{ "openapi": "3.0.0", "x-hideTryItPanel": true, "info": { "version": "Cortex Cloud", "title": "ASPM, CICD and Application Security APIs", "description": "Enhance your security operations and automation capabilities using the ASPM, CICD and Application Security APIs to optimize the management of applications, repositories, data sources, rules, policies, and scans.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "license": { "name": "Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "servers": [ { "url": "https://api-yourfqdn" } ], "paths": { "/public_api/appsec/v1/billing/contributors": { "get": { "operationId": "GetContributors", "summary": "Get Billing Contributors", "description": "Returns a list of unique repository users who are considered **active contributors** for billing calculations. \n\nAn active contributor is defined as a unique (by email), non-bot human user who has committed code within the last 90 days to a billable, non-archived repository that has at least one security scanner enabled.\n\n> **Note:** You must have the **Instance Administrator** permissions to run this endpoint.\n\n> **Required license**:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Billing" ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/RepositoryUser" }, "type": "array" }, "examples": { "Example 1": { "value": [ { "name": "Jane Doe", "userName": "janedoe", "email": "janedoe@example.com", "repositoryId": "a1b2c3d4e5f6a7b8c9d0e1f2a", "creationDate": "2025-06-01T08:00:00.000Z", "lastCommitDate": "2025-02-15T10:30:00.000Z", "role": "WRITE", "hasMfa": true, "teams": [ "backend-team", "security-team" ], "isGuest": false, "isContributor": true, "isAdmin": false, "emailOrigin": "GIT", "uniqueVcsId": "vcs-user-67890" }, { "name": "John Smith", "userName": "johnsmith", "email": "johnsmith@example.com", "repositoryId": "repo-xyz-67890", "creationDate": "2025-03-15T12:00:00.000Z", "lastCommitDate": "2025-01-20T14:45:00.000Z", "role": "DEVELOPER", "hasMfa": false, "teams": [ "frontend-team" ], "isGuest": false, "isContributor": true, "isAdmin": false, "emailOrigin": "API", "uniqueVcsId": "vcs-user-11223" } ] } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "description": "Internal Server Error" } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/application/configuration": { "get": { "operationId": "GetApplicationSettingsConfiguration", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApplicationConfigurationSettings" }, "examples": { "Example 1": { "value": { "keepApplicationRefresh": true, "areSbomIssuesConsideredNew": true, "sla": { "CRITICAL": { "targetDays": 7 }, "HIGH": { "targetDays": 14 }, "MEDIUM": { "targetDays": 30 }, "LOW": { "targetDays": 90 }, "approaching": { "targetDays": 5 } } } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "summary": "Get an application configuration", "tags": [ "Applications" ], "description": "Retrieves the application configuration settings.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/application": { "post": { "operationId": "CreateApplication", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CrudResponse" } } }, "headers": {} }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_NotFoundError", "message": "Some assets do not exist in the database." } }, "properties": { "errorCode": { "type": "string", "description": "Displays the error code.", "example": "\"errorCode\": \"_NotFoundError\"" }, "message": { "type": "string", "description": "Displays the error message.", "example": "\"message\": \"Some assets do not exist in the database.\"" } } } } } }, "409": { "description": "Conflict. Occurs when an application with the specified name already exists.\n\n**Resolution**\n\nProvide a unique name for the application.\n\n", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_ConflictError", "message": "Application is already exists" } }, "properties": { "errorCode": { "type": "string", "description": "Displays the error code.", "example": "\"errorCode\": \"_ConflictError\"" }, "message": { "type": "string", "description": "Displays the error message.", "example": "\"message\": \"Application already exists\"" } } }, "examples": { "Example 1": { "value": { "error": "string", "message": "string" } } } } } }, "500": { "description": "Internal Server Error. Occurs when the server encounters an unexpected condition that prevents it from fulfilling the request.\n\n**Resolution**\n\nThis is a server-side issue. No action is required from you. If the problem persists, try again later.\n", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "InternalServerError", "message": "Internal Server Error" } }, "properties": { "errorCode": { "type": "string", "default": "InternalServerError" }, "message": { "type": "string", "default": "Internal Server Error" } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateApplicationRequest" }, "examples": { "Example 1": { "value": { "name": "test-app", "businessCriticality": "Low", "businessUnit": "string", "creationType": "Auto", "description": "string", "businessOwner": [], "devOwner": [], "devOpsOwner": [], "productManager": [], "assetSelection": { "selectionType": "filter", "section": "code", "filter": { "values": [ "928aa0b599d2df33978d958e96d146fc299ac68f02fda5cc376440f41452c2e0" ], "provider": "GITHUB", "filterType": "REPOSITORY" }, "assetIds": [] } } } } } } }, "x-scope": [ "external" ], "summary": "Create an application", "tags": [ "Applications" ], "description": "Creates a new application asset based on the provided details, such as name, criticality, and asset selection.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." }, "get": { "operationId": "GetApplications", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BasicPaginatedResponse_ExtendedFields-Array_" } } } } }, "security": [], "parameters": [ { "in": "query", "name": "page", "required": false, "schema": { "format": "double", "type": "number" }, "description": "Page number of the results to retrieve for pagination." }, { "in": "query", "name": "pageSize", "required": false, "schema": { "format": "double", "type": "number" }, "description": "Number of records returned per page." }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "summary": "Get applications", "tags": [ "Applications" ], "description": "Retrieves a list of all application assets using pagination.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n" } }, "/public_api/appsec/v1/application/{applicationId}": { "get": { "operationId": "GetApplication", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExtendedFields" }, "examples": { "Example 1": { "value": { "criteriaId": "string", "risk": -1.7976931348623157e+308, "id": "string", "strongId": "string", "name": "string", "description": "string", "exposures": [ "DeployedToProduction" ], "coverage": -1.7976931348623157e+308, "businessCriticality": "Critical", "businessUnit": "string", "creationType": "Auto", "businessOwner": [ "string" ], "devOwner": [ "string" ], "devOpsOwner": [ "string" ], "productManager": [ "string" ], "environments": "string", "assetsCount": -1.7976931348623157e+308, "config": { "lastRefreshDate": "2019-08-24T14:15:22Z", "assetSelection": { "selectionType": "filter", "section": "code", "filter": { "values": [ "string" ], "provider": "CIRCLE_CI", "filterType": "REPOSITORY" }, "assetIds": [ "string" ] } }, "updatedAt": "2019-08-24T14:15:22Z", "deletedAt": "2019-08-24T14:15:22Z", "enrichStatus": "IN_PROGRESS" } } } } } } }, "security": [], "parameters": [ { "in": "path", "name": "applicationId", "description": "Unique ID of the Application", "required": true, "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "summary": "Get an application", "tags": [ "Applications" ], "description": "Retrieves detailed information for a specific application asset using its unique ID.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n" }, "put": { "operationId": "UpdateApplication", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CrudResponse" } } } } }, "security": [], "parameters": [ { "in": "path", "name": "applicationId", "description": "Unique ID of the Application", "required": true, "schema": { "type": "string" } }, { "in": "header", "name": "x-cas-trace-id", "required": false, "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateApplicationRequest" } } } }, "x-scope": [ "external" ], "summary": "Update an application", "tags": [ "Applications" ], "description": "Updates the attributes of an existing application asset identified by its unique ID.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n" }, "delete": { "operationId": "DeleteApplicationById", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "properties": { "message": { "type": "string" } }, "required": [ "message" ], "type": "object" } } } } }, "security": [], "parameters": [ { "in": "path", "name": "applicationId", "description": "Unique ID of the Application", "required": true, "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "summary": "Delete an application", "tags": [ "Applications" ], "description": "Deletes a specific application asset identified by its unique ID.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on." } }, "/public_api/appsec/v1/application/{applicationId}/assets/addable": { "get": { "operationId": "GetAddableAssets", "summary": "List addable assets", "description": "Returns assets that can be added to the specified application. Use this endpoint to find assets that are not currently associated with the application and manually add them to improve the application's asset inventory. Use the optional `filter` parameter to return specific subsets of assets, such as orphan assets, recently discovered assets, or assets with shared contributors. Results are paginated, with pages starting at `1`.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.", "parameters": [ { "in": "path", "name": "applicationId", "required": true, "description": "The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.", "schema": { "type": "string" } }, { "in": "query", "name": "page", "required": false, "description": "The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.", "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "pageSize", "required": false, "description": "The number of assets to return on each page.", "schema": { "format": "double", "type": "number", "default": 100, "maximum": 500 } }, { "in": "query", "name": "filter", "required": false, "description": "A predefined filter that limits the assets returned. Supported values:\n- `RecentlyDiscovered`: Returns assets ingested into UAI within the last 7 days.\n- `OrphanAssets`: Returns assets that are not associated with any application.\n- `SameContributors`: Returns assets whose contributors overlap with contributors of assets already associated with the application.", "schema": { "$ref": "#/components/schemas/AddableAssetFilter" } }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "A paginated list of the assets that you can add to the application.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetManageableAssetsResponse" }, "examples": { "Addable assets": { "value": { "items": [ { "assetId": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "assetName": null, "assetTypeCategory": "Other", "assetTypeId": "AWS_BACKUP_PROTECTED_RESOURCES", "assetTypeClass": "Other", "assetProvider": "AWS", "assetCloudRegion": "us-east-1" }, { "assetId": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0", "assetName": "example.com", "assetTypeCategory": "Certificate", "assetTypeId": "TLS_CERTIFICATE", "assetTypeClass": "External Surface", "assetProvider": "OTHER", "assetCloudRegion": "" } ], "currentPage": 1, "totalPages": 37312, "pageSize": 3, "totalItems": 111935 } } } } } } }, "security": [], "x-scope": [ "external" ], "tags": [ "Applications" ] } }, "/public_api/appsec/v1/application/{applicationId}/assets/removable": { "get": { "operationId": "GetRemovableAssets", "summary": "List removable assets", "description": "Returns assets that can be removed from the specified application. Use this endpoint to identify assets that are currently associated with the application and are eligible for manual removal. Results are paginated, with pages starting at `1`.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.", "parameters": [ { "in": "path", "name": "applicationId", "required": true, "description": "The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.", "schema": { "type": "string" } }, { "in": "query", "name": "page", "required": false, "description": "The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.", "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "pageSize", "required": false, "description": "The number of assets to return on each page.", "schema": { "format": "double", "type": "number", "maximum": 500, "default": 100 } }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "required": true, "name": "Authorization", "description": "{api_key}" }, { "schema": { "type": "string", "example": "1" }, "in": "header", "required": true, "name": "x-xdr-auth-id", "description": "{api_key_id}" } ], "responses": { "200": { "description": "A paginated list of the assets that you can remove from the application.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetManageableAssetsResponse" }, "examples": { "Removable assets": { "value": { "items": [ { "assetId": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "assetName": "example-collaborator", "assetTypeCategory": "Human Identity", "assetTypeId": "VCS_COLLABORATOR", "assetTypeClass": "Identity", "assetProvider": "GITHUB", "assetCloudRegion": null }, { "assetId": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0", "assetName": "example-org/finance-app-code", "assetTypeCategory": "Repository", "assetTypeId": "GITHUB_REPOSITORY", "assetTypeClass": "Code", "assetProvider": "GITHUB", "assetCloudRegion": null } ], "currentPage": 1, "totalPages": 41, "pageSize": 5, "totalItems": 204 } } } } } } }, "security": [], "x-scope": [ "external" ], "tags": [ "Applications" ] } }, "/public_api/appsec/v1/application/{applicationId}/assets/override": { "post": { "operationId": "OverrideAssets", "summary": "Add or remove assets", "description": "Adds or removes assets from the specified application. Set the `operation` field to `ADD` to associate the specified assets with the application, or to `REMOVE` to disassociate them. Each request creates a single override action and returns an `actionId` that identifies the operation and all affected assets. You can use this `actionId` to undo the operation with **Revert asset override action**.\n\nTo identify assets that can be added, use **List addable assets**. To identify assets that can be removed, use **List removable assets**.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.", "parameters": [ { "in": "path", "name": "applicationId", "required": true, "description": "The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.", "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "required": true, "name": "Authorization", "description": "{api_key}" }, { "schema": { "type": "string", "example": "1" }, "in": "header", "required": true, "name": "x-xdr-auth-id", "description": "{api_key_id}" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverrideAssetsRequest" }, "examples": { "Add assets": { "summary": "Add two assets to the application", "value": { "assetIds": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90", "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0" ], "operation": "ADD" } }, "Remove assets": { "summary": "Remove one asset from the application", "value": { "assetIds": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" ], "operation": "REMOVE" } }, "Add assets with a filter": { "summary": "Add an asset and store a filter expression with the action", "value": { "assetIds": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" ], "operation": "ADD", "filter": "assetProvider=AWS" } } } } } }, "responses": { "200": { "description": "The override action completed. The response includes the action identifier and the assets that were processed.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverrideAssetsResponse" }, "examples": { "Successful add": { "summary": "All assets processed successfully", "value": { "success": true, "actionId": "11111111-2222-3333-4444-555555555555", "processed": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" ], "failed": [] } } } } } }, "404": { "description": "The specified application was not found. This endpoint validates the `applicationId` and returns this error when no matching application exists.", "content": { "application/json": { "examples": { "Application not found": { "value": { "errorCode": "_NotFoundError", "message": "[getApplication] Could not find matching application with id a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90." } } }, "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_NotFoundError", "message": "[getApplication] Could not find matching application with id a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90." } }, "properties": { "errorCode": { "type": "string", "description": "Error code or message" }, "message": { "type": "string", "description": "Detailed error message with resolution." } } } } } }, "422": { "description": "The request failed validation. For example, the `operation` field is missing, the `operation` value is not one of `ADD` or `REMOVE`, or `assetIds` is empty.", "content": { "application/json": { "examples": { "Invalid operation value": { "value": { "errorCode": "ValidateError", "message": "Validation Failed", "details": { "body.operation": { "message": "should be one of the following; ['ADD','REMOVE']", "value": "FOO" } } } } }, "schema": { "type": "object", "x-examples": { "Example 1": { "value": { "errorCode": "ValidateError", "message": "Validation Failed", "details": { "body.operation": { "message": "should be one of the following; ['ADD','REMOVE']", "value": "FOO" } } } } }, "properties": { "value": { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error code" }, "message": { "type": "string", "description": "Error message" }, "details": { "type": "object", "description": "Error details", "properties": { "body.operation": { "type": "object", "properties": { "message": { "type": "string" }, "value": { "type": "string" } } } } } } } } } } } } }, "security": [], "x-scope": [ "external" ], "tags": [ "Applications" ] } }, "/public_api/appsec/v1/application/{applicationId}/assets/overrides": { "get": { "operationId": "GetOverrides", "summary": "List override actions", "description": "Returns the history of manual asset override actions for the specified application. Each entry represents a single add or remove action and includes the affected assets, the operation, the user who performed it, and the timestamp when it was created. Results are paginated, with pages starting at 1.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.", "parameters": [ { "in": "path", "name": "applicationId", "required": true, "description": "The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.", "schema": { "type": "string" } }, { "in": "query", "name": "page", "required": false, "description": "The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.", "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "pageSize", "required": false, "description": "The number of override actions to return on each page.", "schema": { "format": "double", "type": "number", "default": 100, "maximum": 500 } }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "required": true, "description": "{api_key}" }, { "schema": { "type": "string", "example": "1" }, "in": "header", "required": true, "name": "x-xdr-auth-id", "description": "{api_key_id}" } ], "responses": { "200": { "description": "A paginated list of the override actions that were applied to the application.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BasicPaginatedResponse_ApplicationAssetOverrideResponse-Array_" }, "examples": { "Overrides present": { "summary": "One add override action exists", "value": { "data": [ { "actionId": "11111111-2222-3333-4444-555555555555", "assetIds": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" ], "operationType": "ADD", "userEmail": "user@example.com", "filter": null, "createdAt": "2026-07-31T05:55:43" } ], "hasNext": false } }, "No overrides": { "summary": "The application has no override actions", "value": { "data": [], "hasNext": false } } } } } } }, "security": [], "x-scope": [ "external" ], "tags": [ "Applications" ] } }, "/public_api/appsec/v1/application/{applicationId}/assets/overrides/{actionId}": { "delete": { "operationId": "RevertOverrides", "summary": "Revert asset override action", "description": "Reverts a manual asset override action by its `actionId`. Reverting an action undoes the add or remove operation for all assets affected by that override action. To find the `actionId`, use the value returned by **Add or remove assets** or the `actionId` value from **List override actions**.