Nodes
A node is one processing step. It takes data in, does a single job, and passes its result on.
Nodes are the vocabulary of a workflow: reading a CycloneDX file, normalizing component names, verifying licenses, generating a PDF. You build a pipeline by choosing the right nodes and connecting them in the right order.
Three things called "node"
The word gets used at three levels, and the distinction matters when reading the rest of these docs:
- A category is a functional grouping, such as Data Format or Reporting.
- A node type is a specific implementation, such as Read CycloneDX. It defines what the node does, what it accepts, what it produces, and what you can configure.
- A node on your canvas is one placement of a node type, with your settings filled in. The same type can appear many times in one workflow with different configuration.
Categories
The node palette groups node types into these categories:
| Category | What it covers |
|---|---|
| Import/Export | Getting data into and out of a workflow. |
| Data Format | Reading and writing SPDX and CycloneDX. |
| Database | Reading from and writing to a registered database. |
| FossID Workbench | Driving FossID Workbench from a workflow. |
| Validation | Checking SBOM structure. |
| Verification | Checking SBOM content against the FossID Knowledge Base. |
| Transformation | Reshaping data. |
| Normalization | Canonicalizing component data. |
| Consolidation | Merging several SBOMs into one. |
| Policy | Applying rules and regulatory checks. |
| Analysis | Deriving summaries from SBOM data. |
| Reporting | Producing reports and sending them out. |
| Review | Pausing for human approval. |
Not every category is filled in yet. The node reference lists the node types that are available and documented today.
Configuration
Selecting a node on the canvas opens its configuration panel. What appears there is defined by the node type: a connection to use, a format version to emit, which checks to run, and so on.
Parameters marked as required must be filled in before the workflow will validate. Optional parameters generally have sensible defaults, which are listed per node in the node reference.
Inputs and outputs
Every node declares what kind of data it accepts and what it produces. This is what the editor uses to stop you from building a pipeline that cannot work — see Edges and data flow.
Some nodes accept multiple inputs. When several branches feed into one of these, the node waits for all of them before it runs. That is how a workflow fans out to do several things in parallel and then brings the results back together — merging several SBOMs into one, for instance.
Internal and external nodes
Some nodes run inside the Workflows backend; others run as separate services that the platform dispatches work to.
This is an implementation detail and does not change how you use them — it is mentioned only because the distinction occasionally surfaces in the interface.
Related
- Node reference — every available node in detail.
- Edges and data flow — how nodes connect.
- Connections — the credentials some nodes need.