SCA (Projects & Releases) API

The SCA Repository API has Endpoints to query, create, and update projects, releases, and related components on a ProGet instance.

Security & API Keys

To specify an API Key, use the request header (X-ApiKey), querystring (key), or api:«api-key» as the username. See API Key Usage to learn more.

Endpoint Specifications

List Projects Endpoint

The List Project Endpoint returns a JSON array of all projects.

• Request Type: GET
• Request URL: /api/sca/projects
• Note that:
  • An API key must be specified as part of the request

List Projects Response

Get Project Endpoint

The Get Project Endpoint returns a JSON object describing a project.

• Request Type: GET
• Request URL: /api/sca/projects?name=«projectName»
• Note that:
  • An API key must be specified as part of the request

Get Project Response

Create/Update Project Endpoint

The Create/Update Project Endpoint can create a new project or update properties on an existing project.

Create/Update Project Request

• Request Type: POST
• Request URL: /api/sca/projects
• Request Body: ProjectInfo Object
• Note that:
  • An API key must be specified as part of the request

Create/Update Project Response

List Releases Endpoint

The List Releases Endpoint returns a JSON array of all releases in a project.

• Request Type: GET
• Request URL: /api/sca/releases?project=«projectName»
• Note that:
  • An API key must be specified as part of the request

List Releases Response

Get Release Endpoint

The Get Release Endpoint returns a JSON object describing a release.

• Request Type: GET
• Request URL: /api/sca/releases?name=«projectName»&version=«versionNumber»
• Note that:
  • An API key must be specified as part of the request

Get Release Response

Create/Update Release Endpoint

The Create/Update Release Endpoint can create a new release or update properties on an existing release.

Create/Update Release Request

• Request Type: POST
• Request URL: /api/sca/releases
• Request Body: ReleaseInfo Object
• Note that:
  • An API key must be specified as part of the request

Create/Update Release Response

List Issues Endpoint

The List Issues Endpoint returns a JSON array of all issues in a project release.

• Request Type: GET
• Request URL: /api/sca/issues?project=«projectName»&version=«releaseVersion»
• Note that:
  • An API key must be specified as part of the request

List Issues Response

Resolve Issue Endpoint

The Resolve Issue Endpoint sets the status of an Issue to Resolved.

Resolve Issue Request

• Request Type: POST
• Request URL: /api/sca/issues?project=«projectName»&version=«releaseVersion»&resolve=true
• Note that:
  • An API key must be specified as part of the request

Resolve Issue Response

Delete Issue Endpoint

The Delete Issue Endpoint deletes an Issue.

Delete Issue Request

• Request Type: DELETE
• Request URL: /api/sca/issues?project=«projectName»&version=«releaseVersion»&number=«issueNumber»
• Note that:
  • An API key must be specified as part of the request

Delete Issue Response

List Comments Endpoint

The List Comments Endpoint returns a JSON array of all comments in a project release.

• Request Type: GET
• Request URL: /api/sca/comments?project=«projectName»&version=«releaseVersion»
• Note that:
  • An API key must be specified as part of the request

List Comments Response

Create/Update Comment Endpoint

The Create/Update Comment Endpoint creates or updates properties on a comment.

Create/Update Comment Request

• Request Type: POST
• Request URL: ` /api/sca/issues
• Request Body: CommentInfo Object
• Note that:
  • An API key must be specified as part of the request

Create/Update Comment Response

Delete Comment Endpoint

The Delete Comment Endpoint deletes an Issue.

Delete Comment Request

• Request Type: DELETE
• Request URL: /api/sca/comments?project=«projectName»&version=«releaseVersion»&number=«commentNumber»
• Note that:
  • An API key must be specified as part of the request

Delete Comment Response

Import SBOM Endpoint

The Import SBOM Endpoint can be used to import an existing SBOM document into ProGet and create corresponding project and release information from it.

