---
id: spdx-python-model
version: "0.0.6"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# spdx-python-model — SPDX Model Python Bindings

License: permissive · Maintenance: active · Downloads: 173.5K/mo

## What it is and what it does

spdx-python-model is a Python library that provides direct bindings to the SPDX 3 specification through auto-generated classes. The bindings are created from the official RDF and SHACL definitions of SPDX 3 using shacl2code during package build, ensuring they stay synchronized with the specification. It exposes low-level, direct access to SPDX data structures organized by version (e.g., v3_0_1), allowing you to instantiate and manipulate SPDX objects programmatically.

The library is intended for developers who need to work directly with SPDX files or build SPDX documents from code. It includes a load() API that can automatically detect and deserialize SPDX documents from disk. However, the bindings are intentionally low-level—they lack higher-level convenience functions for common SPDX creation tasks. If you need a more ergonomic API, the SPDX Python Tools project offers a higher-level interface, though it does not yet support SPDX 3.

Use it for:

- Parse and deserialize existing SPDX 3 JSON documents into Python objects for inspection or modification
- Programmatically construct SPDX 3 documents from scratch by instantiating model classes like Person, Package, or Bundle
- Build software bill-of-materials (SBOM) generation tools that emit valid SPDX 3 output
- Integrate SPDX 3 data handling into build systems or CI/CD pipelines that need to work with standardized software metadata

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides Python bindings for the SPDX 3 data model, enabling direct manipulation of SPDX documents through auto-generated classes from RDF and SHACL specifications.

Yes, if you need to work with SPDX 3 documents in Python. The library has low install friction, no runtime dependencies, active maintenance, and permissive licensing. It is the canonical bindings for SPDX 3 and supports modern Python versions. Caveat: it is low-level and lacks convenience helpers—suitable for direct manipulation but not for rapid prototyping of SPDX workflows.

## Install

pip install spdx-python-model
uv add spdx-python-model
poetry add spdx-python-model

## Installing spdx-python-model

Before you install: Low installation friction with no runtime dependencies. Active maintenance with a release 52 days ago and recent commits. Supports Python 3.9 through 3.14.

License in practice: Apache-2.0 permissive license allows use in most commercial and open-source projects with minimal restrictions.

Quickstart:

pip install spdx-python-model

import spdx_python_model
p = spdx_python_model.v3_0_1.Person()

# Or load from an SPDX file
from pathlib import Path
model, objset = spdx_python_model.load(Path("/path/to/file.spdx3.json"))

Requires Python 3.9 or later. Building from source with local SPDX model files requires setting SHACL2CODE_SPDX_DIR environment variable.

Verify before relying:

- Whether the low-level bindings are suitable for typical SPDX document creation workflows without higher-level helpers
- Performance characteristics when working with large or complex SPDX documents

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 173.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

spdx 3 python bindings, software bill of materials python, sbom model library, spdx document manipulation, rdf shacl python code generation, sbom, standards-compliance

[View on SkillFed](https://skillfed.io/packages/spdx-python-model) · [View on PyPI](https://pypi.org/project/spdx-python-model/)