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.", "parameters": [ { "in": "path", "name": "applicationId", "required": true, "description": "The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.", "schema": { "type": "string" } }, { "in": "path", "name": "actionId", "required": true, "description": "The unique identifier of the override action to revert. Retrieve this value from the `actionId` field in the response of Add or remove assets or List override actions.", "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "The override action was reverted. The response lists the assets whose override was undone.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevertOverridesResponse" }, "examples": { "Successful revert": { "value": { "success": true, "reverted": [ "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" ] } } } } } }, "404": { "description": "The resource was not found. This endpoint returns this error when the specified application does not exist, or when no override action matches the specified action identifier in the application.", "content": { "application/json": { "examples": { "Action not found": { "summary": "The application exists but the action identifier does not match any override", "value": { "errorCode": "_NotFoundError", "message": "No overrides found for actionId '11111111-2222-3333-4444-555555555555' in application 'a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90'" } }, "Application not found": { "summary": "The specified application does not exist", "value": { "errorCode": "_NotFoundError", "message": "[getApplication] Could not find matching application with id a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90." } } }, "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_NotFoundError", "message": "No overrides found for actionId '11111111-2222-3333-4444-555555555555' in application 'a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90'" } }, "properties": { "errorCode": { "type": "string", "description": "Error code or message" }, "message": { "type": "string", "description": "Detailed error message." } } } } } } }, "security": [], "x-scope": [ "external" ], "tags": [ "Applications" ] } }, "/public_api/appsec/v1/policies": { "post": { "tags": [ "Policies" ], "summary": "Create an AppSec policy", "description": "Creates a new Application Security policy.\n\nAn application security policy defines how a system responds to application security threats. Each policy consists of **Conditions**, **Scope**, **Triggers**, and **Actions**. \n\n**Triggers** determine the execution context, such as a Pull Request, CI pipeline, registry scan, or periodic code scan, while **Actions** are executed only when both the **Condition** and **Scope** criteria are met. \n\n**Actions** can include generating a remediation issue for detection or actively blocking threats within the PR or CI workflow. \n\n> **Note:** To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\n\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n\n#### Limitations\n\nBe aware of the following limitations when creating policies:\n\n##### Trigger and Action Constraints by Finding Type\n\n2. **Code & Image scanners Finding Types** (for example, `IAC_MISCONFIGURATION`, `SECRETS`, `VULNERABILITY`, `LICENSES`, `OPERATIONAL_RISK`, `CODE_WEAKNESS`, and `MALWARE`)\n\n * For **scope filters**, only the following parameters are supported:\n * Category\n * Asset Type\n * Provider\n * Business Application Names\n * Application Business Criticality\n * Application Business Owner\n * Tags\n * Image Names\n * Source Branch\n * Repository Name\n * Repository Id\n * Is Public Repository\n * Has Deployed Assets\n * Has Internet-exposed deployed assets\n * Has deployed assets with Access to sensitive data\n * Has deployed assets with privileged capabilities\n * Repository labels\n * Image Architecture\n * Organization URL\n * The `category` parameter only supports `Application`, `Container Image` and `Repository` values. \n * Setting the `overrideIssueSeverity` parameter is mandatory when `ciImage` or `imageRegistry` actions are enabled.\n\n2. **CI/CD Risks Finding Type** (`CICD_RISKS`)\n\n * Only the Code **Periodic Scan** trigger is supported.\n * Only the **reportIssue** action is available.\n * For **conditions**, the `category` parameter supports only the following values:\n * Category\n * Application\n * CI/CD Instance\n * CI/CD Pipeline\n * VCS Collaborator\n * VCS Organization\n * For **scope filters**, only the following parameters are supported:\n * Asset Type\n * Provider\n * Tags\n * Business Application Names\n * Application Business Criticality\n * CI/CD Instance Name\n * CI/CD Instance Id\n * CI/CD Pipeline Name\n * CI/CD Pipeline Id\n * VCS Collaborator Name\n * VCS Collaborator Email\n * VCS Collaborator MFA Enabled\n * VCS Collaborator Last Observed\n * VCS Organization Name\n * Repository Name\n * Repository Id\n * Is Public Repository\n \n3. **Drift Finding Type** (`DRIFT`)\n\n * Only the Code **Periodic Scan** trigger is supported.\n * Only the **reportIssue** action is available.\n * For **conditions**, the `category` parameter only supports `Application` and `Repository` values.\n * For **scope filters**, only the following parameters are supported:\n * Category\n * Provider\n * Business Application Names\n * Application Business Criticality\n * Application Business Owner\n * Cloud Account\n * Cloud Region\n * Repository Name\n * Repository Id\n * Is Public Repository\n * Has Deployed Assets\n * Has Internet-exposed deployed assets\n * Has deployed assets with Access to sensitive data\n * Has deployed assets with privileged capabilities\n\n##### General Policy Constraints\n1. **Third-Party Integration Data**\n\n * For ingested data from third-party integrations:\n\n * Only the **periodic** scan trigger is supported, along with the `ingestedData` action that must be explicitly configured.\n\n\n2. **Multiple Finding Types in Conditions**\n\n * When selecting multiple `Finding Type` values within a single condition, only common filters across those types are available.\n * To use filters specific to a `Finding Type`, add another condition group that is separated by the **OR** operator.\n\n3. **Condition and Scope Depth**\n\n * The UI supports up to **2 levels** of depth for conditions and scope.\n * The API allows up to **10 levels** of depth for more complex policy configurations.\n\n4. **Scope vs. Asset Groups**\n\n * You must define either a **scope** (detailed asset filters) or specify **assetGroupIds**, but **not** both in the same policy.\n * If both fields are defined (contain values), then only the **assetGroupIds** will be applied and the **scope** will be ignored.\n\n5. **Empty Results during Configuration**\n\n * `Conditions` and `scope` filters may return **empty results** during policy configuration.\n * Policies can still be saved for future use. \n * Once the policies are active, they will evaluate the conditions and trigger defined actions if matching results are found.\n", "operationId": "CreatePolicy", "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRequest" }, "examples": { "Code and Image Scanners Policy": { "value": { "name": "Critical vulnerabilities in code deployed to internet-exposed assets", "description": "Detects critical and high-severity vulnerabilities on deployed assets with internet exposure.", "conditions": { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VULNERABILITY" }, { "OR": [ { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] } ] }, "scope": { "AND": [ { "SEARCH_FIELD": "has_internet_exposed", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true } ] }, "assetGroupIds": [], "triggers": { "periodic": { "isEnabled": true, "actions": { "reportIssue": true } }, "pr": { "isEnabled": true, "actions": { "reportIssue": true, "blockPr": true, "reportPrComment": true }, "overrideIssueSeverity": null }, "cicd": { "isEnabled": true, "actions": { "reportIssue": true, "blockCicd": true, "reportCicd": true }, "overrideIssueSeverity": null }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false }, "overrideIssueSeverity": null } } } }, "CI/CD Configuration Scanners Policy": { "value": { "name": "Critical CI/CD configuration risks", "description": "Detects critical and high severity CI/CD risks across pipelines and instances.", "conditions": { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CICD_RISKS" }, { "OR": [ { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" } ] } ] }, "scope": { "AND": [ { "SEARCH_FIELD": "repository_provider", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "GITHUB" } ] }, "assetGroupIds": [], "triggers": { "periodic": { "isEnabled": true, "actions": { "reportIssue": true } }, "pr": { "isEnabled": false, "actions": { "reportIssue": false, "blockPr": false, "reportPrComment": false }, "overrideIssueSeverity": null }, "cicd": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false }, "overrideIssueSeverity": null } } } }, "Drift Detection Scanner Policy": { "value": { "name": "Critical IaC drift detection", "description": "Detects critical and high severity IaC drift findings between deployed infrastructure and IaC definitions.", "conditions": { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "DRIFT" }, { "OR": [ { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] } ] }, "scope": {}, "triggers": { "periodic": { "isEnabled": true, "actions": { "reportIssue": true }, "overrideIssueSeverity": "Critical" }, "pr": { "isEnabled": false, "actions": { "reportIssue": false, "blockPr": false, "reportPrComment": false }, "overrideIssueSeverity": null }, "cicd": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false }, "overrideIssueSeverity": null } } } }, "Image scan policy with all triggers": { "value": { "name": "Image scan policy", "description": "Detects vulnerabilities, secrets, and malware with CI Image Scan and Registry Image Scan triggers enabled.", "conditions": { "OR": [ { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SECRETS" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" } ] }, { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VULNERABILITY" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] }, { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "MALWARE" } ] } ] }, "scope": {}, "triggers": { "periodic": { "isEnabled": false, "actions": { "reportIssue": false }, "overrideIssueSeverity": null }, "pr": { "isEnabled": false, "actions": { "reportIssue": false, "blockPr": false, "reportPrComment": false }, "overrideIssueSeverity": null }, "cicd": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "ciImage": { "isEnabled": true, "actions": { "reportIssue": true, "blockCicd": true, "reportCicd": false }, "overrideIssueSeverity": "Medium" }, "imageRegistry": { "isEnabled": true, "actions": { "reportIssue": true }, "overrideIssueSeverity": "Low" } } } } } } } }, "responses": { "204": { "description": "No content" }, "400": { "description": "Bad Request\r\n\r\nThe error occurs when the server cannot process the request due to client-side errors in the request body. The error is returned when: \r\n* Required fields are missing\r\n* Field values are invalid (for example, incorrect `SEARCH_TYPE` for the given `SEARCH_FIELD`)\r\n* The JSON request body is not structured properly (invalid payload structure)", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "error": "Bad Request", "message": "Invalid value for 'name': must not be empty." } }, "properties": { "error": { "type": "string", "description": "The HTTP error category. Indicates the general type of error that occurred." }, "message": { "type": "string", "description": "A human-readable message with specific details about why the request failed." } } }, "examples": { "Example 1": { "value": { "error": "Bad Request", "message": "Invalid value for 'name': must not be empty." } } } } } }, "409": { "description": "Conflict.\r\n\r\n**Resolution**\r\n\r\nUse a unique policy name that does not match any existing policy.\r\n\r\n", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "error": "Conflict", "message": "A policy with the name 'test_cicdscanners' already exists." } }, "properties": { "error": { "type": "string", "description": "The HTTP error category. Indicates the general type of error that occurred." }, "message": { "type": "string", "description": "A human-readable message with specific details about why the request failed." } } }, "examples": { "Example 1": { "value": { "error": "Conflict", "message": "A policy with the name 'Critical vulnerabilities on internet-exposed assets' already exists." } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "error": "Internal Server Error", "message": "An unexpected error occurred. Please try again later." } }, "properties": { "error": { "type": "string", "description": "The HTTP error category. Indicates the general type of error that occurred." }, "message": { "type": "string", "description": "A human-readable message with specific details about why the request failed." } } }, "examples": { "Example 1": { "value": { "error": "Internal Server Error", "message": "An unexpected error occurred. Please try again later." } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "get": { "operationId": "GetPolicies", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/Policy" }, "type": "array" }, "examples": { "Example 1": { "value": [ { "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "name": "Block Build and Pull Request on Valid secrets", "description": "Block Build and Pull Request on Valid secrets in public repository", "status": "disabled", "isCustom": false, "triggers": { "periodic": { "isEnabled": false, "actions": { "reportIssue": false } }, "pr": { "isEnabled": true, "actions": { "reportIssue": false, "reportPrComment": false, "blockPr": true } }, "cicd": { "isEnabled": true, "actions": { "reportIssue": false, "reportCicd": false, "blockCicd": true } }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "reportCicd": false, "blockCicd": false } }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false } } }, "isClonable": true, "isEditable": false, "policyType": "code_image_scanners", "conditions": { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SECRETS" }, { "SEARCH_FIELD": "Secret Validity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VALID" } ] }, "relatedDetectionRules": [], "scope": { "AND": [ { "SEARCH_FIELD": "is_public_repository", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true } ] }, "createdBy": "system", "modifiedBy": null, "deletedBy": null, "version": 1, "assetGroupIds": [] } ] } } } } } }, "security": [], "parameters": [ { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/FindingType" } }, "in": "query", "description": "Type of security finding that the policy targets.", "name": "findingTypes", "required": false }, { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UnifiedAction" } }, "in": "query", "name": "actions", "description": "Filter policies by action types" }, { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "schema": { "$ref": "#/components/schemas/PolicyStatus" }, "in": "query", "name": "status", "description": "Filter policies by status" }, { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Trigger" } }, "in": "query", "name": "triggers", "description": "Filter policies by trigger types", "required": false }, { "schema": { "type": "boolean" }, "in": "query", "name": "isCustom", "description": "Filter by custom policies (`true`) or system-provided policies (`false`)" } ], "x-scope": [ "external" ], "tags": [ "Policies" ], "summary": "List AppSec policies", "description": "Retrieves a list of all Application Security policies. You can filter the results by finding types, actions, status, triggers, and custom policy flag.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/rules": { "get": { "tags": [ "Rules" ], "summary": "Get AppSec rules", "description": "Get a paginated list of Application Security (AppSec) rules. Supports filtering by enabled state, custom flag, categories, sub-categories, cloud providers, scanners, severities, frameworks, and labels.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetRules", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "get-scanner-rule-id", "description": "Unique identifier for a scanner rule. When set to `true`, the `scannerRuleId` field is included in each rule object returned in the response. If omitted or set to `false`, the `scannerRuleId` field is excluded from the response. ", "in": "header", "required": false, "schema": { "type": "boolean" } }, { "name": "enabled", "in": "query", "description": "Filter rules by their enabled state. Set to `true` to return only active rules, or `false` to return only disabled rules. If omitted, rules of both states are returned.", "required": false, "schema": { "type": "boolean" } }, { "name": "isCustom", "in": "query", "required": false, "schema": { "type": "boolean" }, "description": "Filter rules by type. Set to `true` to return only custom rules, or `false` to return only out-of-the-box rules. If omitted, both rule types are returned." }, { "name": "categories", "in": "query", "deprecated": false, "allowEmptyValue": false, "explode": false, "schema": { "type": "array", "items": { "type": "string", "enum": [ "AI_ML", "LOGGING", "KUBERNETES", "COMPUTE", "STORAGE", "PUBLIC", "NETWORKING", "MONITORING", "IAM", "API_KEYS", "DATABASE_CREDENTIALS", "ENCRYPTION_KEYS", "CLOUD_SERVICE_PROVIDER_KEYS", "SSH_KEYS", "ENVIRONMENT_VARIABLES", "SENSITIVE_TOKENS", "THIRD_PARTY_SERVICES" ] } }, "description": "Custom AppSec rule category." }, { "name": "subCategories", "in": "query", "schema": { "type": "array", "items": { "type": "string" } }, "description": "Filter rules by subcategory. Subcategories further classify the type of security issue within a category and are applicable to `IAC` rules only. The supported subcategory values depend on the selected categories filter. `CICD`, `SCA`, and `SECRETS` rules do not have subcategories and are retured with a `null` value." }, { "name": "cloudProviders", "in": "query", "schema": { "type": "array", "items": { "type": "string", "enum": [ "ALIBABA_CLOUD", "AWS", "AZURE", "GCP", "IBM", "ORACLE", "OTHER" ] } }, "description": "Cloud provider associated with the rule. " }, { "name": "scanners", "in": "query", "description": "Filter rules by the type of security scanner used to detect findings.", "required": false, "schema": { "type": "array", "items": { "type": "string", "$ref": "#/components/schemas/Scanner" } } }, { "name": "severities", "in": "query", "description": "The priority level assigned to findings identified by the rule", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Severity" } } }, { "name": "frameworks", "in": "query", "description": "Filter rules by the IaC framework or language they apply to. Returns only rules that have a definition for at least one of the specified frameworks.", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/FrameworkName" } } }, { "name": "labels", "in": "query", "description": "Filter rules by one or more labels. Returns only rules that have all specified labels assigned.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "name": "offset", "description": "The number of rules to skip before returning results. Used for pagination together with `limit`. Set to 0 to start from the first result.", "in": "query", "required": false, "schema": { "type": "number", "format": "double", "default": 0 } }, { "name": "limit", "description": "The maximum number of rules to return per page. Used for pagination together with `offset`.", "in": "query", "required": false, "schema": { "type": "number", "format": "double", "default": 100 } }, { "name": "sortBy", "description": "The field by which to sort the returned rules.", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "created_at", "name", "labels" ], "default": "name" } }, { "name": "sortOrder", "in": "query", "required": false, "schema": { "$ref": "#/components/schemas/SortDirection" }, "description": "The sort direction for the results. Use `1` for ascending order and `-1` for descending order." } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetRulesResponseObject" } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "post": { "tags": [ "Rules" ], "summary": "Create an AppSec rule", "description": "Create a new Application Security Rule. Application Security rules are designed to detect security threats within your application security environment. Application Security rules identify and flag issues based on predefined criteria.\n\n**Limitation**: This API supports creating custom rules only for **IaC Security** and **Secrets Security**. CI/CD Security custom rules are **not** supported.