https://github.com/guacsec/trustify/blame/9aaf962b917d0f8d267e2e1e58a89c57f57b90d6/modules/fundamental/src/sbom/endpoints/test.rs#L1672-L1685

Note that the %2F characters that appear in the original SBOM aren't preserved in our API results. We add a namespace to the PURL's that doesn't exist in the SBOM.

I've created an upstream issue for this.