Import SBOM Request

• Request Type: POST
• Request URL: /api/sca/import
• Content-Type: text/xml or application/json
• Request Body: SBOM Document in either XML or JSON format depending on the value of the Content-Type header
• Note that:
  • An API key must be specified as part of the request

Import SBOM Response

Export SBOM Endpoint

The Export SBOM Endpoint can be used to generate an SBOM from project and release information in ProGet.

Export SBOM Request

• Request Type: GET
• Request URL: /api/sca/export?project=«projectName»&version=«versionNumber»&format=«xml/json»
• Note that:
  • An API key must be specified as part of the request

Export SBOM Response

Analyze Release Endpoint

Introduced in v2022.10, this input will run an analysis of a single release, similar to clicking the "analyze" button in the user interface, on the release overview page.

Analyze Release Request

• Request Type: POST
• Request URL: /api/sca/analyze-release?project=«projectName»&version=«releaseVersion»
• Note that:
  • An API key must be specified as part of the request

Analyze Release Response

Data Specifications

ProjectInfo Properties

ProjectInfo is a set of key/value pairs that correspond to the fields on a Project. It's used as both input and output data for various endpoints:

• Output: Create, Update, and List endpoints return ProjectInfo as a JSON-formatted object; all values are returned
• Input: Update endpoint receives ProjectInfo as a JSON-formatted object; a missing property indicates that the value should not be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

ReleaseInfo Properties

ReleaseInfo is a set of key/value pairs that correspond to the fields on a Release. It's used as both input and output data for various endpoints:

• Output: Create, Update, and List endpoints return ReleaseInfo as a JSON-formatted object; all values are returned
• Input: Update endpoint receives ReleaseInfo as a JSON-formatted object; a missing property indicates that the value should not be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

IssueInfo Properties

IssueInfo is a set of key/value pairs that correspond to the fields on an Issue. It's used as both input and output data for various endpoints:

• Output: Create, Update, and List endpoints return IssueInfo as a JSON-formatted object; all values are returned
• Input: Update endpoint receives IssueInfo as a JSON-formatted object; a missing property indicates that the value should not be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

CommentInfo Properties

CommentInfo is a set of key/value pairs that correspond to the fields on a Comment. It's used as both input and output data for various endpoints:

• Output: Create, Update, and List endpoints return CommentInfo as a JSON-formatted object; all values are returned
• Input: Update endpoint receives CommentInfo as a JSON-formatted object; only the comment field will be updated

Note that some values are optional (indicated by string?), and may be set to null or an empty string.

PackageInfo Properties

PackageInfo is a set of key/value pairs that correspond to the fields on a Package. It's used as a parameter on a ReleaseInfo object.

VulnerabilityInfo Properties

VulnerabilityInfo is a set of key/value pairs that correspond to the fields on a Vulnerability. It's used as a parameter on a PackageInfo object.

Usage Examples

Import SBOM

curl --header "X-ApiKey: <key>" --header "Content-Type: application/json" --request POST --upload-file bom.json http://proget/api/sca/import

Download SBOM

curl --header "X-ApiKey: <key>" "http://proget/api/sca/export?project=juice-shop&version=11.1.2&format=xml"

Mark a Release as Inactive

curl --header "X-ApiKey: <key>" --header "Content-Type: application/json" --request POST --data "{ \"project\": \"juice-shop\", \"version\": \"10.0.0\", \"active\": false }" http://proget/api/sca/releases

Resolve an Issue

curl --header "X-ApiKey: <key>" --request POST --data ""  "http://proget/api/sca/issues?project=juice-shop&version=11.1.2&number=1000&resolve"

Add a Comment to a Release

curl --header "X-ApiKey: <key>" --header "Content-Type: application/json" --request POST --data "{ \"project\": \"juice-shop\", \"version\": \"11.1.2\", \"comment\": \"I am a new comment.\" }" http://proget/api/sca/comments

Get Issues for a Release

curl --header "X-ApiKey: <key>" "http://proget/api/sca/issues?project=juice-shop&version=11.1.2"