The DependencyTrack API returns, for the /bom/cyclonedx/project/{uuid} return a BOM which is JSON, except it's a string. The code generator then expects a string, but the client has already tried and succeeded to deserialize it into JSON.
We should have a better think how to decide the intial requests.Response so that we handle this case better.