SCA (Projects & Releases) API

The Software Composition Analysis (SCA) Repository API has to query, create, and update projects, releases, and related components on a ProGet instance.
All API endpoints are accessed through the following base URL:

🛠️ Projects Endpoints

Create/Update Project - Creates or updates a project
Get Project - Describes a specified project
List Projects - Lists and describes specified projects

🚀 Releases Endpoints

Create/Update Release - Creates or updates a release
Get Release - Describes a specified release
List Releases - Lists and describes specified releases
Analyze Release - Runs an analysis on a specified release

🚩 Issues Endpoints

List Issues - Lists and describes specified issues
Delete Issues - Deletes a specified issue
Resolve Issue - Sets a specified issue to resolved

💬 Comments Endpoints

Create/Update Comment - Creates or updates a comment
List Comments - Lists and describes specified comments
Delete Comment - Deletes a specified comment

📄 SBOM Document Endpoints

Endpoints for managing "Software Bill of Material" (SBOM) documents

Export SBOM Endpoint - Exports a SBOM document from ProGet
Import SBOM Endpoint - Imports a SBOM document to ProGet

Authenticating to SCA Repository API Endpoints

The following is a summary of access types and their corresponding requirements for various API key types and endpoints within this API.

To specify an API Key, use the request header (X-ApiKey), querystring (key), or api:«api-key» as the username. See API Key Usage to learn more.

curl -X GET -H "X-ApiKey: abc12345" "https://proget.corp.local/api/sca/projects"

403 The specified API key does not have the proper permissions to perform this action.

Data Specifications

ProjectInfo Object Properties

ProjectInfo is a set of key/value pairs that correspond to the fields on a Project. It's used as both input and output data for various endpoints:

• Output: Create/Update Project and List Projects endpoints return ProjectInfo as a JSON-formatted object; all values are returned
• Input: Create/Update Project endpoint receives ProjectInfo as a JSON-formatted object; a missing property indicates that the value should not be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

JSON Object

{
  "id":1,
  "name":"myProject"
}

ReleaseInfo Object Properties

ReleaseInfo is a set of key/value pairs that correspond to the fields on a Release. It's used as both input and output data for various endpoints:

• Output: Create/Update Release and List Releases endpoints return ReleaseInfo as a JSON-formatted object; all values are returned
• Input: Create/Update Release endpoint receives ReleaseInfo as a JSON-formatted object; a missing property indicates that the value should not be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

JSON Object

{
    "project":"myProject",
    "version":"1.2.3",
    "active":true,
    "viewReleaseUrl":"http://proget.corp.local/projects/release?projectReleaseId=2",
    "viewIssuesUrl":"http://proget.corp.local/projects/release/issues?projectReleaseId=2",
    "comments": [
        {
            "number": 1,
            "by": "proget",
            "date": "2024-01-24T02:10:36.993Z",
            "comment": "I am a comment."
        },
        {
            "number": 2,
            "by": "proget",
            "date": "2024-01-24T03:45:21.567Z",
            "comment": "I am another comment."
        }
    ],
    "packages": [
        {
            "purl": "pkg:myGroup/myPackage@1.2.3",
            "vulnerabilities": [
                {
                    "id": "CVE-2021-12345",
                    "title": "Security Vulnerability A",
                    "description": "This is an example of a high-severity security vulnerability.",
                    "score": 9.8,
                    "assessment": "Critical"
                },
                {
                    "id": "CVE-2021-67890",
                    "title": "Security Vulnerability B",
                    "description": "Another example of a medium-severity security vulnerability.",
                    "score": 6.5,
                    "assessment": "Moderate"
                }
            ],
            "licenses": ["MIT", "Apache-2.0"]
        },
        {
            "purl": "pkg:myGroup/anotherPackage@2.0.1",
            "vulnerabilities": [],
            "licenses": ["GPL-3.0"]
        }
    ]
}

IssueInfo Properties

IssueInfo is a set of key/value pairs that correspond to the fields on an Issue. It's used as output data for the List Issues endpoint, returning IssueInfo as a JSON-formatted object.

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

JSON Object

{
    "project": "myProject",
    "version": "1.2.3",
    "number": 123,
    "created": "2024-01-23T12:00:00Z",
    "type": "V",
    "purl": "pkg:myGroup/myPackage@v1.2.3",
    "vulnerability": "12345"
}

CommentInfo Object Properties

CommentInfo is a set of key/value pairs that correspond to the fields on a Comment. It's used as both input and output data for various endpoints:

• Output: Create/Update Comment and List Comments endpoints return CommentInfo as a JSON-formatted object; all values are returned
• Input: Create/Update Comment endpoint receives CommentInfo as a JSON-formatted object; only the comment field will be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

JSON Object

{
    "number":1,
    "by":"proget",
    "date":"2024-01-24T02:10:36.993Z",
    "comment":"I am a new comment."
}

PackageInfo Properties

PackageInfo is a set of key/value pairs that correspond to the fields on a Package. It's used as a parameter on a ReleaseInfo object.

JSON Object

{
  "purl": "pkg:myGroup/myPackage@1.2.3",
  "vulnerabilities": [
    {
      "id": "CVE-2021-12345",
      "title": "Security Vulnerability A",
      "description": "This is an example of a high-severity security vulnerability.",
      "score": 9.8,
      "assessment": "Critical"
    },
    {
      "id": "CVE-2021-67890",
      "title": "Security Vulnerability B",
      "description": "Another example of a medium-severity security vulnerability.",
      "score": 6.5,
      "assessment": "Moderate"
    }
  ],
  "licenses": ["MIT", "Apache-2.0"]
}

VulnerabilityInfo Properties

VulnerabilityInfo is a set of key/value pairs that correspond to the fields on a Vulnerability. It's used as a parameter on a PackageInfo object.

JSON Object

    {
      "id": "CVE-2021-12345",
      "title": "Security Vulnerability A",
      "description": "This is an example of a high-severity security vulnerability.",
      "score": 9.8,
      "assessment": "Critical"
    },