For modifying Bill of Materials (BoM), you need to use the Product endpoint. The request would look like this (replace dev with your account):

curl --request POST \
     --url https://app.finaleinventory.com/dev/api/product/100000 \
     --header 'authorization: Basic XXX' \
     --data '{"productAssocList":[{"productAssocTypeId":"MANUF_COMPONENT","productAssocUrl":"/dev/api/productassoc/100000","productAssocItemList":[{"productUrl":"/dev/api/product/100001","quantity":8}]}],"productId":"100000","productUrl":"/dev/api/product/100000"}'

Breaking out the data sent for the request:

{  
  "productAssocList": [  
    { "productAssocTypeId": "MANUF_COMPONENT",  
      "productAssocUrl": "/dev/api/productassoc/100000",  
      "productAssocItemList": [  
        { "productUrl": "/dev/api/product/100001", "quantity": 8 }  
      ]  
    }  
  ],  
  "productId": "100000",  
  "productUrl": "/dev/api/product/100000",
}

The productAssocUrl for the specific productAssocList needs to be correct. When creating a new productAssocList from an empty product, you can exclude the productAssocUrl. In all other cases, you must specify the productAssocUrl. This is a bug where if you don’t specify a productAssocUrl when updating the productAssocList, it will create a new productAssocList entry instead of replacing the existing entry. This extra entry will not be picked up by builds in the UI or in imports.

The UI / Imports only pulls the first productAssocList entry. All other entries will be ignored.

The other values included are the minimum values required for this request.

productAssocList: list of product BoMs (Our UI / Imports only support a single BoM, even though our API is capable of multiple)
productAssocUrl: The unique identifier for the productAssocList entry. Our UI / Imports only pull the first entry for this list, so the productAssocUrl needs to be specified for all update operations
productAssocTypeId: will always be “MANUF_COMPONENT” in the case of BoMs
productAssocItemList: The associated item list for the BoM. Each entry must have a productUrl and a quantity to be valid
productId, productUrl: Both the productId and productUrl are required for any updates to the product API

Just a note, product urls need to be pulled from the product collection. We use a different internal identifier than what is visible from the product ID, so the product URL is not always /dev/api/product/PRODUCT_ID.