Internet Explorer is no longer supported. Many things will still work, but your experience will be degraded and some things won't function. Please use a modern browser such as Edge, Chrome, or Firefox.
 
No matching results found

SCA (Builds & Projects)

view on GitHub

The Software Composition Analysis (SCA) API provides several pgutil commands (available as pgutil builds) and HTTP endpoints for querying, creating, and updating builds, projects, and related data:

All http requests are made through the following base URL:

/api/sca/...

pgutil Commands

All HTTP endpoints of the SCA API are available as pgutil commands.

To find the list of commands available in pgutil, simply run pgutil builds --help. See Getting started with pgutil to learn more.

Available HTTP Endpoints

The SCA API is comprised of endpoints for Builds, Projects, Issues, Comments and SBOM Documents:

🏗 Builds

Create/Update Build - Creates or updates a build
Get Build - Describes a specified build
List Build - Lists and describes specified build
Analyze Build - Runs an analysis on a specified build
Promote Build - Promotes a build to a specified stage
Scan Build - Generates a minimal SBOM from project dependencies*

* Only available as a pgutil command.

🛠️ Projects

Create/Update Project - Creates or updates a project
Get Project - Describes a specified project*
List Projects - Lists and describes specified projects

* Only available as an HTTP request.

🚩 Issues

List Issues - Lists and describes specified issues
Delete Issues - Deletes a specified issue
Resolve Issue - Sets a specified issue to resolved

💬 Comments

Create/Update Comment - Creates or updates a comment
List Comments - Lists and describes specified comments
Delete Comment - Deletes a specified comment

📄 SBOM Document

For managing "Software Bill of Material" (SBOM) documents

Export SBOM - Exports a SBOM document from ProGet
Import SBOM - Imports a SBOM document to ProGet*

* Only available as an HTTP request.

Authenticating to SCA Repository API

The following is a summary of access types and their corresponding requirements for various API key types and endpoints within this API.

Access Type Requirements
System API Keys Manage Builds & Projects and/or Upload SBOM documents
Feed API Keys not usable
Personal API Key* Projects_View
Projects_ResolveIssue
Projects_UploadSbom
Projects_Manage
No API Key anonymous or authenticated user must have at one of the above permissions

* Personal API keys are scoped to users and inherit the Tasks and attributes assigned to those users.

To specify an API Key, use the request header (X-ApiKey), querystring (key), or api:«api-key» as the username. See API Key Usage to learn more.

🚀 Quick Example: Authenticating with curl

For example, to authenticate with the API key abc12345 to List Projects, you could specify the API key as follows:

curl -X GET -H "X-ApiKey: abc12345" "https://proget.corp.local/api/sca/projects"
In this article

inedo.com | Support | MyInedo

docs © 2026 Inedo, LLC