hi @MMandoiu833310 (Community Member)​ 

To generate an SBOM for a sandbox, you would first need to promote the sandbox scan to a policy scan, which then gets linked to an application profile. After this, you can use the API to generate the SBOM for the application profile.

Here's a general outline of how it works:

• Complete the Sandbox Scan: Ensure the sandbox scan has completed successfully.

• Promote the Scan:
  • Via Veracode Platform: Navigate to the application, then to the specific sandbox, and select the option to promote the scan. You may have an option to delete the sandbox after promotion.

• Via API: Use the promotesandbox.do XML API call or its REST API equivalent (POST/appsec/v1/applications/{applicationGuid}/sandboxes/{sandboxGuid}/promote). You'll need to provide the build_id of the scan you wish to promote. You can also specify if you want to delete the sandbox after promotion.

Once a sandbox scan is promoted, it counts towards your application's policy compliance score.

Refer to the docs:

• Scan code in a sandbox for details on how to promote a scan through the Veracode Platform.
• promotesandbox.do for information on the XML API call.
• The Development Sandbox API documentation for the REST API equivalent.

After promoting the sandbox scan to a policy scan, you can then use the SBOM API to generate an SBOM for that application profile.