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "CreateCustomRule", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrModifyCustomRuleRequestParams" }, "examples": { "IaC Security Rule": { "value": { "name": "S3 Bucket Public Access Check", "description": "Detects S3 buckets with public access enabled", "severity": "HIGH", "scanner": "IAC", "category": "PUBLIC", "subCategory": "STORAGE_BUCKETS", "cspmRuleId": "fddd75de-c838-472c-9b24-5c9127ba5405", "labels": [ "Custom-Rule", "S3-Security" ], "frameworks": [ { "name": "TERRAFORM", "definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false", "remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource" } ] } }, "Secrets Security Rule": { "value": { "name": "example secret rule", "description": "This is a secret rule description", "severity": "LOW", "scanner": "SECRETS", "labels": [ "my-label" ], "category": "API_KEYS", "frameworks": [ { "name": "GIT", "definition": "definition:\n cond_type: secrets\n value: AIza[0-9A-Za-z-_]{35}", "remediationDescription": "Revoke the GCP API key immediately through the Google Cloud Console." } ] } } } } } }, "responses": { "201": { "description": "Created. A new resource was created successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DetectionRule" }, "examples": {} } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "properties": { "errorCode": { "type": "string", "example": "_BadRequestError", "description": "The HTTP error category. Indicates the general type of error that occurred." }, "message": { "type": "string", "example": "Invalid subcategory for PUBLIC. Must be one of: ADMIN_INTERFACES, DATABASE_ENDPOINTS, STORAGE_BUCKETS, APIS, SENSITIVE_PORTS", "description": "A human-readable message with specific details about why the request failed." } } }, "examples": { "400 error": { "value": { "errorCode": "_BadRequestError", "message": "Invalid subcategory for PUBLIC. Must be one of: ADMIN_INTERFACES, DATABASE_ENDPOINTS, STORAGE_BUCKETS, APIS, SENSITIVE_PORTS" } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/rules/{ruleId}": { "get": { "tags": [ "Rules" ], "summary": "Get an AppSec rule", "description": "Get the details of the specified Application Security rule.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetRuleById", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "ruleId", "description": "Unique identifier of the Application Security rule", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DetectionRule" } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "patch": { "tags": [ "Rules" ], "summary": "Update an AppSec rule", "description": "Update an existing Application Security rule. If it's an out-of-the-box rule, the only modification you can make is to add labels. For custom rules, you can modify all of the fields.\n\n**Note:** To customize an out-of-the-box rule, you can create a custom rule by cloning the existing one. This allows you to make changes to the original rule according to your requirements.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "ModifyRule", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "ruleId", "description": "Unique identifier of the Application Security rule", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/CreateOrModifyCustomRuleRequestParams" }, { "$ref": "#/components/schemas/ModifyRuleParams" } ] }, "examples": {} } } }, "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModifyRuleResponseObject" }, "examples": { "Example 1": { "value": { "rule": { "category": "PUBLIC", "cloudProvider": null, "createdAt": { "value": "2024-01-01T00:00:00.000Z" }, "description": "Detects S3 buckets with public access enabled", "detectionMethod": "IaC Security", "domain": "POSTURE", "findingTypeId": 30040031, "frameworks": [ { "definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false\nmetadata:\n name: S3 Bucket Public Access Check\n category: public\n severity: high\n guidelines: Detects S3 buckets with public access enabled\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource", "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_", "isCustom": true, "isEnabled": true, "labels": [ "Custom-Rule", "S3-Security" ], "name": "s3 bucket public access check", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "subCategory": "STORAGE_BUCKETS", "updatedAt": { "value": "2024-02-01T00:00:00.000Z" }, "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Public Exposure Storage Buckets", "mitreTactics": [], "mitreTechniques": [], "shortDescription": null, "complianceStandards": [], "cspmRuleId": "", "cspmTypeId": 60100018 } } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "delete": { "tags": [ "Rules" ], "summary": "Delete an AppSec rule", "description": "Delete the specified Application Security rule.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "DeleteRuleById", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "ruleId", "description": "Unique identifier of the Application Security rule", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ] } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/rules/rule-labels": { "get": { "summary": "Get AppSec rule labels", "description": "Get a list of all of the Application Security rule labels.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetLabels", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetLabelsResponse" } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ], "tags": [ "Rules" ] }, "parameters": [] }, "/public_api/appsec/v1/rules/validate": { "post": { "operationId": "ValidateCustomRule", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateCodeResponse" } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/ValidateCustomRuleRequestParams" }, "type": "array" } } } }, "x-scope": [ "external" ], "summary": "Create an AppSec rule validation", "tags": [ "Rules" ], "description": "**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/repositories": { "get": { "tags": [ "Repositories" ], "summary": "Get repositories", "description": "Get details on all repositories integrated with Cortex Cloud Application Security, providing detailed information and insights into repository artifacts, configurations, and dependencies.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetRepositoryAssets", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "source", "in": "query", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/IntegrationType" } } }, { "name": "search", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "number" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "number" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Omit_Repository.assetId_" } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/repositories/{assetId}": { "get": { "tags": [ "Repositories" ], "summary": "Get a repository", "description": "Get details on the Application Security repository specified by its asset ID.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetRepositoryAssetByAssetId", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "assetId", "in": "path", "description": "Asset ID", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Omit_Repository.assetId_" } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "parameters": [ { "schema": { "type": "string" }, "name": "assetId", "in": "path", "required": true, "description": "Asset ID" } ] }, "/public_api/appsec/v1/repositories/{assetId}/scan-configuration": { "get": { "tags": [ "Repositories" ], "summary": "Get a repository scan configuration", "description": "Get the details of an Application Security scan configuration.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetAssetScanConfiguration", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "assetId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScanConfiguration" } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "put": { "tags": [ "Repositories" ], "summary": "Update a repository scan configuration", "description": "Update the configuration of an Application Security scan.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "UpdateAssetScanConfiguration", "parameters": [ { "schema": { "type": "string", "example": "your-api-key" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "assetId", "description": "The unique asset ID of the repository.", "in": "path", "required": true, "schema": { "type": "string" }, "example": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "excludedPaths": [], "prScanning": { "blockOnError": false, "isEnabled": false }, "taggingBot": { "tagModuleBlocks": false, "tagResourceBlocks": false }, "scanners": { "SECRETS": { "isEnabled": false, "scanOptions": { "secretValidation": false, "gitHistory": false } }, "SCA": { "isEnabled": false }, "IAC": { "isEnabled": false } } } }, "properties": { "excludedPaths": { "type": "array", "description": "A list of file or directory paths to exclude from scanning. Paths are relative to the repository root and support wildcard patterns.\n\n- **Exclude directories:** Enter folder names to exclude all files inside, such as `node_modules/`, `tests/`, `dist/`.\n- **Exclude files by pattern:** Use wildcards — `*` for any number of characters, `?` for a single character. For example, `.*.log` excludes all log files, `*.min.js` excludes all minified JavaScript files.\n- **Use a comma-separated list:** Separate multiple exclusions with commas. For example, `node_modules/, dist/, docs/`.\n- **Avoid leading slashes:** Use `dist/`, not `/dist/`.", "items": { "type": "string", "example": "tests/" } }, "prScanning": { "type": "object", "description": "Pull Request (PR) scan settings. PR scans are triggered by version control system events (GitHub, GitLab, Bitbucket, Azure Repos) or webhooks.", "required": [ "blockOnError", "isEnabled" ], "properties": { "blockOnError": { "type": "boolean", "description": "When `true`, pull requests (PRs) automatically fail on a scan error. This prevents security risks and misconfigurations from being merged into the codebase." }, "isEnabled": { "type": "boolean", "description": "When `true`, security scans automatically trigger on a pull request (PR) to identify potential security risks or misconfigurations before the code is merged." } } }, "taggingBot": { "type": "object", "description": "Configuration for the tagging bot. When enabled, automatically appends a unique `yor_trace` ID to resource and module blocks when a pull request is opened. This identifier enables precise code-to-cloud tracing throughout the software development lifecycle.", "required": [ "tagModuleBlocks", "tagResourceBlocks" ], "properties": { "tagModuleBlocks": { "type": "boolean", "description": "When `true`, the tagging bot automatically appends a unique `yor_trace` ID to IaC module blocks when a pull request is opened." }, "tagResourceBlocks": { "type": "boolean", "description": "When `true`, the tagging bot automatically appends a unique yor_trace ID to IaC resource blocks when a pull request is opened." } } }, "scanners": { "type": "object", "description": "Scanner settings to update", "properties": { "SECRETS": { "type": "object", "description": "Configure the Secrets scanner to identify hardcoded credentials, such as API keys, access tokens, private keys, and passwords, embedded in source code, configuration files, and Git history.", "required": [ "isEnabled" ], "properties": { "isEnabled": { "type": "boolean", "description": "When `true`, enables this scanner to run on the repository." }, "scanOptions": { "type": "object", "description": "Scanner-specific options for the Secrets scanner. These options control additional scanning behaviors.", "properties": { "secretValidation": { "type": "boolean", "description": "When `true`, enables secrets validation to check a detected secret's activity status via public APIs. This allows you to prioritize and address only active, exposed secrets. Secrets validation scanning is available through the Cortex Cloud tenant and IDE extensions." }, "gitHistory": { "type": "boolean", "description": "When `true`, enables Git history scanning to automatically detect secrets still present in the repository's past commits. By identifying these exposed credentials, you can proactively address risks and prevent potential data breaches." } } } } }, "SCA": { "type": "object", "description": "Configure the Software Composition Analysis (SCA) scanner to identify known vulnerabilities in your open-source dependencies.", "required": [ "isEnabled" ], "properties": { "isEnabled": { "type": "boolean", "description": "When `true`, enables this scanner to run on the repository." } } }, "IAC": { "type": "object", "description": "Configure the Infrastructure as Code (IaC) scanner to detect security risks and compliance violations in your IaC templates before deployment.", "required": [ "isEnabled" ], "properties": { "isEnabled": { "type": "boolean", "description": "When `true`, enables this scanner to run on the repository." } } } } } } }, "examples": { "Example 1": { "value": { "excludedPaths": [ "tests/" ], "prScanning": { "blockOnError": true, "isEnabled": true }, "taggingBot": { "tagModuleBlocks": true, "tagResourceBlocks": true }, "scanners": { "SECRETS": { "isEnabled": true, "scanOptions": { "secretValidation": true, "gitHistory": true } }, "SCA": { "isEnabled": true }, "IAC": { "isEnabled": true } } } } } } } }, "responses": { "204": { "description": "No content. Indicates that the Scan configuration updated successfully." } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/data_source_instances": { "get": { "tags": [ "Data Sources" ], "summary": "Get all Data Sources", "description": "Retrieve a list of all data source instances configured in your Cortex environment. You can filter the results by data source type and category.\n\n> **Required license:** \n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetDataSourceInstances", "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "type", "in": "query", "description": "Type of data source instance to retrieve.", "required": false, "schema": { "$ref": "#/components/schemas/UrlIntegrationType" } }, { "name": "type_category", "in": "query", "description": "Category of data source instances to retrieve.", "required": false, "schema": { "$ref": "#/components/schemas/UrlIntegrationTypeCategory" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "type": "array", "items": { "allOf": [ { "$ref": "#/components/schemas/Integration" }, { "type": "object", "required": [ "repositoriesCount" ], "properties": { "repositoriesCount": { "type": "number", "format": "double", "description": "Total number of repositories associated with this data source instance." } } } ] } }, "examples": { "Example 1": { "value": [ { "creationDate": "2025-06-15T09:30:00.000Z", "domain": { "hostname": "github.example.com", "protocol": "https" }, "id": "a1b2c3d4e5f6a7b8c9d0e1f2", "instanceVersion": "1.0.0", "lastUpdateDate": "2025-07-20T14:15:30.000Z", "scanTypes": { "SAST": { "isEnabled": true }, "SCA": { "isEnabled": false } }, "selectionType": "MANUAL_SELECTION", "selfSignedCertificate": "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIJAL...\n-----END CERTIFICATE-----", "state": [ "example-org/repo-alpha", "example-org/repo-beta" ], "status": "CONNECTED", "statusDetails": { "connection": { "status": "VALID", "message": "Connection established successfully", "timestamp": "2025-07-20T14:15:30.000Z" } }, "tenantId": "tenant-001", "transporter": { "brokerDeviceId": "broker-device-abc123", "connectionName": "on-prem-github-connection" }, "type": "GITHUB_ENTERPRISE", "typeCategory": "DEFAULT", "uniqueIdentifier": "example-org", "repositoriesCount": 12 }, { "creationDate": "2025-08-01T11:00:00.000Z", "domain": { "hostname": "api.example-vendor.io", "protocol": "https" }, "id": "b2c3d4e5f6a7b8c9d0e1f2a3", "lastUpdateDate": "2025-08-10T16:45:00.000Z", "scanTypes": { "SAST": { "isEnabled": true }, "SCA": { "isEnabled": true } }, "selectionType": "CURRENT_STATE_AND_FUTURE", "status": "CONNECTED", "type": "SNYK", "typeCategory": "EXTERNAL_VENDOR_INTEGRATIONS", "uniqueIdentifier": "snyk-default-org", "repositoriesCount": 5 }, { "creationDate": "2025-09-12T08:20:00.000Z", "id": "c3d4e5f6a7b8c9d0e1f2a3b4", "lastUpdateDate": "2025-09-12T08:20:00.000Z", "status": "CONNECTED", "type": "COLLECTOR", "uniqueIdentifier": "my-sast-collector", "repositoriesCount": 0 } ] } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "post": { "operationId": "CreateDataSourceInstance", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Integration" }, "examples": { "COLLECTOR creation response": { "value": { "creationDate": "2025-04-02T08:20:58.381Z", "id": "d4e5f6a7b8c9d0e1f2a3b4c5", "status": "CONNECTED", "type": "COLLECTOR", "uniqueIdentifier": "my-sast-collector", "lastUpdateDate": "2025-04-02T08:20:58.381Z", "credentials": { "webhookAuthKey": "your_webhook_auth_key_shown_only_once", "webhookAuthKeyId": 1 }, "detectionMethod": "SAST", "fileType": "SARIF", "apiUrl": "https://api-yourfqdn/public_api/appsec/v1/collectors/d4e5f6a7b8c9d0e1f2a3b4c5" } } } } } }, "422": { "description": "Validation error.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error code identifying the type of validation failure." }, "message": { "type": "string", "description": "Human-readable message describing the validation error." }, "details": { "type": "object", "description": "Detailed validation error information, keyed by field path.", "additionalProperties": { "type": "object", "properties": { "message": { "type": "string" } } } } } }, "examples": { "Missing required type field": { "value": { "errorCode": "ValidateError", "message": "Validation Failed", "details": { "body.type": { "message": "'type' is required" } } } }, "Duplicate name": { "value": { "errorCode": "_BadParamsError", "message": "Collector with name \"my-sast-collector\" already exists" } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateIntegrationBody" }, "examples": { "Create a COLLECTOR data source": { "value": { "type": "COLLECTOR", "uniqueProperties": { "name": "my-sast-collector", "detectionMethod": "SAST", "fileType": "SARIF" } } } } } } }, "x-scope": [ "external" ], "summary": "Create AppSec Data Sources", "tags": [ "Data Sources" ], "description": "Create a new data source instance to connect an external system to your Cortex environment.\n\n> **Required license:** \n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "x-internal": false } }, "/public_api/appsec/v1/data_source_instances/{id}": { "get": { "tags": [ "Data Sources" ], "summary": "Get an AppSec Data Source", "description": "Retrieve the details of a specific data source instance identified by its ID.\n\n> **Required license:** \n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetDataSourceInstance", "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "id", "in": "path", "description": "Unique ID of the data source instance to retrieve. You can retrieve this value from the `id` field in the response of [Get all Data Sources](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/data-sources#get-public_api-appsec-v1-data_source_instances) or [Create Appsec Data Sources](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/data-sources#post-public_api-appsec-v1-data_source_instances) endpoint.", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Integration" }, "examples": { "Github Enterprise response": { "value": { "creationDate": "2025-06-15T09:30:00.000Z", "domain": { "hostname": "github.example.com", "protocol": "https" }, "id": "a1b2c3d4e5f6a7b8c9d0e1f2", "instanceVersion": "1.0.0", "lastUpdateDate": "2025-07-20T14:15:30.000Z", "scanTypes": { "SAST": { "isEnabled": true }, "SCA": { "isEnabled": false } }, "selectionType": "MANUAL_SELECTION", "selfSignedCertificate": "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIJAL...\n-----END CERTIFICATE-----", "state": [ "example-org/repo-alpha", "example-org/repo-beta" ], "status": "CONNECTED", "statusDetails": { "connection": { "status": "VALID", "message": "Connection established successfully", "timestamp": "2025-07-20T14:15:30.000Z" } }, "tenantId": "tenant-001", "transporter": { "brokerDeviceId": "broker-device-abc123", "connectionName": "on-prem-github-connection" }, "type": "GITHUB_ENTERPRISE", "typeCategory": "DEFAULT", "uniqueIdentifier": "example-org" } } } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_NotFoundError", "message": "Integration d4e5f6a7b8c9d0e1f2a3b4c5 not found" } }, "properties": { "errorCode": { "type": "string", "description": "Error code identifying the type of error." }, "message": { "type": "string", "description": "Human-readable message describing the error." } } }, "examples": { "Example 1": { "value": { "errorCode": "_NotFoundError", "message": "Integration d4e5f6a7b8c9d0e1f2a3b4c5 not found" } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "put": { "tags": [ "Data Sources" ], "summary": "Update an AppSec Data Source", "description": "Update the configuration of an existing data source instance.