or delete a report. To capture later changes, generate another one. A report that covers a scanner you can’t see isn’t listed for you. Earnie keeps it, and it appears again once that scanner is enabled for you. Earnie records each generation in the audit log as project_report.generated.

​
Through the API

The request body takes a template (compliance, executive, or operator) and formats (pdf, csv), and optionally sections (merge_gate, vulnerabilities, license_obligations, cryptography_export, ai_provenance) and anchor_scan_id. Leave out sections to get every section you can see. Earnie always anchors the report to the project’s latest completed scan. anchor_scan_id is only a check: if a newer scan has completed since, the request fails with 409 anchor_not_latest and nothing is generated. Other errors:
  • 409 no_completed_scan: the project has no completed scan to anchor to.
  • 422 invalid_report: an unknown or repeated template, section, or format, or no format.
  • 422 section_not_visible: you asked for a section you can’t see.
  • 404 format_not_rendered: you asked to download a format the report wasn’t generated in.
See Using the API for authentication and scopes.

​
What’s next

A report shows where a project stands. When someone later asks why a decision was made, the answer is in the audit log.