Internet Explorer is no longer supported. Many things will still work, but your experience will be degraded and some things won't function. Please use a modern browser such as Edge, Chrome, or Firefox.
 
No matching results found

SCA (Builds & Projects)

view on GitHub

The Software Composition Analysis (SCA) API provides several pgutil commands (available as pgutil builds) and HTTP endpoints for querying, creating, and updating builds, projects, and related data:

All http requests are made through the following base URL:

/api/sca/...

pgutil Commands

All HTTP endpoints of the SCA API are available as pgutil commands.

To find the list of commands available in pgutil, simply run pgutil builds --help. See Getting started with pgutil to learn more.

Available HTTP Endpoints

The SCA API is comprised of endpoints for Builds, Projects, Issues, Comments and SBOM Documents:

🏗 Builds

Create/Update Build - Creates or updates a build
Get Build - Describes a specified build
List Build - Lists and describes specified build
Analyze Build - Runs an analysis on a specified build
Promote Build - Promotes a build to a specified stage
Scan Build - Generates a minimal SBOM from project dependencies*

* Only available as a pgutil command.

🛠️ Projects

Create/Update Project - Creates or updates a project
Get Project - Describes a specified project*
List Projects - Lists and describes specified projects

* Only available as an HTTP request.

🚩 Issues

List Issues - Lists and describes specified issues
Delete Issues - Deletes a specified issue
Resolve Issue - Sets a specified issue to resolved

💬 Comments

Create/Update Comment - Creates or updates a comment
List Comments - Lists and describes specified comments
Delete Comment - Deletes a specified comment

📄 SBOM Document

For managing "Software Bill of Material" (SBOM) documents

Export SBOM - Exports a SBOM document from ProGet
Import SBOM - Imports a SBOM document to ProGet*

* Only available as an HTTP request.

Authenticating to SCA Repository API

The following is a summary of access types and their corresponding requirements for various API key types and endpoints within this API.

Access Type Requirements
System API Keys Upload SBOM documents only required to import SBOMs
Manage SCA (Projects & Builds) required for all other endpoints
Feed API Keys not usable
Personal API Key* Projects_Manage can access all endpoints
Projects_View is required for Get Build, List Build, Get Project, and List Project
Projects_UploadSbom is required for Import SBOM
Projects_ResolveIssue is required for Resolve Issue
No API Key anonymous or authenticated user must have at one of the above permissions

* Personal API keys are scoped to users and inherit the Tasks and attributes assigned to those users.

To specify an API Key, use the request header (X-ApiKey), querystring (key), or api:«api-key» as the username. See API Key Usage to learn more.

🚀 Quick Example: Authenticating with curl

For example, to authenticate with the API key abc12345 to List Projects, you could specify the API key as follows:

curl -X GET -H "X-ApiKey: abc12345" "https://proget.corp.local/api/sca/projects"
In this article

inedo.com | Support | MyInedo

docs © 2026 Inedo, LLC