\n\n> **Required license:** \n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "UpdateDataSourceInstance", "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "id", "in": "path", "description": "Unique ID of the data source instance to update. You can retrieve this value from the `id` field in the response of [Get all Data Sources](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/data-sources#get-public_api-appsec-v1-data_source_instances) or [Create Appsec Data Sources](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/data-sources#post-public_api-appsec-v1-data_source_instances) endpoint.", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateIntegrationPublicBody" }, "examples": { "Example 1": { "value": { "selectionType": "CURRENT_STATE", "state": [ "string" ], "externalProjects": [ { "branchName": "string", "externalBranchName": "string", "externalId": "string", "externalProjectId": "string", "repoId": "string" } ], "uniqueProperties": {} } }, "Update collector name": { "value": { "uniqueProperties": { "name": "my-collector-updated" } } } } } } }, "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Integration" }, "examples": { "Example 1": { "value": { "creationDate": "2025-09-12T08:20:00.000Z", "id": "d4e5f6a7b8c9d0e1f2a3b4c5", "instanceVersion": "1.0.0", "lastUpdateDate": "2025-10-05T16:30:00.000Z", "selectionType": "MANUAL_SELECTION", "state": [ "example-org/repo-alpha", "example-org/repo-beta" ], "status": "CONNECTED", "type": "COLLECTOR", "typeCategory": "DEFAULT", "uniqueIdentifier": "my-collector-updated", "detectionMethod": "SAST", "fileType": "SARIF", "apiUrl": "https://api-yourfqdn/public_api/appsec/v1/collectors/d4e5f6a7b8c9d0e1f2a3b4c5" } }, "COLLECTOR Update response": { "value": { "creationDate": "2025-04-02T08:20:58.381Z", "id": "d4e5f6a7b8c9d0e1f2a3b4c5", "status": "CONNECTED", "type": "COLLECTOR", "uniqueIdentifier": "my-collector-updated", "lastUpdateDate": "2025-04-02T08:21:47.023Z", "detectionMethod": "SAST", "fileType": "SARIF", "apiUrl": "https://api-yourfqdn/public_api/appsec/v1/collectors/d4e5f6a7b8c9d0e1f2a3b4c5" } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_InternalServerError", "message": "Failed to update data source instance" } }, "properties": { "errorCode": { "type": "string", "description": "Error code identifying the type of error." }, "message": { "type": "string", "description": "Human-readable message describing the error." } } }, "examples": { "Example 1": { "value": { "errorCode": "_InternalServerError", "message": "Failed to update data source instance" } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] }, "delete": { "tags": [ "Data Sources" ], "summary": "Delete an AppSec Data Source", "description": "Delete the specified data source instance from your Cortex environment.\n\n> **Required license:** \n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "DeleteDataSourceInstance", "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "id", "description": "Unique ID of the data source instance to delete.", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "204": { "description": "No content" } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/repositories/{assetId}/branches": { "get": { "tags": [ "Repositories" ], "summary": "Get AppSec repository branches", "description": "Get the details of the Application Security repository branches.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetScannedBranches", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "assetId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Branch" } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external", "internal" ] }, "put": { "tags": [ "Repositories" ], "summary": "Update an AppSec repository branch", "description": "Update the Application Security repository branch by indicating the primary branch.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "SetPersistBranches", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "assetId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetPersistBranchesApi" } } } }, "responses": { "204": { "description": "No content" } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external", "internal" ] } }, "/public_api/appsec/v1/scans/unscanned-repositories": { "get": { "tags": [ "Scan management" ], "summary": "Get unscanned AppSec scan management repositories", "description": "Get a list of Application Security repositories that have not been scanned. You can optionally filter by specifying the number of days past during which the repositories were not scanned.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetUnscannedRepos", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "days", "in": "query", "description": "Define the time period in days previous to now", "required": false, "schema": { "type": "number", "format": "double", "default": 7 } } ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BasicScanInfo" } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external", "internal" ] }, "parameters": [] }, "/public_api/appsec/v1/sbom/repository": { "get": { "tags": [ "SBOM management" ], "summary": "Get an SBOM for the specified repository", "description": "Get an SBOM (Software Bill of Materials) report for the specified repository.\n\nOnly the following combinations are supported:\n\n`format`: `cyclonedx`\n`fileType`: `json` or `xml`\n`version: `1.4` or `1.5` or `1.6`\n\n`format`: `spdx`\n`fileType`: `json` or `txt`\n`version: `2.3`\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "operationId": "GetSBOMReport", "parameters": [ { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "repoId", "required": true, "schema": { "type": "string" }, "description": "Unique identifier of the repository for which to retrieve the SBOM report.\n\nTo retrieve this value, call `GET /public_api/appsec/v1/repositories` and use the `id` field from each repository object in the response.", "example": "67db03bb1246ebdc5a86ca2d6cbb379391aa3d3c7639538aba9c47f6e5614e99" }, { "in": "query", "name": "branchName", "example": "main", "required": false, "schema": { "type": "string" }, "description": "Branch name for which you want to export the SBOM." }, { "in": "query", "name": "fileType", "required": false, "schema": { "type": "string", "enum": [ "json", "xml", "txt" ], "default": "xml", "example": "json" }, "description": "Define the file type you want to export. For cyclonedx, either json or xml. For spdx, either json or txt." }, { "in": "query", "name": "version", "required": false, "schema": { "type": "string", "enum": [ "1.4", "1.5", "1.6", "2.3" ], "default": "1.6", "example": "1.6" }, "description": "For cyclonedx, version can be 1.4, 1.5, or 1.6. For spdx, version is 2.3." }, { "schema": { "type": "string", "enum": [ "cyclonedx", "spdx" ], "default": "cyclonedx", "example": "cyclonedx" }, "in": "query", "name": "format", "required": false, "description": "Define the SBOM format." } ], "responses": { "200": { "description": "Ok. The SBOM report was generated successfully. The response body is the raw SBOM file content streamed directly (not base64-encoded).", "content": { "application/json": { "schema": { "type": "string", "format": "byte", "description": "Raw CycloneDX or SPDX XML or JSON file content, streamed directly in the response body." }, "examples": { "Example 1": { "value": { "$schema": "string", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d66c8bb5-4b17-4790-85b2-3e8e0135039b", "version": 1, "metadata": { "timestamp": "2026-09-02T16:01:03.254839+00:00", "tools": [ { "vendor": "CycloneDX", "name": "cyclonedx-python-lib", "version": "7.6.2" } ] }, "components": [ { "type": "library", "bom-ref": "pkg:pypi/aiodns@3.6.1", "group": "SCA", "name": "aiodns", "version": "3.6.1", "purl": "pkg:pypi/aiodns@3.6.1", "licenses": [ {} ] } ], "dependencies": [ { "ref": "pkg:pypi/aiodns@3.6.1" } ] } } } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/sbom/organization": { "get": { "tags": [ "SBOM management" ], "summary": "Get all SBOMs for the specified organization", "description": "Returns SBOM reports for **all repositories** belonging to the specified organization, bundled as a single downloadable ZIP file.\n\n\n**Downloading the ZIP file**\n\nA successful `200` response returns the SBOMs as a `.zip` archive. How you save the file depends on your HTTP client.\n\n**Using cURL**\n\nAdd the `-o` flag to save the response body directly to a local file:\n\n```bash\ncurl --location 'https://api-/public_api/appsec/v1/sbom/organization?orgName=&fileType=xml&version=1.6&format=cyclonedx' \\\n --header 'Authorization: ' \\\n --header 'x-xdr-auth-id: ' \\\n -o ./sbom-org-export.zip\n```\n\nThis saves the ZIP archive as `sbom-org-export.zip` in the current directory.\n\n**Using Postman**\n\nAfter sending the request, click **Send > Download Response** to save the `.zip` file to your local system.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n\n", "operationId": "GetOrgSBOMReport", "parameters": [ { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "name": "orgName", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Name of the organization (asset owner) for which to retrieve all SBOM reports. To retrieve this value, call `GET /public_api/appsec/v1/repositories` and use the `owner` field from each repository object in the response.", "example": "my-org" }, { "name": "fileType", "in": "query", "description": "Define the file type you want to export. For cyclonedx, either json or xml. For spdx, either json or txt.", "required": false, "schema": { "type": "string", "enum": [ "json", "xml", "txt" ], "default": "xml", "example": "json" } }, { "name": "version", "in": "query", "description": "For cyclonedx, version can be 1.4, 1.5, or 1.6. For spdx, version is 2.3.", "required": false, "schema": { "type": "string", "enum": [ "1.4", "1.5", "1.6", "2.3" ], "default": "1.6", "example": "1.6" } }, { "schema": { "type": "string", "enum": [ "cyclonedx", "spdx" ], "default": "cyclonedx", "example": "cyclonedx" }, "in": "query", "name": "format", "description": "Define the SBOM format.", "required": false } ], "responses": { "200": { "description": "Ok. The SBOM bundle was generated successfully. The response body is a ZIP file containing the SBOM reports for all repositories in the specified organization.", "content": { "application/zip": { "schema": { "type": "string", "format": "byte", "description": "Binary ZIP archive containing one SBOM file per repository in the organization." } } } } }, "security": [], "servers": [ { "url": "https://api-yourfqdn" } ], "x-scope": [ "external", "internal" ] } }, "/public_api/appsec/v1/scans/periodic": { "get": { "operationId": "GetPeriodicScans", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/PeriodicScansResponse" }, "type": "array" } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "organizationName", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "repositories", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "branchName", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "scanHealth", "required": false, "schema": { "$ref": "#/components/schemas/ScanHealthEnum" } }, { "in": "query", "name": "days", "required": false, "schema": { "default": 7, "format": "double", "type": "number" } }, { "in": "query", "name": "offset", "required": false, "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "limit", "required": false, "schema": { "format": "double", "type": "number", "default": 100 } } ], "x-scope": [ "external", "internal" ], "summary": "Get AppSec branch periodic scans", "description": "Branch periodic scans are automated checks that assess the security posture of applications and infrastructure. \n\nGet the details of branch periodic scans.\n\n**How to access branch periodic scans in the UI:** Under **Modules** select **Application Security** > **Branch Periodic Scanning** (under **Scans**).\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/scans/pr": { "get": { "operationId": "GetPRScans", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/PRScansResponse" }, "type": "array" } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "organizationName", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "repositories", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "branchName", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "prId", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "prTitle", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "prStatus", "required": false, "schema": { "$ref": "#/components/schemas/ScanStatus" } }, { "in": "query", "name": "scanHealth", "required": false, "schema": { "$ref": "#/components/schemas/ScanHealthEnum" } }, { "in": "query", "name": "days", "required": false, "schema": { "default": 7, "format": "double", "type": "number" } }, { "in": "query", "name": "offset", "required": false, "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "limit", "required": false, "schema": { "format": "double", "type": "number", "default": 100 } } ], "x-scope": [ "external", "internal" ], "summary": "Get AppSec Pull Request scans", "description": "Pull Request (PR) scans are initiated by events triggered by version control systems such as GitHub, GitLab, Bitbucket and Azure Repos, or via webhooks. These scans are run on default or non-default branches containing open PRs or Merge Requests (MR) from your integrated repositories.\n\nGet the details of PR scans.\n\n**How to access Pull Request scans in the UI:** Under **Modules** select **Application Security** **Pull Request Scans** (under **Scans**).\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/scans/ci": { "get": { "operationId": "GetCIScans", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/CIScansResponse" }, "type": "array" } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "organizationName", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "repositories", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "ciStatus", "required": false, "schema": { "$ref": "#/components/schemas/ScanStatus" } }, { "in": "query", "name": "scanHealth", "required": false, "schema": { "$ref": "#/components/schemas/ScanHealthEnum" } }, { "in": "query", "name": "days", "required": false, "schema": { "default": 7, "format": "double", "type": "number" } }, { "in": "query", "name": "offset", "required": false, "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "limit", "required": false, "schema": { "format": "double", "type": "number", "default": 100 } } ], "x-scope": [ "external", "internal" ], "summary": "Get AppSec CI scans", "description": "CI scans detect exposed secrets, misconfigurations in your infrastructure-as-code (IaC) files, vulnerabilities in your software composition analysis (SCA) packages, and license non-compliance in your CI pipelines.\n\nGet the details of CI scans.\n\n**How to access CI scans in the UI:** Under **Modules** select **Application Security** > **CI Scans** (under **Scans**).\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/scans/{scanId}/issues": { "get": { "operationId": "GetScanIssues", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/ScanIssuesResponse" }, "type": "array" } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "scanId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "severity", "required": false, "schema": { "$ref": "#/components/schemas/SeverityEnum" } }, { "in": "query", "name": "offset", "required": false, "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "limit", "required": false, "schema": { "format": "double", "type": "number", "default": 100 } } ], "x-scope": [ "external", "internal" ], "summary": "List AppSec scan issues", "description": "Get a list of the issues discovered in the scan specified by scan ID.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/scans/{scanId}/findings": { "get": { "operationId": "GetScanFindings", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/ScanFindingsResponse" }, "type": "array" } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "scanId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "severity", "required": false, "schema": { "$ref": "#/components/schemas/SeverityEnum" } }, { "in": "query", "name": "offset", "required": false, "schema": { "format": "double", "type": "number", "default": 0 } }, { "in": "query", "name": "limit", "required": false, "schema": { "format": "double", "type": "number", "default": 100 } } ], "x-scope": [ "external", "internal" ], "summary": "List AppSec scan findings", "description": "Get a list of the findings discovered in the scan specified by scan ID.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/scan/repository/{repositoryId}": { "post": { "operationId": "ScanRepository", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/ScanRepositorySuccessResponse" }, { "$ref": "#/components/schemas/ScanFailureResponse" } ] } } } } }, "tags": [ "Scan management" ], "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "repositoryId", "required": true, "schema": { "type": "string" } }, { "schema": { "type": "boolean" }, "in": "query", "name": "scanFullGitHistory" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicScanRepositoryInput" } } } }, "x-scope": [ "external" ], "summary": "Rerun a repository scan", "description": "Create a repository scan by specifying the branch name.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "/public_api/appsec/v1/policies/{policyId}": { "get": { "operationId": "GetPolicy", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Policy" }, "examples": { "Custom Policy created via API": { "value": { "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "name": "Image scan policy with all triggers", "description": "Detects vulnerabilities, secrets, and malware with CI Image Scan and Registry Image Scan triggers enabled.", "status": "enabled", "isCustom": true, "triggers": { "periodic": { "isEnabled": false, "overrideIssueSeverity": null, "actions": { "reportIssue": false } }, "pr": { "isEnabled": false, "overrideIssueSeverity": null, "actions": { "reportIssue": false, "reportPrComment": false, "blockPr": false } }, "cicd": { "isEnabled": false, "overrideIssueSeverity": null, "actions": { "reportIssue": false, "reportCicd": false, "blockCicd": false } }, "ciImage": { "isEnabled": true, "overrideIssueSeverity": "Medium", "actions": { "reportIssue": true, "reportCicd": false, "blockCicd": true } }, "imageRegistry": { "isEnabled": true, "overrideIssueSeverity": "Low", "actions": { "reportIssue": true } } }, "isClonable": true, "isEditable": true, "policyType": "code_image_scanners", "conditions": { "OR": [ { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SECRETS" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" } ] }, { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VULNERABILITY" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] }, { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "MALWARE" } ] } ] }, "relatedDetectionRules": [], "scope": {}, "dateCreated": "2025-06-15T09:30:00.000Z", "createdBy": "API Token 1", "dateModified": "2025-06-15T09:30:00.000Z", "modifiedBy": "API Token 1", "deletedBy": null, "version": 1, "assetGroupIds": [] } }, "System created policy": { "value": { "id": "c3d4e5f6-a7b8-9012-cdef-123456789012", "name": "Create issues on findings of High and above severity", "description": "Create issues on findings of High and above severity", "status": "disabled", "isCustom": false, "triggers": { "periodic": { "isEnabled": true, "actions": { "reportIssue": true } }, "pr": { "isEnabled": true, "actions": { "reportIssue": true, "reportPrComment": true, "blockPr": true } }, "cicd": { "isEnabled": true, "actions": { "reportIssue": true, "reportCicd": true, "blockCicd": true } }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "reportCicd": false, "blockCicd": false } }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false } } }, "isClonable": true, "isEditable": false, "policyType": "code_image_scanners", "conditions": { "AND": [ { "OR": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "IAC_MISCONFIGURATION" }, { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VULNERABILITY" }, { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "LICENSES" }, { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SECRETS" }, { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CODE_WEAKNESS" }, { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "OPERATIONAL_RISK" } ] }, { "OR": [ { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] } ] }, "relatedDetectionRules": [], "scope": {}, "createdBy": "system", "modifiedBy": null, "deletedBy": null, "version": 1, "assetGroupIds": [] } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "policyId", "description": "Unique identifier for the policy", "required": true, "schema": { "type": "string", "example": "d4e5f6a7-b8c9-0123-def0-1234567890ab" } } ], "x-scope": [ "external" ], "tags": [ "Policies" ], "summary": "Get an AppSec policy", "description": "Retrieves detailed information for a specific Application Security policy using its unique policy ID.