I am using Azure DevOps and am doing a SAST and SCA scan on a public GitHub repo. Both of these are successful! However, I am trying to take it a step further and would like to generate an SBOM based on the SCA Agent-Based Scan result for each time I run the pipeline.

I am aware that I need to obtain the workspace GUID, and the project GUID to obtain the SBOM. I am trying to use this API to obtain that info, and adding it into the SCA task.

curl -X 'GET' \

'https://api.veracode.com/srcclr/v3/workspaces?filter%5Bworkspace%5D=WS-30268' \

-H 'accept: application/json'

I got this syntax from the Veracode REST API SwaggerHub documentation, but that call doesn't return anything. I am trying to obtain the workspace GUID and project GUID for the projects in WS-30268 so that I can obtain the SBOM.

Here is my current snippet from the yaml file for the SCA Task. Am I using the REST API call correctly to obtain the workspace info?

- task: CmdLine@2

  displayName: SCA Scan 

  enabled: true

  inputs:

    script: |

      export SCM_URI='https://$(Application_Profile_name)'

      export SRCCLR_API_TOKEN=$(SRCCLR_API_TOKEN)

      export scaDownloadUrl=https://download.srcclr.com/ci.sh

      export SCM_REF_TYPE=branch

      # make sure the branch name is set appropriately for the below scm_ref 

      export SCM_REF=main

      export SCM_REV=1.0

      curl -sSL $scaDownloadUrl | env DEBUG=1 bash -s scan --scm-uri $SCM_URI --scm-rev $SCM_REV --scm-ref $SCM_REF --scm-ref-type $SCM_REF_TYPE

      curl -u 'GET' \

        'https://api.veracode.com/srcclr/v3/workspaces?filter%5Bworkspace%5D=WS-30268' \

        -H 'accept: application/json'