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n" }, "put": { "operationId": "UpdatePolicy", "responses": { "204": { "description": "No content" }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "errorCode": "_BadParamsError", "message": "Conditions cannot be empty." } }, "properties": { "errorCode": { "type": "string", "description": "The HTTP error category. Indicates the general type of error that occurred." }, "message": { "type": "string", "description": "A human-readable message with specific details about why the request failed. Use this message for debugging and troubleshooting." } } }, "examples": { "Example 1": { "value": { "errorCode": "_BadParamsError", "message": "The following triggers are not compatible with the policy conditions: [CI Image, Image Registry]. Allowed triggers based on conditions: [PR, CI/CD, Periodic]." } }, "Example 2": { "value": { "errorCode": "_BadParamsError", "message": "Conditions cannot be empty." } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "policyId", "description": "Unique identifier for the policy", "required": true, "schema": { "type": "string", "example": "d4e5f6a7-b8c9-0123-def0-1234567890ab" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRequest" }, "examples": { "Example 1": { "value": { "name": "Updated policy name", "description": "Updated policy description", "conditions": { "AND": [ { "SEARCH_FIELD": "Finding Type", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VULNERABILITY" }, { "OR": [ { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "CRITICAL" }, { "SEARCH_FIELD": "Severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "HIGH" } ] } ] }, "scope": { "AND": [ { "SEARCH_FIELD": "has_deployed_assets", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true } ] }, "triggers": { "periodic": { "isEnabled": true, "actions": { "reportIssue": true }, "overrideIssueSeverity": "High" }, "pr": { "isEnabled": true, "actions": { "reportIssue": true, "blockPr": true, "reportPrComment": true }, "overrideIssueSeverity": null }, "cicd": { "isEnabled": true, "actions": { "reportIssue": true, "blockCicd": false, "reportCicd": true }, "overrideIssueSeverity": null }, "ciImage": { "isEnabled": false, "actions": { "reportIssue": false, "blockCicd": false, "reportCicd": false }, "overrideIssueSeverity": null }, "imageRegistry": { "isEnabled": false, "actions": { "reportIssue": false }, "overrideIssueSeverity": null } } } } } } } }, "x-scope": [ "external" ], "summary": "Update an AppSec policy", "tags": [ "Policies" ], "description": "Updates an existing Application Security policy by policy ID. Use this endpoint to modify the policy’s **Conditions**, **Scope**, **Triggers** or **Actions**. \n\n\n> **Note:** To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." }, "delete": { "operationId": "DeletePolicy", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "properties": { "message": { "type": "string" } }, "required": [ "message" ], "type": "object" }, "examples": { "Example 1": { "value": { "message": "Policy 'd4e5f6a7-b8c9-0123-def0-1234567890ab' was successfully deleted" } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "policyId", "description": "Unique identifier for the policy", "required": true, "schema": { "type": "string", "example": "d4e5f6a7-b8c9-0123-def0-1234567890ab" } } ], "x-scope": [ "external" ], "summary": "Delete an AppSec policy", "tags": [ "Policies" ], "description": "Deletes an Application Security policy by its policy ID.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." }, "parameters": [ { "schema": { "type": "string", "example": "1db58e20-9e73-498d-8faa-99936e26934c" }, "name": "policyId", "in": "path", "description": "Unique identifier for the policy", "required": true } ] }, "/public_api/appsec/v1/operational-risk": { "get": { "operationId": "GetPackageOperationalRiskV2", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/PackagesMetadataResponse" }, { "type": "object", "properties": { "status": { "type": "number", "format": "double" }, "message": { "type": "string" } } } ] }, "examples": { "Example 1": { "value": { "name": "lodash", "version": "4.17.21", "releaseDate": "2021-02-07", "weeklyDownloads": 27000000, "operationalRisk": "Low", "lastCommitDate": "2023-05-14", "commitFrequency": "weekly", "maintainersCount": 5, "stars": 50000, "forks": 12000 } } } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "packageManagerName", "required": true, "schema": { "type": "string" }, "description": "Open source package manager name" }, { "in": "query", "name": "packageName", "required": true, "schema": { "type": "string" }, "description": "Open source package name" } ], "x-scope": [ "external" ], "tags": [ "Operational risk" ], "summary": "Get open source package operational risk", "description": "Retrieve the operational risk severity and key metrics for a specific open source package.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "x-internal": true } }, "/public_api/appsec/v1/issues/fix/{issueId}/fix_suggestion": { "get": { "operationId": "GetFixSuggestion", "responses": { "200": { "description": "Fix Suggestion Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetIssueFixSuggestionResponse" } } } } }, "description": "Retrieves a comprehensive fix suggestion for a specified application security issue. Use optional query parameters to include data such as the original code block, remediation instructions, or the suggested code fix.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Remediations" ], "security": [], "summary": "Get Fix Suggestion", "parameters": [ { "description": "The unique identifier for the specific application security issue. ", "in": "path", "name": "issueId", "required": true, "schema": { "type": "string", "example": "1234567" } }, { "description": "Specifies whether to include the original code block in the response.", "in": "query", "name": "showCodeBlock", "required": false, "schema": { "default": true, "type": "boolean" } }, { "description": "Specifies whether to include manual remediation instructions in the response.", "in": "query", "name": "showRemediationInstruction", "required": false, "schema": { "default": false, "type": "boolean" } }, { "description": "Specifies whether to include the automated code fix in the response.", "in": "query", "name": "showSuggestedCodeBlock", "required": false, "schema": { "default": true, "type": "boolean" } } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/issues/fix/trigger_fix_pull_request": { "post": { "operationId": "TriggerFixPr", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerFixPrResponse" } } } } }, "description": "Create automated pull requests to fix multiple security issues in a single bulk operation.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "summary": "Trigger Fix Pull Request", "tags": [ "Remediations" ], "security": [], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriggerFixPrPayload" } } } }, "x-scope": [ "external" ] } }, "/public_api/appsec/v1/issues/fix/{remediationId}": { "get": { "operationId": "GetFixStatus", "tags": [ "Remediations" ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FixStatus" } } } } }, "description": "Retrieves the fix status of remediation processes using the remediation ID.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "summary": "Get Fix Status", "security": [], "parameters": [ { "description": "Remediation Id", "in": "path", "name": "remediationId", "required": true, "schema": { "type": "string" } } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/application/criteria/all": { "get": { "operationId": "GetAllCriteria", "description": "Retrieves a paginated list of all criteria.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n", "summary": "Get all criteria", "tags": [ "Criteria" ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginationResponse_CriteriaDTO_" } } } } }, "security": [], "parameters": [ { "in": "query", "name": "page", "required": false, "description": "Current page number in the paginated response.", "schema": { "format": "double", "type": "number" } }, { "in": "query", "name": "pageSize", "description": "Total number of items in the current page.", "required": false, "schema": { "format": "double", "type": "number" } } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/application/criteria/{criteriaId}": { "get": { "operationId": "GetCriteria", "summary": "Get a Criteria by ID", "description": "Retrieves detailed information for a specific criteria using its unique Id.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n\n", "tags": [ "Criteria" ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CriteriaDTO" } } } } }, "security": [], "parameters": [ { "in": "path", "name": "criteriaId", "description": "Unique identifier for the criteria", "required": true, "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "required": true, "description": "{api_key}" }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "required": true, "description": "{api_key_id}" } ], "x-scope": [ "external" ] }, "delete": { "operationId": "DeleteCriteria", "summary": "Delete a Criteria", "description": "Deletes a specific criteria identified by its unique Id.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n", "tags": [ "Criteria" ], "responses": { "204": { "description": "No content" } }, "security": [], "parameters": [ { "in": "path", "name": "criteriaId", "description": "Unique identifier for the criteria", "required": true, "schema": { "type": "string" } }, { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/application/criteria": { "post": { "operationId": "CreateCriteria", "summary": "Create a Criteria", "description": "Creates a Criteria based on the provided details.\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.\n", "tags": [ "Criteria" ], "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCriteriaResponse" } } } } }, "security": [], "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "required": true, "description": "{api_key}" }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCriteriaRequest" } } } }, "x-scope": [ "external" ] } }, "/public_api/appsec/v1/collectors/{collectorId}": { "parameters": [ { "schema": { "type": "string", "example": "col_7f2a9b4e1c3d5f8a0b6e2d4c" }, "name": "collectorId", "in": "path", "required": true, "description": "Unique identifier for the collector instance. This is the `id` field returned by the [Get all Data Sources](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/data-sources#GetDataSourceInstances) endpoint (with `type=collector`). The collector must be of type `COLLECTOR` with `detectionMethod: SAST` and `fileType: SARIF`" } ], "post": { "summary": "3rd Party AppSec Collector", "tags": [ "Data Sources" ], "responses": { "201": { "description": "Returned when the SARIF file is accepted and the ingestion process has started.", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "description": "Ingestion status.", "type": "string", "enum": [ "INGESTED", "PARTIALLY_VALID" ] }, "message": { "type": "string", "description": "Human-readable result message including the number of findings to be ingested." } } }, "examples": { "Example 1": { "value": { "status": "INGESTED", "message": "SARIF file uploaded successfully. Ingestion in progress, findings may take a few minutes to show. 1 findings will be ingested" } } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "description": "Error response for validation failures or bad requests.", "properties": { "status": { "type": "string", "description": "Status of the request (for example, `INVALID`, `INGESTED_FAILED`)." }, "message": { "type": "string", "description": "Human-readable error message." }, "errorCode": { "type": "string", "description": "Error code identifying the type of error." } } }, "examples": { "SARIF missing version field": { "value": { "status": "INVALID", "message": "Validation failed: Invalid SARIF format – the \"version\" field is missing" } }, "No rules defined": { "value": { "status": "INVALID", "message": "Validation failed: Invalid SARIF format – the rules section is empty" } }, "Invalid repository_id format": { "value": { "status": "INGESTED_FAILED", "message": "File ingestion failed - Invalid repository id format" } }, "Missing repository ID": { "value": { "errorCode": "_BadRequestError", "message": "Missing required repository identifier" } } } } } }, "403": { "description": "Forbidden\n\nThe API key lacks required permissions. Required role: Instance Admin, AppSec Admin, or Data Sources edit permission.", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "description": "Error code identifying the type of error." }, "err_msg": { "type": "string", "description": "Human-readable error message." }, "err_extra": { "type": "string" } } } } }, "examples": { "Example 1": { "value": { "reply": { "err_code": 403, "err_msg": "Forbidden. Access was denied to this resource.", "err_extra": "Insufficient permissions for api key" } } } } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "type": "object", "properties": { "errorCode": { "type": "string", "description": "Error code identifying the type of error." }, "message": { "type": "string", "description": "Human-readable error message." } } }, "examples": { "Collector ID does not exist.": { "value": { "errorCode": "_NotFoundError", "message": "Collector 'invalid-collector-id' not found" } } } } } }, "503": { "description": "Service Unavailable. Returned when the collector is disabled." } }, "operationId": "uploadSarifFindings", "description": "Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. This endpoint is used specifically for ingesting scan results, not for creating or configuring a generic collector.\n\nThe Collector API accepts scan results in SARIF v2.1.0 format. Once uploaded, the SARIF file is parsed to create code findings. These findings can then be elevated to issues, either manually or automatically, depending on your configured policies.\n\n\n> #### Required license:\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n\n### Prerequisites\n1. **Permissions**: The following Cortex Cloud user roles or RBAC permissions are required:\n - **User roles:**\n - Cortex Cloud Instance Administrator\n - AppSec Administrator\n - **RBAC:**\n - **View/Edit** permissions for **Data Sources** configurations are required when not using a dedicated user role.\n2. **Repository Identification**: The repository must already be onboarded in Cortex Cloud before SARIF findings for that repository can be uploaded. To identify the target repository, you must provide at least one of the following query parameters:\n - `repository_id`— The repository asset ID. This is the `id` field (SHA-256 hash format) returned by the [Get repositories](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/repositories#GetRepositoryAssets) endpoint.\n - `repository_url` — The repository URL (for example, `https://github.com/owner/repo`).\n - Either `repository_id` or `repository_url` must be provided. Both can be provided simultaneously. If neither is provided, the request returns a 400 error.\n3. **SARIF specifications:** The following table outlines the mandatory and optional JSON fields required to successfully validate and ingest SAST findings. \n\nField | Required | Description\n---------|----------|---------\n `version` | Yes | Must be \"2.1.0\"\n `tool.driver.name` | Yes | Analysis tool name\n `driver.rules` or `extensions[].rules` | Yes | At least one rule definition\n `results[].ruleId`| Yes | Must match a defined rule `id`\n `results[].message.text`| Yes | Finding description\n `results[].locations[].physicalLocation.artifactLocation.uri`| Yes | File path\n `results[].locations[].physicalLocation.region.startLine` | Yes | Line number\n `results[].level`| Yes | `error` \\| `warning` \\| `note` \\| `none`. Defaults to `High`\n\n\n\n### Limitations\n- **Maximum file size**: **10 MB** per request.\n- **SARIF version**: Only SARIF **v2.1.0** is supported. Files with invalid formats or schema will return a 400 error.\n", "parameters": [ { "schema": { "type": "string", "example": "a3b8f2e1c7d4509a6b1e3f8c2d7a4b9e5f0c1d6a8b3e7f2c4d9a0b5e1f6c3d8" }, "in": "query", "name": "repository_id", "required": true, "description": "The asset ID of the target repository. This is the `id` field (SHA-256 hash format) returned by the [Get repositories](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/repositories#GetRepositoryAssets) endpoint. At least one of repository_url or repository_id must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request." }, { "schema": { "type": "string", "example": "https://github.com/testapp/cves" }, "in": "query", "name": "repository_url", "required": true, "description": "The URL of the target repository. At least one of `repository_url` or `repository_id` must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request." }, { "schema": { "type": "string", "example": "main" }, "in": "query", "name": "branch", "description": "Optional. Branch name to associate findings with. Defaults to the repository's default branch when omitted." }, { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "security": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": {} }, "examples": { "Veracode Static Analysis": { "value": { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Veracode Static Analysis Policy Scan", "rules": [ { "id": "78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "shortDescription": { "text": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "helpUri": "https://cwe.mitre.org/data/definitions/78.html", "properties": { "category": "STATIC", "tags": [ "STATIC" ] }, "defaultConfiguration": { "level": "error" } }, { "id": "89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "shortDescription": { "text": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "helpUri": "https://cwe.mitre.org/data/definitions/89.html", "properties": { "category": "STATIC", "tags": [ "STATIC" ] }, "defaultConfiguration": { "level": "error" } } ], "version": "1.0" } }, "results": [ { "level": "error", "rank": 5, "message": { "text": "This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "com/scalesec/vulnado/Cowsay.java" }, "region": { "startLine": 16 } }, "logicalLocations": [ { "name": "Cowsay.java", "fullyQualifiedName": "com.scalesec.vulnado.Cowsay.run", "kind": "function" } ] } ], "ruleId": "78", "partialFingerprints": { "context_guid": "", "file_path": "", "procedure": "" } }, { "level": "error", "rank": 4, "message": { "text": "This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "com/scalesec/vulnado/User.java" }, "region": { "startLine": 49 } }, "logicalLocations": [ { "name": "User.java", "fullyQualifiedName": "com.scalesec.vulnado.User.fetch", "kind": "function" } ] } ], "ruleId": "89", "partialFingerprints": { "context_guid": "", "file_path": "", "procedure": "" } } ] } ] } } } } }, "description": "A SARIF v2.1.0 document that contains SAST scan results. The file must strictly adhere to the SARIF v2.1.0 specification. The maximum file size is 10 MB. For an example, see **Request sample**." } } }, "/get /public_api/appsec/v1/package_explorer/packages/{name}/versions/{version}": { "parameters": [ { "schema": { "type": "string" }, "name": "name", "description": "Name of the package to look up, as it appears in the package manager registry", "in": "path", "example": "com.vaadin.external.google:android-json", "required": true }, { "schema": { "type": "string" }, "name": "version", "description": "The version of the package to look up", "in": "path", "example": "0.0.20131108.vaadin1", "required": true } ], "get": { "summary": "Get Package Version Details", "tags": [ "Package Explorer" ], "operationId": "GetPackages", "x-stoplight": { "id": "7n6ziypvowfeh" }, "description": "Retrieves structured information for a specific package version. Use the optional manager query parameter to filter results by package manager ecosystem. This read-only endpoint does not provide exposure details, remediation actions, or governance execution.\n\n**Required license**: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n", "security": [], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "schema": { "type": "string", "example": "MAVEN" }, "in": "query", "name": "manager", "description": "Optional. Filters the results to a specific package manager ecosystem (for example, NPM, YARN, MAVEN, or GRADLE). When omitted, results are returned for all ecosystems in which the package version was detected.", "required": false } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageExplorerResponse" }, "examples": { "Example 1": { "value": { "name": "com.vaadin.external.google:android-json", "version": "0.0.20131108.vaadin1", "package_type": "OSS", "ecosystem": "MAVEN", "operational_risk": "HIGH", "used_in": { "code": 9, "runtime": 2, "deploy": 1 }, "vulnerabilities": { "critical": 3, "high": 0, "medium": 0, "low": 0, "info": 0 } } } } } } } } } }, "/public_api/appsec/v1/code-to-cloud/coverage": { "get": { "operationId": "GetCoverage", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CoveragePublicApiResponse" } } } } }, "description": "Returns the Code-to-Cloud coverage ratio, which measures the percentage of your assets that have a traceable lineage between code and cloud. This is the same value shown on the Code to Cloud dashboard.\n\nSet `direction` to choose which way lineage is traced, and `type` to choose which kind of asset to trace:\n\n| `direction` | Traces |\n|---|---|\n| `code_to_cloud` | Repositories → their deployed cloud assets |\n| `cloud_to_code` | Cloud assets → their source repositories |\n\n| `type` | Traces |\n|---|---|\n| `artifact` | Repositories → the cloud images built from them |\n| `infrastructure` | IaC resources → the cloud assets deployed from them |\n\n#### Required license\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Cloud Coverage" ], "security": [], "parameters": [ { "in": "query", "name": "direction", "required": true, "schema": { "$ref": "#/components/schemas/CodeToCloudDirection" } }, { "in": "query", "name": "type", "required": true, "schema": { "$ref": "#/components/schemas/CodeToCloudDashboardType" } }, { "in": "query", "name": "only_onboarded", "required": false, "description": "If `true`, only onboarded repositories are included in the calculation. Only applies when direction is `code_to_cloud` and type is `artifact`; ignored otherwise.", "schema": { "type": "boolean", "default": false } }, { "in": "query", "name": "application", "required": false, "schema": { "type": "string" }, "description": "Limit the calculation to a single application, by name." }, { "in": "query", "name": "provider", "required": false, "schema": { "type": "string", "example": "GITHUB" }, "description": "Limit the calculation to a single provider, by name ." }, { "schema": { "type": "string", "example": "your-api-key-here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "x-scope": [ "external" ], "summary": "Get Code-to-Cloud Coverage Ratio" } } }, "tags": [ { "name": "Billing", "description": "APIs for managing billing contributors" }, { "name": "Applications", "description": "APIs for managing applications" }, { "name": "Criteria", "description": "APIs for managing Criteria" }, { "name": "Data Sources", "description": "APIs for managing integrations" }, { "name": "Labels", "description": "APIs for managing rule labels" }, { "name": "Operational risk", "description": "APIs for managing operational risk" }, { "name": "Policies", "description": "APIs for managing policies" }, { "name": "Package Explorer", "description": "APIs for retrieving structured information for a specific package version." }, { "name": "Repositories", "description": "APIs for managing repository assets" }, { "name": "Repository branches", "description": "APIs for managing repository branches" }, { "name": "Repository scans", "description": "APIs for managing repository scans" }, { "name": "Remediations", "description": "APIs for managing Remediation" }, { "name": "Rules", "description": "APIs for managing rules" }, { "name": "SBOM management", "description": "APIs for managing SBOMs" }, { "name": "Scan management", "description": "APIs for managing scans" }, { "name": "Cloud Coverage", "description": "API for retrieving code-to-cloud coverage ratio for the requested view." } ], "components": { "securitySchemes": { "XDRAuth": { "type": "apiKey", "in": "header", "name": "x-xdr-auth-id", "description": "API Key ID for authentication" }, "XDRAuthToken": { "type": "apiKey", "in": "header", "name": "Authorization", "description": "API Key for authentication" } }, "schemas": { "CriteriaType.Cloud": { "enum": [ "cloud" ], "type": "string", "description": "Criteria Type. Allowed values - `cloud`." }, "ApplicationMetadataCloud": { "properties": { "applicationNameSourceTags": { "type": "string", "description": "Identifies the application name. If multiple values are found, the three most frequent ones are concatenated (for example, infra_bank_pay).\n If matching tag is not found, the application name is automatically generated by the system." }, "businessCriticalitySourceTags": { "type": "string", "description": "Maps the business criticality level (Critical, High, Medium, or Low). If multiple values are present, the highest severity level is applied. The default value is Medium." }, "businessOwnerSourceTags": { "items": { "type": "string", "description": "Specifies the application owner. If multiple values are present, they are concatenated and separated by commas." }, "type": "array" }, "businessUnitSourceTags": { "type": "string", "description": "Maps the tag key to the Business Unit. If multiple values are available, a comma-separated string containing the top five most frequent values is shown." } }, "type": "object", "additionalProperties": false }, "CriteriaDefinitionType": { "enum": [ "tags", "organization", "project", "repository" ], "type": "string" }, "CodeProvider": { "enum": [ "GITLAB", "GITHUB", "BITBUCKET", "AZURE_REPOS", "AWS_CODE_COMMIT" ], "type": "string", "description": "Source code management (SCM) or code hosting provider.\n**Allowed values**: `GITLAB`, `GITHUB`, `BITBUCKET`, `AZURE_REPOS`, `AWS_CODE_COMMIT`", "title": "Code Provider" }, "RunProvider": { "enum": [ "GCP", "AWS", "AZURE" ], "type": "string", "description": "Runtime or execution environment provider for the application or asset. **Allowed Values**: `GCP`, `AWS`, `AZURE`", "title": "Run Provider" }, "SectionProvider": { "anyOf": [ { "$ref": "#/components/schemas/CodeProvider" }, { "$ref": "#/components/schemas/RunProvider" } ] }, "CriteriaDefinition": { "properties": { "type": { "$ref": "#/components/schemas/CriteriaDefinitionType" }, "provider": { "$ref": "#/components/schemas/SectionProvider" }, "tagKeys": { "items": { "type": "string" }, "type": "array" } }, "required": [ "type", "provider" ], "type": "object", "additionalProperties": false }, "CloudCriteriaConfig": { "type": "object", "additionalProperties": false, "required": [ "criteriaDefinitions", "applicationMetaData" ], "properties": { "unifyWithinProvider": { "type": "boolean", "description": "Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider." }, "unifyAcrossProviders": { "type": "boolean", "description": "If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application." }, "criteriaDefinitions": { "type": "array", "items": { "$ref": "#/components/schemas/CriteriaDefinition" } }, "criteriaPrettyName": { "type": "string", "description": "A human-readable name for the criteria." }, "criteriaPrettyNameTags": { "type": "array", "description": "Tags associated with the criteria name.", "items": {} }, "applicationMetaData": { "$ref": "#/components/schemas/ApplicationMetadataCloud" } }, "title": "Cloud Criteria" }, "CodeCriteriaConfig": { "type": "object", "additionalProperties": false, "required": [ "criteriaDefinitions", "applicationMetaData" ], "properties": { "unifyWithinProvider": { "type": "boolean", "description": "Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider." }, "unifyAcrossProviders": { "type": "boolean", "description": "If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application." }, "criteriaDefinitions": { "type": "array", "items": { "$ref": "#/components/schemas/CriteriaDefinition" } }, "criteriaPrettyName": { "type": "string", "description": "A human-readable name for the criteria." }, "criteriaPrettyNameTags": { "type": "array", "description": "Tags associated with the criteria name.", "items": { "type": "string" } }, "applicationMetaData": { "$ref": "#/components/schemas/ApplicationMetadataCode" } }, "title": "Code Criteria" }, "ApplicationMetadataCode": { "type": "object", "additionalProperties": false, "required": [ "businessOwner", "businessCriticality", "exposedToInternetOverride" ], "properties": { "businessOwner": { "$ref": "#/components/schemas/BusinessOwnerMetaData" }, "businessCriticality": { "$ref": "#/components/schemas/BusinessCriticality" }, "exposedToInternetOverride": { "type": "boolean", "description": "Whether the asset is exposed to the internet." } } }, "BusinessOwnerMetaData": { "enum": [ "none", "organizationOwner", "projectOwner", "repositoryOwner" ], "type": "string", "description": "The metadata of the business owner." }, "CriteriaCreationMethod": { "enum": [ "manual", "automatic" ], "type": "string", "description": "Creation method for the criteria. Possible values:\n -`manual`: For the criteria created manually.\n -`automatic`: Criteria that are automatically created." }, "RefreshStatus": { "enum": [ "in_progress", "done" ], "type": "string", "description": "The current refresh status." }, "CriteriaMetadata": { "type": "object", "additionalProperties": false, "description": "Additional metadata for the criteria.", "properties": { "applicationCount": { "type": "number", "format": "double", "description": "The number of associated applications." }, "assetCount": { "type": "number", "format": "double", "description": "The number of associated assets." }, "refreshStatus": { "$ref": "#/components/schemas/RefreshStatus" }, "deletedFromUai": { "type": "boolean", "description": "Indicates whether the resource has been deleted from UAI." } } }, "CriteriaDTOCode": { "type": "object", "additionalProperties": false, "description": "Code Criteria details.", "title": "Code Criteria", "required": [ "id", "name", "creationMethod", "createdBy", "createdAt", "type", "config" ], "properties": { "id": { "type": "string", "description": "Unique Id of the criteria." }, "name": { "type": "string", "description": "Unique name of the criteria." }, "description": { "type": "string", "description": "Criteria description." }, "creationMethod": { "$ref": "#/components/schemas/CriteriaCreationMethod" }, "createdBy": { "type": "string", "description": "Owner of the criteria." }, "createdAt": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was created." }, "lastUpdated": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was updated." }, "deletedAt": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was deleted." }, "metadata": { "$ref": "#/components/schemas/CriteriaMetadata" }, "type": { "$ref": "#/components/schemas/CriteriaType.Code" }, "config": { "$ref": "#/components/schemas/CodeCriteriaConfig" } } }, "CriteriaType.Code": { "enum": [ "code" ], "type": "string", "description": "Criteria Type." }, "CriteriaDTOCloud": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "creationMethod", "createdBy", "createdAt", "type", "config" ], "properties": { "id": { "type": "string", "description": "Unique Id of the criteria." }, "name": { "type": "string", "description": "Unique name of the criteria." }, "description": { "type": "string", "description": "Criteria description." }, "creationMethod": { "$ref": "#/components/schemas/CriteriaCreationMethod" }, "createdBy": { "type": "string", "description": "Owner of the criteria." }, "createdAt": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was created." }, "lastUpdated": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was updated." }, "deletedAt": { "type": "string", "format": "date-time", "description": "Timestamp when the criteria was deleted." }, "metadata": { "$ref": "#/components/schemas/CriteriaMetadata" }, "type": { "$ref": "#/components/schemas/CriteriaType.Cloud" }, "config": { "$ref": "#/components/schemas/CloudCriteriaConfig" } }, "description": "Cloud Criteria details.", "title": "Cloud Criteria" }, "CriteriaDTO": { "anyOf": [ { "$ref": "#/components/schemas/CriteriaDTOCode" }, { "$ref": "#/components/schemas/CriteriaDTOCloud" } ] }, "PaginationResponse_CriteriaDTO_": { "properties": { "items": { "items": { "$ref": "#/components/schemas/CriteriaDTO" }, "type": "array" }, "currentPage": { "type": "number", "format": "double", "description": "Current page number in the paginated response." }, "totalPages": { "type": "number", "format": "double", "description": "Total number of pages for the paginated response." }, "pageSize": { "type": "number", "format": "double", "description": "Number of entries in each page." }, "totalItems": { "type": "number", "format": "double", "description": "Total number of items in the response." } }, "required": [ "items", "currentPage", "pageSize", "totalItems" ], "type": "object", "additionalProperties": false }, "CreateCriteriaResponse": { "properties": { "id": { "type": "string", "description": "Unique Id of the criteria." }, "name": { "type": "string", "description": "Unique name of the criteria." } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "CreateCriteriaRequest": { "type": "object", "additionalProperties": false, "description": "Creates a new criteria object.", "title": "CreateCriteriaRequest", "required": [ "name", "type", "config" ], "properties": { "name": { "type": "string", "description": "Unique name for the criteria." }, "description": { "type": "string", "description": "Optional description for the criteria." }, "type": { "$ref": "#/components/schemas/CriteriaType.Cloud" }, "config": { "anyOf": [ { "$ref": "#/components/schemas/CodeCriteriaConfig" }, { "$ref": "#/components/schemas/CloudCriteriaConfig" } ] } } }, "GetIssueFixSuggestionResponse": { "properties": { "issueId": { "type": "string", "description": "Unique identifier for the issue." }, "issueName": { "type": "string", "description": "Name of the security issue." }, "existingCodeBlock": { "type": "string", "description": "Original vulnerable code." }, "remediationInstruction": { "type": "string", "description": "Manual remediation instructions." }, "suggestedCodeBlock": { "type": "string", "description": "Automated fix suggestions." } }, "required": [ "issueId", "issueName" ], "type": "object", "additionalProperties": false }, "TriggeredPr": { "properties": { "issueId": { "type": "string", "description": "A unique identifier for issue." }, "status": { "type": "string", "enum": [ "triggered", "automated_fix_not_available" ], "description": "PR status. Possible values:\n -`triggered`: If the PR is in triggered state.\n -`automated_fix_not_available`: If the PR is in automated_fix_not_available state. " } }, "required": [ "issueId", "status" ], "type": "object", "additionalProperties": false }, "TriggerFixPrResponse": { "properties": { "message": { "type": "string", "description": "Error message if the process fails." }, "triggeredPrs": { "items": { "$ref": "#/components/schemas/TriggeredPr" }, "type": "array", "description": "Status of each issue." }, "status": { "type": "string", "description": "Overall process status." }, "remediationId": { "type": "string", "description": "Unique identifier to track the remediation process" }, "error": { "type": "string", "description": " Error details if the process fails." } }, "required": [ "message", "triggeredPrs" ], "type": "object", "additionalProperties": false }, "TriggerFixPrPayload": { "properties": { "fixBranchName": { "type": "string", "description": "The branch name for the fix pull request. If not specified, a custom branch will be used." }, "title": { "type": "string", "description": "The title for the fix pull request. If not specified, a default message will be used." }, "issueIds": { "items": { "type": "string" }, "type": "array", "description": "A list of unique identifiers for the issues to be fixed. Maximum 10 IDs per request.", "example": [ "1234567", "9876543" ] } }, "required": [ "issueIds" ], "type": "object" }, "SaveFixResult": { "properties": { "prUrl": { "type": "string", "description": "URL of the created pull request." }, "errorMessage": { "type": "string", "description": "Error details if the process failed." }, "remediationRepositoryId": { "type": "string", "description": " Internal repository identifier." }, "failureIssueIds": { "items": { "type": "string", "description": "Issues Ids that could not be fixed." }, "type": "array" }, "successfulIssueIds": { "items": { "type": "string", "description": "Issues Ids that were successfully fixed." }, "type": "array" } }, "required": [ "remediationRepositoryId", "failureIssueIds", "successfulIssueIds" ], "type": "object" }, "FixStatus": { "properties": { "isProcessDone": { "type": "boolean", "description": "Indicates whether all remediation processes are complete." }, "results": { "items": { "$ref": "#/components/schemas/SaveFixResult" }, "type": "array", "description": " Remediation results grouped by repository." } }, "required": [ "isProcessDone", "results" ], "type": "object" }, "ApplicationConfigurationSettings": { "type": "object", "x-examples": {}, "properties": { "keepApplicationRefresh": { "type": "boolean", "description": "Indicates if the system is configured to automatically and periodically refresh the application's metadata and asset data." }, "areSbomIssuesConsideredNew": { "type": "boolean", "description": "Indicates if findings from Software Bill of Materials (SBOM) scans are treated as brand-new issues for tracking and compliance purposes." }, "sla": { "type": "object", "description": "Contains the Service Level Agreement (SLA) configurations, defining the resolution timeframes for various severity levels.", "properties": { "CRITICAL": { "type": "object", "description": "Defines the SLA target days for issues classified as CRITICAL severity.", "properties": { "targetDays": { "type": "integer", "description": "The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced." } } }, "HIGH": { "type": "object", "description": "Defines the SLA target days for issues classified as HIGH severity.", "properties": { "targetDays": { "type": "integer", "description": "The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced." } } }, "MEDIUM": { "type": "object", "description": "Defines the SLA target days for issues classified as MEDIUM severity.", "properties": { "targetDays": { "type": "integer", "description": "The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced." } } }, "LOW": { "type": "object", "description": "Defines the SLA target days for issues classified as LOW severity.", "properties": { "targetDays": { "type": "integer", "description": "The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced." } } }, "approaching": { "type": "object", "description": "Defines the early warning threshold that triggers notifications before an SLA is officially breached.", "properties": { "targetDays": { "type": "integer", "description": "The number of calendar days set as the target for defining the 'approaching' window." } } } } } } }, "CrudResponse": { "type": "object", "additionalProperties": false, "required": [ "status" ], "properties": { "status": { "type": "boolean", "description": "Displays the status of the application.", "default": true }, "applicationId": { "type": "string", "description": "Displays the Asset ID of the application.", "example": "a7dc11ea688c73dbbc759459ba661d7f7a7edaad229a3fdb50701b6548535f5b" } } }, "Category": { "enum": [ "Business Application" ], "type": "string" }, "BusinessCriticality": { "enum": [ "Critical", "High", "Medium", "Low" ], "type": "string", "description": "The operational importance of the asset." }, "CreationType": { "enum": [ "Auto", "Manual" ], "type": "string", "description": "Defines how the application asset is created." }, "Compliance": { "enum": [ "PCI-DSS", "ISO 27001", "SOX", "NIST", "GDPR", "CCPA", "HIPAA", "FedRAMP" ], "type": "string", "description": "The compliance status or requirement category for an asset." }, "ApplicationAssetSelectionType": { "enum": [ "filter", "assetIds" ], "type": "string", "description": "Method to select application assets." }, "ApplicationBuilderStartSection": { "enum": [ "code", "run" ], "type": "string", "description": "Identifies the functional section to which the asset selection applies." }, "BuildProvider": { "enum": [ "CIRCLE_CI", "JENKINS", "GITLAB_CI", "AZURE_PIPELINES", "GITHUB_ACTIONS" ], "type": "string", "description": "Build system or CI provider used for the asset. **Allowed values:** `CIRCLE_CI` `JENKINS` `GITLAB_CI` `AZURE_PIPELINES` `GITHUB_ACTIONS`", "title": "Build Provider" }, "DeployProvider": { "enum": [ "ACR", "ECR", "GAR", "JFrog", "Docker" ], "type": "string", "description": "Deployment platform or system used to deploy the application or asset. **Allowed values:** `ACR` `ECR` `GAR` `JFrog` `Docker`", "title": "Deploy Provider" }, "Provider": { "anyOf": [ { "$ref": "#/components/schemas/BuildProvider" }, { "$ref": "#/components/schemas/CodeProvider" }, { "$ref": "#/components/schemas/RunProvider" }, { "$ref": "#/components/schemas/DeployProvider" } ] }, "CodeFilterType": { "enum": [ "REPOSITORY", "ORGANIZATION", "CODE" ], "type": "string", "title": "Code Filter Type", "description": "Specifies the available values for the code type filter." }, "RunFilterType": { "enum": [ "K8S_NAMESPACE", "K8S_CLUSTER", "ORGANIZATION", "RESOURCE_TAG", "VPC", "ACCOUNT" ], "type": "string", "title": "Run Type Filter", "description": "Specifies the available values for the run type filter." }, "FilterType": { "anyOf": [ { "$ref": "#/components/schemas/CodeFilterType" }, { "$ref": "#/components/schemas/RunFilterType" } ], "description": "The asset attribute used to filter assets from the selected provider." }, "ApplicationAssetSelectionFilterValues": { "type": "object", "x-examples": { "Example 1": { "properties": { "values": { "items": { "type": "string" }, "type": "array" }, "provider": { "$ref": "#/components/schemas/Provider" }, "filterType": { "$ref": "#/components/schemas/FilterType" } }, "required": [ "values", "provider", "filterType" ], "type": "object", "additionalProperties": false } }, "title": "Application Asset Selection Filter Values", "description": "Defines the set of values used to evaluate the asset selection filter.", "required": [ "values" ], "properties": { "values": { "type": "object", "description": "Container for filter values used to match application assets.", "properties": { "orgUrl": { "type": "string", "description": "Organization URL used to filter assets belonging to a specific organization." }, "repositoryId": { "type": "string", "description": "Unique identifier of the repository used to filter assets." }, "projectUrl": { "type": "string", "description": "Project URL used to filter assets belonging to a specific project." }, "orgUnifyFilter": { "type": "object", "description": "Defines unification rules applied at the organization level.", "required": [ "providers", "name" ], "properties": { "providers": { "$ref": "#/components/schemas/Provider" }, "name": { "type": "string", "description": "Name of the organization used for asset unification." } } }, "projectUnifyFilter": { "type": "object", "description": "Defines unification rules applied at the project level.", "required": [ "providers", "name" ], "properties": { "providers": { "$ref": "#/components/schemas/Provider" }, "name": { "type": "string", "description": "Name of the project used for asset unification." } } }, "repositoryUnifyFilter": { "type": "object", "description": "Defines unification rules applied at the repository level.", "required": [ "providers", "name" ], "properties": { "providers": { "$ref": "#/components/schemas/Provider" }, "name": { "type": "string", "description": "Name of the repository used for asset unification." } } } } }, "filterType": { "$ref": "#/components/schemas/FilterType" } } }, "ApplicationAssetSelectionFilter": { "anyOf": [ { "$ref": "#/components/schemas/ManualAndRunCriteriaApplicationAssetSelectionFilter" }, { "$ref": "#/components/schemas/ApplicationAssetSelectionFilterValues" }, { "type": "string" } ], "description": "Defines filter criteria to dynamically select application assets. This field supports one of the supported application asset selection filter types.", "title": "Application Asset Selection Filter" }, "ManualAndRunCriteriaApplicationAssetSelectionFilter": { "additionalProperties": false, "type": "object", "title": "Manual and Run Criteria Application Asset Selection Filter", "x-examples": { "Example 1": { "values": [ "string" ], "provider": "CIRCLE_CI", "filterType": "REPOSITORY" } }, "required": [ "values", "filterType" ], "properties": { "values": { "type": "array", "description": "If the filterType is `REPOSITORY`, enter the repository ID as the value. \nIf the filterType is `ORGANIZATION`, enter the organization URL of the provider.", "items": { "type": "string" } }, "provider": { "$ref": "#/components/schemas/Provider" }, "filterType": { "$ref": "#/components/schemas/FilterType" } } }, "ApplicationAssetSelection": { "type": "object", "additionalProperties": false, "description": "Define the logic for how specific technical assets must be linked to this application.", "required": [ "selectionType", "section" ], "properties": { "selectionType": { "$ref": "#/components/schemas/ApplicationAssetSelectionType" }, "section": { "$ref": "#/components/schemas/ApplicationBuilderStartSection" }, "filter": { "$ref": "#/components/schemas/ApplicationAssetSelectionFilter" }, "assetIds": { "type": "array", "description": "A list of unique identifiers representing the assets to be included.", "items": { "type": "string" } } }, "title": "Application Asset Selection" }, "CreateApplicationRequest": { "type": "object", "additionalProperties": false, "x-examples": { "Example 1": { "name": "string", "businessCriticality": "Critical", "businessUnit": "string", "creationType": "Auto", "description": "string", "compliance": [ "PCI-DSS" ], "businessOwner": [ "string" ], "devOwner": [ "string" ], "devOpsOwner": [ "string" ], "productManager": [ "string" ], "assetSelection": { "selectionType": "filter", "section": "code", "filter": { "values": [ "string" ], "provider": "CIRCLE_CI", "filterType": "REPOSITORY" }, "assetIds": [ "string" ] } } }, "required": [ "name", "businessCriticality", "creationType", "assetSelection" ], "properties": { "name": { "type": "string", "description": "A unique name for the application asset." }, "businessCriticality": { "$ref": "#/components/schemas/BusinessCriticality" }, "businessUnit": { "type": "string", "description": "Business unit responsible for the asset." }, "creationType": { "$ref": "#/components/schemas/CreationType" }, "description": { "type": "string", "description": "A brief description of the asset's purpose." }, "compliance": { "$ref": "#/components/schemas/Compliance" }, "businessOwner": { "type": "array", "description": "A list of stakeholders responsible for the asset from the business side.", "items": { "type": "string" } }, "devOwner": { "type": "array", "description": "A list of primary developers or engineering leads responsible for the code.", "items": { "type": "string" } }, "devOpsOwner": { "type": "array", "description": "A list of SRE or DevOps engineers managing the infrastructure.", "items": { "type": "string" } }, "productManager": { "type": "array", "description": "A list of product managers responsible for overseeing the application asset.", "items": { "type": "string" } }, "assetSelection": { "$ref": "#/components/schemas/ApplicationAssetSelection" } } }, "Exposures": { "enum": [ "DeployedToProduction", "SensitiveData", "ExternalAccessible" ], "type": "string", "description": "Represents the risks the system identifies on assets.", "title": "Exposures" }, "DataGovernance": { "enum": [ "PII", "PCI", "Financial", "PHI", "Sensitive" ], "type": "string", "description": "Type of data governance applied to the asset." }, "ApplicationEnrichStatus": { "enum": [ "IN_PROGRESS", "NOT_IN_PROGRESS" ], "type": "string", "description": "Indicates whether asset enrichment is currently in progress." }, "ExtendedFields": { "type": "object", "additionalProperties": false, "x-examples": {}, "description": "Exposure attributes associated with the asset.", "required": [ "creationType", "config" ], "properties": { "criteriaId": { "type": "string", "description": "A unique identifier of the criteria." }, "criteriaName": { "type": "string", "description": "Name of the criteria." }, "risk": { "type": "number", "format": "double", "description": "Calculated risk score associated with the criteria or asset." }, "id": { "type": "string", "description": "Unique identifier of the resource." }, "strongId": { "type": "string", "description": "Globally unique, immutable identifier for the resource." }, "name": { "type": "string", "description": "Name of the application asset." }, "description": { "type": "string", "description": "Description providing additional details about the asset." }, "exposures": { "type": "array", "items": { "$ref": "#/components/schemas/Exposures" } }, "coverage": { "type": "number", "format": "double", "description": "Represents the level of coverage applied to the asset." }, "businessCriticality": { "$ref": "#/components/schemas/BusinessCriticality" }, "businessUnit": { "type": "string", "description": "Business unit responsible for the asset." }, "creationType": { "$ref": "#/components/schemas/CreationType" }, "businessOwner": { "type": "array", "description": "Business owners responsible for the asset.", "items": { "type": "string" } }, "devOwner": { "type": "array", "description": "Development owners responsible for building and maintaining the asset.", "items": { "type": "string" } }, "devOpsOwner": { "type": "array", "description": "DevOps owners responsible for deployment and operations.", "items": { "type": "string" } }, "productManager": { "type": "array", "description": "Product managers responsible for the asset.", "items": { "type": "string" } }, "dataGovernance": { "$ref": "#/components/schemas/DataGovernance" }, "compliance": { "$ref": "#/components/schemas/Compliance" }, "environments": { "type": "string", "description": "Environment in which the asset is deployed (for example, development, staging, or production)." }, "assetsCount": { "type": "number", "format": "double", "description": "Total number of assets included in the response." }, "config": { "type": "object", "description": "Configuration settings associated with the application.", "required": [ "assetSelection" ], "properties": { "lastRefreshDate": { "type": "string", "format": "date-time", "description": "Date and time when the application data was last refreshed." }, "assetSelection": { "$ref": "#/components/schemas/ApplicationAssetSelection" } } }, "updatedAt": { "type": "string", "format": "date-time", "description": "Date and time when the configuration was last updated." }, "deletedAt": { "type": "string", "format": "date-time", "description": "Date and time when the configuration was deleted." }, "enrichStatus": { "$ref": "#/components/schemas/ApplicationEnrichStatus" }, "unifyAcrossProviders": { "type": "boolean", "description": "If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application." }, "unifyWithinProvider": { "type": "boolean", "description": "Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider." } } }, "BasicPaginatedResponse_ExtendedFields-Array_": { "type": "object", "additionalProperties": false, "required": [ "data", "hasNext" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/ExtendedFields" } }, "hasNext": { "type": "boolean", "description": "Indicates whether additional results are available beyond the current page." } }, "x-examples": { "Example 1": { "data": [ { "criteriaId": "string", "criteriaName": "string", "risk": 0, "id": "string", "strongId": "string", "name": "string", "description": "string", "exposures": [ "DeployedToProduction" ], "coverage": 0, "businessCriticality": "Critical", "businessUnit": "string", "creationType": "Auto", "businessOwner": [ "string" ], "devOwner": [ "string" ], "devOpsOwner": [ "string" ], "productManager": [ "string" ], "dataGovernance": "PII", "compliance": "PCI-DSS", "environments": "string", "assetsCount": 0, "config": { "lastRefreshDate": "2019-08-24T14:15:22Z", "assetSelection": { "selectionType": "filter", "section": "code", "filter": { "values": [ "string" ], "provider": "CIRCLE_CI", "filterType": "REPOSITORY" }, "assetIds": [ "string" ] } }, "updatedAt": "2019-08-24T14:15:22Z", "deletedAt": "2019-08-24T14:15:22Z", "enrichStatus": "IN_PROGRESS", "unifyAcrossProviders": true, "unifyWithinProvider": true } ], "hasNext": true } } }, "UpdateApplicationRequest": { "type": "object", "additionalProperties": false, "properties": { "businessCriticality": { "type": "string", "enum": [ "Critical", "High", "Medium", "Low" ], "description": "The operational importance of the asset." }, "creationType": { "type": "string", "enum": [ "Auto", "Manual" ], "description": "How the asset was created." }, "businessUnit": { "type": "string", "description": "Business unit responsible for the asset." }, "description": { "type": "string", "description": "Description providing additional details about the asset." }, "compliance": { "$ref": "#/components/schemas/Compliance" }, "businessOwner": { "type": "array", "description": "Business owners responsible for the asset.", "items": { "type": "string" } }, "devOwner": { "type": "array", "description": "Development owners responsible for building and maintaining the asset.", "items": { "type": "string" } }, "devOpsOwner": { "type": "array", "description": "DevOps owners responsible for deployment and operations.", "items": { "type": "string" } }, "productManager": { "type": "array", "description": "Product managers responsible for the asset.", "items": { "type": "string" } } }, "x-examples": { "Example 1": { "businessCriticality": "Critical", "creationType": "Auto", "businessUnit": "string", "description": "string", "compliance": "PCI-DSS", "businessOwner": [ "string" ], "devOwner": [ "string" ], "devOpsOwner": [ "string" ], "productManager": [ "string" ] } } }, "CIScansResponse": { "type": "object", "properties": { "issuesFound": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsSeverityBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "issuesTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "repositoryId": { "type": "string", "description": "ID of the scanned repository" }, "integrationId": { "type": "string" }, "scanId": { "type": "string" }, "provider": { "type": "string" }, "blockingPolicyName": { "type": "string" }, "blockingPolicyId": { "type": "string" }, "ciStatus": { "$ref": "#/components/schemas/ScanStatus" }, "scanHealth": { "$ref": "#/components/schemas/ScanHealthEnum" }, "scanDate": { "type": "string", "description": "The timestamp of the last scan execution" }, "branchName": { "type": "string", "description": "The name of the branch analyzed during the scan" }, "organizationName": { "type": "string", "description": "Name of the organization owning the repository" }, "repoName": { "type": "string", "description": "Name of the scanned repository" } } }, "CreateRequest": { "type": "object", "title": "CreateRequest", "description": "Define the Application Security policy. \n\n**Notes:** \n- The `policyType` field is auto-assigned by the API based on the `Finding Type` in conditions, it is not set in the request body.\n- The `conditions` and `scope` fields are required. The `scope` can be set to `{}` for global scope.\"", "additionalProperties": false, "x-examples": {}, "required": [ "conditions", "name", "scope", "triggers" ], "properties": { "conditions": { "$ref": "#/components/schemas/PolicyCondition" }, "description": { "type": "string", "description": "A brief description of the AppSec policy's purpose." }, "name": { "type": "string", "description": "A unique name for the AppSec policy." }, "scope": { "$ref": "#/components/schemas/PolicyScope" }, "triggers": { "$ref": "#/components/schemas/AppsecPolicyTriggersandActions" }, "enabled": { "type": "boolean", "description": "Whether the policy is enabled upon creation." }, "assetGroupIds": { "type": "array", "description": "A list of asset group IDs that the policy should apply to. If the list is empty, the policy applies globally, unless other scope conditions are defined.\r\n**Note** : Cannot be used with the `scope` parameter.", "items": { "type": "number", "format": "double" } }, "suggestionId": { "type": "string", "description": "Unique identifier for the suggested policy to link this policy to." }, "userSbac": { "type": "array", "description": "Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is created. Controls which asset groups the policy applies to based on the creator's access. When empty, the policy applies to all user scoped asset groups.", "items": { "type": "number", "format": "double" } } } }, "DataSource": { "enum": [ "GitHub", "GitLab", "Bitbucket", "Azure Repos", "Bitbucket Server", "Bitbucket DataCenter", "GitLab Dedicated", "GitHub Enterprise", "GitLab Self-Managed", "Aws Code Commit" ], "type": "string" }, "DetectionMethod": { "enum": [ "Secrets Security", "Attack Path", "Cve Security", "Operational Risk Security", "License Security", "IaC Security", "CIEM Scanner", "API Traffic Monitor", "API Posture Scanner", "CLI Scanner", "Agentless Disk Scanner", "Kubernetes Scanner", "Compute Policy", "CSPM Scanner" ], "type": "string" }, "FindingType": { "enum": [ "CICD_RISKS", "VULNERABILITY", "SECRETS", "IAC_MISCONFIGURATION", "CODE_WEAKNESS", "LICENSES", "OPERATIONAL_RISK", "MALWARE", "DRIFT" ], "type": "string" }, "Omit_PackagesMetadataBq.lastCommitTimestamp-or-latestReleaseTimestamp-or-firstVersionTimestamp-or-updatedTimestamp_": { "$ref": "#/components/schemas/Pick_PackagesMetadataBq.Exclude_keyofPackagesMetadataBq.lastCommitTimestamp-or-latestReleaseTimestamp-or-firstVersionTimestamp-or-updatedTimestamp__" }, "PackagesMetadataResponse": { "allOf": [ { "$ref": "#/components/schemas/Omit_PackagesMetadataBq.lastCommitTimestamp-or-latestReleaseTimestamp-or-firstVersionTimestamp-or-updatedTimestamp_" }, { "properties": { "updatedTimestamp": { "type": "number", "format": "double" }, "firstVersionTimestamp": { "type": "number", "format": "double" }, "latestReleaseTimestamp": { "type": "number", "format": "double" }, "lastCommitTimestamp": { "type": "number", "format": "double" } }, "required": [ "updatedTimestamp" ], "type": "object" } ] }, "PeriodicScansResponse": { "type": "object", "properties": { "issuesFound": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsSeverityBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "issuesTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "repositoryId": { "type": "string", "description": "ID of the scanned repository" }, "integrationId": { "type": "string" }, "provider": { "type": "string" }, "scanId": { "type": "string", "description": "Scan ID" }, "scanHealth": { "$ref": "#/components/schemas/ScanHealthEnum" }, "scanDate": { "type": "string", "description": "Timestamp of the last scan execution" }, "branchName": { "type": "string", "description": "The branch analyzed during the scan" }, "organizationName": { "type": "string", "description": "The organization owning the repository" }, "repoName": { "type": "string", "description": "Name of the scanned repository" } } }, "Pick_PackagesMetadataBq.Exclude_keyofPackagesMetadataBq.lastCommitTimestamp-or-latestReleaseTimestamp-or-firstVersionTimestamp-or-updatedTimestamp__": { "properties": { "packageName": { "type": "string" }, "packageManager": { "type": "string" }, "isDeprecated": { "type": "boolean" }, "maintainersNumber": { "type": "number", "format": "double" }, "weeklyDownloads": { "type": "number", "format": "double" }, "openPrs": { "type": "number", "format": "double" }, "isArchived": { "type": "boolean" }, "repoOwnerType": { "type": "string" }, "contributorsNumber": { "type": "number", "format": "double" }, "repositoryUrl": { "type": "string" }, "registryUrl": { "type": "string" }, "latestVersionNumber": { "type": "string" }, "numberOfVersions": { "type": "number", "format": "double" }, "stars": { "type": "number", "format": "double" }, "forks": { "type": "number", "format": "double" }, "openIssues": { "type": "number", "format": "double" }, "popularity": { "type": "string" }, "maintenance": { "type": "string" }, "operationalRisk": { "type": "string" } }, "required": [ "packageName", "packageManager" ], "type": "object" }, "Policy": { "type": "object", "additionalProperties": false, "x-examples": {}, "required": [ "conditions", "id", "name", "triggers", "relatedDetectionRules", "createdBy", "isCustom", "status", "version" ], "properties": { "dateCreated": { "type": "string", "description": "The date and time when the policy was created" }, "suggestionHash": { "type": "string", "description": "Unique identifier for the suggested policy" }, "conditions": { "$ref": "#/components/schemas/CortexCondition" }, "description": { "type": "string", "description": "Description of the policy" }, "id": { "type": "string", "description": "Unique identifier for the policy" }, "name": { "type": "string", "description": "Name of the policy" }, "scope": { "$ref": "#/components/schemas/CortexCondition" }, "triggers": { "$ref": "#/components/schemas/AppsecPolicyTriggersandActions" }, "dateDeleted": { "type": "string", "description": "The date and time when the policy was deleted" }, "deletedBy": { "type": "string", "description": "The user or system that deleted the policy" }, "relatedDetectionRules": { "type": "array", "description": "List of related detection rules", "items": { "type": "string" } }, "assetGroupIds": { "type": "array", "description": "List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.", "items": { "type": "number", "format": "double" } }, "suggestionId": { "type": "string", "description": "Unique identifier for the suggested policy" }, "createdBy": { "type": "string", "description": "The user or system that created the policy" }, "dateModified": { "type": "string", "description": "The date and time when the policy was last modified" }, "isClonable": { "type": "boolean", "description": "Indicates if the policy is cloneable" }, "isCustom": { "type": "boolean", "description": "Indicates if the policy is a custom policy or a system-provided policy" }, "isEditable": { "type": "boolean", "description": "Indicates if the policy is editable" }, "lastTriggered": { "type": "string", "description": "The date and time when the policy was last triggered" }, "modifiedBy": { "type": "string", "description": "The user or system that last modified the policy" }, "overrideIssueSeverity": { "description": "Set the severity of the issue and override the system severity. If not used, system severity is kept.", "enum": [ "Critical", "High", "Medium", "Low" ] }, "policyType": { "type": "string", "description": "Indicates the policy type. Auto-assigned by the API based on the `Finding Type` in conditions. **Possible values**:\n- `code_image_scanners`: for VULNERABILITY, IAC_MISCONFIGURATION, SECRETS, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE\n- `cicd_configuration_scanners`: for CICD_RISKS\n- `drift_detection_scanners`: for DRIFT" }, "scopeFields": { "type": "object", "description": "Defines all valid scope fields grouped by category for code, CI/CD, drift, and common contexts.", "required": [ "applicationsScopeFields", "cicdOnlyScopeFields", "codeOnlyScopeFields", "commonScopeFields", "defaultScopeFields", "driftOnlyScopeFields" ], "properties": { "applicationsScopeFields": { "description": "Fields that apply applications scopes.", "type": "array", "items": { "enum": [ "application_business_criticality", "application_business_owner" ] } }, "cicdOnlyScopeFields": { "type": "array", "description": "Fields that only apply to CI/CD related scope keys.", "items": { "enum": [ "cicd_instance_id", "cicd_instance_name", "cicd_pipeline_id", "cicd_pipeline_name", "collaborator_email", "collaborator_inactive_days", "collaborator_mfa_enabled", "collaborator_name", "repository_organization", "repository_organization_name" ] } }, "codeOnlyScopeFields": { "type": "array", "description": "Fields that only apply to code repository scope keys.", "items": { "enum": [ "has_access_sensitive_data", "has_deployed_assets", "has_internet_exposed", "has_leverage_privileged_capabilities" ] } }, "commonScopeFields": { "type": "array", "description": "Fields that apply to both code and CI/CD scopes.", "items": { "enum": [ "business_application_names", "category", "is_public_repository", "repository_id", "repository_name", "repository_provider", "xdm__asset__tags" ] } }, "defaultScopeFields": { "type": "array", "description": "Fields that comes as default in the finding.", "items": { "enum": [ "xdm__asset__id", "xdm__asset__name" ] } }, "driftOnlyScopeFields": { "type": "array", "description": "Fields that only apply to IAC drift scope keys.", "items": { "enum": [ "cloud_account", "cloud_region" ] } } } }, "status": { "$ref": "#/components/schemas/PolicyStatus" }, "version": { "type": "number", "format": "double", "description": "The version of the policy - goes up by one every policy update" } } }, "PolicyStatus": { "description": "Current status of the policy.", "enum": [ "disabled", "enabled" ], "type": "string", "x-examples": { "Example 1": "enabled" }, "default": "enabled" }, "PolicyTrigger": { "description": "Items Enum: 'cicd', 'pr', 'periodic'", "enum": [ "cicd", "pr", "periodic" ], "type": "string" }, "PRScansResponse": { "type": "object", "properties": { "issuesFound": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsSeverityBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "findingsTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "issuesTypesBreakdown": { "$ref": "#/components/schemas/Record_string.number_" }, "pullRequestTitle": { "type": "string" }, "integrationId": { "type": "string" }, "repositoryId": { "type": "string", "description": "ID of the scanned repository" }, "scanId": { "type": "string" }, "provider": { "type": "string" }, "userEmail": { "type": "string" }, "blockingPolicyName": { "type": "string" }, "blockingPolicyId": { "type": "string" }, "scanHealth": { "$ref": "#/components/schemas/ScanHealthEnum" }, "scanDate": { "type": "string", "description": "The timestamp of the last scan execution" }, "commitId": { "type": "string", "description": "The commit included in the PR" }, "pullRequestStatus": { "$ref": "#/components/schemas/ScanStatus" }, "pullRequestId": { "type": "string", "description": "The ID of the PR" }, "branchName": { "type": "string", "description": "Name of the branch analyzed during the scan" }, "organizationName": { "type": "string", "description": "Specifies the organization owning the repository" }, "repoName": { "type": "string" } } }, "PublicScanRepositoryInput": { "properties": { "branchName": { "type": "string" } }, "type": "object", "additionalProperties": false, "title": "" }, "Record_string.number_": { "properties": {}, "additionalProperties": { "type": "number", "format": "double" }, "type": "object" }, "ResolutionReason": { "enum": [ "Resolved - Known Issue", "Resolved - Duplicate Incident", "Resolved - False Positive", "Resolved - Other", "Resolved - True Positive", "Resolved - Security Testing", "Resolved - Dismissed", "Resolved - Fixed", "Resolved - Auto Resolve", "Resolved - Threat Handled" ], "type": "string" }, "ResolutionStatus": { "enum": [ "New", "Under Investigation", "Resolved" ], "type": "string" }, "ScanFailureResponse": { "properties": { "err_msg": { "type": "string" }, "metadata": { "properties": {}, "additionalProperties": {}, "type": "object" } }, "required": [ "err_msg", "metadata" ], "type": "object", "additionalProperties": false }, "ScanFindingsResponse": { "properties": { "scan_source": { "$ref": "#/components/schemas/ScanType" }, "git_user": { "type": "string" }, "first_hash_time": { "type": "string" }, "first_hash": { "type": "string" }, "platform_id": { "type": "string" }, "branch": { "type": "string" }, "detection_method": { "$ref": "#/components/schemas/DetectionMethod" }, "file_path": { "type": "string" }, "description": { "type": "string" }, "last_observed": { "type": "string" }, "first_observed": { "type": "string" }, "suppression_type": { "$ref": "#/components/schemas/SuppressionType" }, "data_source": { "$ref": "#/components/schemas/DataSource" }, "name": { "type": "string" }, "category": { "type": "string" }, "asset_id": { "type": "string" }, "asset_name": { "type": "string" }, "severity": { "$ref": "#/components/schemas/SeverityEnum" }, "scan_id": { "type": "string" }, "issue_name": { "type": "string" } }, "required": [ "scan_source", "git_user", "first_hash_time", "first_hash", "platform_id", "branch", "detection_method", "file_path", "description", "last_observed", "first_observed", "suppression_type", "data_source", "name", "category", "asset_id", "asset_name", "severity", "scan_id", "issue_name" ], "type": "object" }, "ScanHealthEnum": { "enum": [ "COMPLETED", "ERROR", "PARTIALLY_COMPLETED", "IN_PROGRESS" ], "type": "string", "description": "The health of the scan. Valid values include:\n- `ERROR`: Indicates an error with the scan\n- `PARTIALLY_COMPLETED`: Indicates that the scan executed partially with some scan modules succeeded and others failing\n- `IN_PROGRESS`: The scan is in progress\n- `COMPLETED`: Indicates that the scan is complete" }, "ScanIssuesResponse": { "properties": { "resolution_comment": { "type": "string" }, "resolution_reason": { "$ref": "#/components/schemas/ResolutionReason" }, "resolution_status": { "$ref": "#/components/schemas/ResolutionStatus" }, "assignee": { "type": "string" }, "branch": { "type": "string" }, "run_id": { "type": "string" }, "pull_request_id": { "type": "string" }, "repo_id": { "type": "string" }, "created": { "type": "string" }, "file_path": { "type": "string" }, "asset_name": { "type": "string" }, "detection_method": { "$ref": "#/components/schemas/DetectionMethod" }, "alert_name": { "type": "string" }, "severity": { "$ref": "#/components/schemas/SeverityEnum" }, "scan_id": { "type": "string" }, "issue_id": { "type": "string" } }, "required": [ "resolution_comment", "resolution_reason", "resolution_status", "assignee", "branch", "run_id", "pull_request_id", "repo_id", "created", "file_path", "asset_name", "detection_method", "alert_name", "severity", "scan_id", "issue_id" ], "type": "object" }, "ScanRepositorySuccessResponse": { "properties": { "metadata": { "properties": { "scan_id": { "type": "string" } }, "required": [ "scan_id" ], "type": "object" } }, "required": [ "metadata" ], "type": "object", "additionalProperties": false }, "ScanStatus": { "enum": [ "ERROR", "FAILED", "IN_PROGRESS", "PASSED", "PASSED_WITH_ISSUES" ], "type": "string", "description": "Status of the PR scan. Valid values include:\n- `PASSED`\n- `PASSED_WITH_ISSUES`\n- `BLOCKED`\n- `IN_PROGRESS`\n- `ERROR`\n- `FAILED`" }, "ScanType": { "enum": [ "pr", "cicd", "periodic" ], "type": "string" }, "SeverityEnum": { "enum": [ "Critical", "High", "Medium", "Low" ], "type": "string" }, "SuppressionType": { "enum": [ "Inline" ], "type": "string" }, "UpdateRequest": { "$ref": "#/components/schemas/Partial_BasePolicyRequest" }, "ValidateCustomRuleRequestParams": { "properties": { "framework": { "$ref": "#/components/schemas/FrameworkName" }, "definition": { "type": "string" } }, "required": [ "framework", "definition" ], "type": "object", "additionalProperties": false }, "CortexCondition": { "type": "object", "title": "CortexCondition", "description": "Condition or scope filter for the policy. ", "additionalProperties": false, "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "properties": { "SEARCH_FIELD": { "type": "string", "description": "Field the condition filter matches.", "example": "Finding Type" }, "SEARCH_TYPE": { "$ref": "#/components/schemas/ConditionOperators" }, "SEARCH_VALUE": { "description": "The value compared against. The type of this field will differ depending on the `SEARCH_FIELD` that was specified.", "anyOf": [ { "type": "boolean" }, { "$ref": "#/components/schemas/ConditionValue" }, { "type": "number", "format": "double" }, { "type": "string" } ] }, "AND": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } }, "OR": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } } } }, "PolicyCondition": { "type": "object", "title": "PolicyCondition", "description": "Defines the specific criteria (conditions) that will trigger the policy. You can combine multiple conditions to create complex rules for when the policy should be applied. If you combine multiple `Finding Type` values using `OR`, only the common fields across those types will be valid.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Selecting `Finding Type` determines which condition fields you can configure. Each `Finding Type` supports a specific set of condition fields. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table.", "additionalProperties": false, "x-examples": { "Example 1": { "SEARCH_FIELD": "", "SEARCH_TYPE": "", "SEARCH_VALUE": "" } }, "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "properties": { "SEARCH_FIELD": { "type": "string", "description": "Defines the field the condition filter should match. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table." }, "SEARCH_TYPE": { "$ref": "#/components/schemas/ConditionOperators" }, "SEARCH_VALUE": { "description": "Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.", "anyOf": [ { "type": "boolean" }, { "type": "number", "format": "double" }, { "type": "string" } ] }, "AND": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } }, "OR": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } } } }, "PolicyScope": { "type": "object", "title": "PolicyScope", "description": "Defines the type of assets to be evaluated by the policy (the scope). You can combine multiple conditions to create complex rules for when the policy should be applied.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Cannot be used if `assetGroupIds` are set.\n\nFor the list of available scope fields, see [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables).", "additionalProperties": false, "x-examples": { "Example 1": { "SEARCH_FIELD": "", "SEARCH_TYPE": "", "SEARCH_VALUE": "" } }, "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "properties": { "SEARCH_FIELD": { "type": "string", "description": "Defines the field the matching criteria filter should match. To see which fields are allowed for each type, see the [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table." }, "SEARCH_TYPE": { "$ref": "#/components/schemas/ConditionOperators" }, "SEARCH_VALUE": { "description": "Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.", "anyOf": [ { "type": "boolean" }, { "type": "number", "format": "double" }, { "type": "string" } ] }, "AND": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } }, "OR": { "type": "array", "items": { "$ref": "#/components/schemas/CortexCondition" } } } }, "ConditionOperators": { "type": "string", "enum": [ "ARRAY_CONTAINS", "ARRAY_NOT_CONTAINS", "CONTAINS", "CONTAINS_IN_LIST", "EQ", "GT", "GTE", "IN", "JSON_WILDCARD", "JSON_WILDCARD_NOT", "LTE", "LT", "NCONTAINS", "NEQ", "NIN", "NOT_CONTAINS_IN_LIST", "RANGE", "RELATIVE_TIMESTAMP", "WILDCARD", "WILDCARD_NOT", "withinGracePeriod" ], "title": "ConditionOperators", "description": "Condition operator for this filter." }, "Scanner": { "type": "string", "enum": [ "CICD", "IAC", "SCA", "SECRETS" ], "description": "The scanner type used by this rule to detect security issues." }, "Severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "LOW", "MEDIUM" ], "title": "Severity", "description": "Severity level of the rule" }, "FrameworkName": { "type": "string", "enum": [ "ARM", "BICEP", "CLOUDFORMATION", "KUBERNETES", "TERRAFORM" ], "example": "TERRAFORM", "title": "FrameworkName", "description": "Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`." }, "SortDirection": { "type": "integer", "enum": [ -1, 1 ] }, "GetRulesResponseObject": { "type": "object", "title": "GetRulesResponseObject", "properties": { "offset": { "type": "number", "description": "The starting position of the current page of results." }, "nextOffset": { "type": "number", "example": 100, "description": "The offset to use in the next request to retrieve the next page of results. Returns `null` if there are no more results.", "nullable": true }, "rules": { "type": "array", "items": { "$ref": "#/components/schemas/DetectionRule" } } }, "x-examples": {} }, "Control": { "type": "object", "additionalProperties": false, "description": "An array of individual controls within the compliance standard that this rule satisfies. ", "required": [ "controlName", "controlDefinition" ], "properties": { "controlName": { "type": "string", "description": "The name or identifier of the compliance control.", "example": "The default namespace should not be used" }, "controlDefinition": { "type": "string", "description": "A description of what the compliance control requires or validates. ", "example": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult." } } }, "ComplianceStandard": { "type": "object", "additionalProperties": false, "description": "An array of compliance standards associated with this rule.", "properties": { "standardName": { "type": "string", "description": "The name of the compliance framework or standard that this rule is mapped to. ", "example": "CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4_copy v1.4" }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/Control" } } } }, "DetectionRule": { "type": "object", "title": "DetectionRule", "description": "Details of the Application Security rule", "x-examples": { "IAC Rule successful response": { "category": "PUBLIC", "cloudProvider": null, "createdAt": { "value": "2024-01-01T00:00:00.000Z" }, "description": "Detects S3 buckets with public access enabled", "shortDescription": null, "detectionMethod": "IaC Security", "docLink": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference", "domain": "POSTURE", "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Public Exposure Storage Buckets", "findingTypeId": 30040031, "findingTypeName": "s3 bucket public access check", "frameworks": [ { "definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false\nmetadata:\n name: s3 bucket public access check\n category: public\n severity: high\n guidelines: Detects S3 buckets with public access enabled\n", "definitionLink": null, "name": "TERRAFORMPLAN", "remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource", "remediationIds": [], "resourceTypes": [] }, { "definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false\nmetadata:\n name: s3 bucket public access check\n category: public\n severity: high\n guidelines: Detects S3 buckets with public access enabled\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource", "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_", "isCustom": true, "isEnabled": true, "labels": [ "Custom-Rule", "S3-Security" ], "updatedAt": { "value": "2024-01-01T00:00:00.000Z" }, "mitreTactics": [], "mitreTechniques": [], "name": "s3 bucket public access check", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "source": null, "subCategory": "STORAGE_BUCKETS", "complianceStandards": [], "cspmRuleId": "", "cspmTypeId": 60100018 }, "Secrets Rule successful response": { "category": "API_KEYS", "cloudProvider": null, "createdAt": { "value": "2024-01-01T00:00:00.000Z" }, "description": "This is a secret rule description", "shortDescription": null, "detectionMethod": "Secrets Security", "docLink": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference", "domain": "POSTURE", "findingCategory": "Data", "findingDocs": "Custom Secrets rule for API Keys (Secret scanner)", "findingTypeId": 30040054, "findingTypeName": "example secret rule", "frameworks": [ { "definition": "definition:\n cond_type: secrets\n value: AIza[0-9A-Za-z-_]{35}\n", "definitionLink": null, "name": "GIT", "remediationDescription": "Revoke the GCP API key immediately through the Google Cloud Console.", "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_", "isCustom": true, "isEnabled": true, "labels": [ "my-label" ], "updatedAt": { "value": "2024-01-01T00:00:00.000Z" }, "mitreTactics": [], "mitreTechniques": [], "name": "example secret rule", "owner": "CAS", "scanner": "SECRETS", "severity": "LOW", "source": null, "subCategory": null, "complianceStandards": [] } }, "properties": { "category": { "type": "string", "description": "Custom Appsec rule category." }, "cloudProvider": { "$ref": "#/components/schemas/CloudProvider" }, "createdAt": { "type": "string", "format": "date-time", "description": "The timestamp when the AppSec rule was created." }, "description": { "type": "string", "description": "The rule description." }, "shortDescription": { "type": "string", "description": "A brief summary of the rule. If not provided, this field is null.", "nullable": true }, "detectionMethod": { "type": "string", "description": "Security scanner used to detect findings for this rule.", "example": "IaC Security" }, "docLink": { "type": "string", "description": "A URL linking to the relevant Cortex Cloud documentation page." }, "domain": { "type": "string", "description": "The domain associated with the rule.", "example": "POSTURE" }, "findingCategory": { "$ref": "#/components/schemas/FindingCategory" }, "findingDocs": { "type": "string", "example": "Custom IaC rule for Public Exposure Storage Buckets" }, "findingTypeId": { "type": "number", "format": "double", "description": "The numeric identifier of the finding type associated with this rule. ", "example": 30040031 }, "findingTypeName": { "type": "string", "description": "Display name of the finding type associated with this rule. Matches the rule `name` for custom rules." }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/Frameworks" } }, "id": { "type": "string", "description": "Unique identifier of the AppSec rule." }, "isCustom": { "type": "boolean", "description": "Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false)." }, "isEnabled": { "type": "boolean", "description": "Indicates whether the rule is currently active and will generate findings during scans." }, "labels": { "type": "array", "description": "Labels assigned to the rule.", "items": { "type": "string" } }, "updatedAt": { "type": "string", "format": "date-time", "description": "The timestamp when the AppSec rule was last modified." }, "mitreTactics": { "type": "array", "description": "The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.", "nullable": true, "items": { "type": "string" } }, "mitreTechniques": { "type": "array", "description": "The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.", "nullable": true, "items": { "type": "string" } }, "name": { "type": "string", "description": "Name of the Appsec rule." }, "owner": { "type": "string", "description": "The internal service owner of the rule.", "example": "CAS" }, "scanner": { "$ref": "#/components/schemas/Scanner" }, "severity": { "$ref": "#/components/schemas/Severity" }, "subCategory": { "type": "string", "description": "Custom rule subcategory.", "example": "STORAGE_BUCKETS" }, "complianceStandards": { "$ref": "#/components/schemas/ComplianceStandard" }, "cspmRuleId": { "type": "string", "description": "The ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns `null` if no rule is mapped.", "nullable": true }, "cspmTypeId": { "type": "number", "example": 60100018, "description": "The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via `cspmRuleId`.", "nullable": true } } }, "CloudProvider": { "type": "string", "enum": [ "ALIBABA_CLOUD", "AWS", "Azure", "GCP", "IBM", "ORACLE", "OTHER" ], "example": "GCP", "description": "The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null." }, "FindingCategory": { "type": "string", "enum": [ "Code", "Configuration", "Data", "Vulnerability" ], "description": "Category of findings this rule generates." }, "Frameworks": { "type": "object", "properties": { "frameworkDetails": { "nullable": true, "allOf": [ { "$ref": "#/components/schemas/FrameworkDetails" } ] } }, "description": "Framework objects containing the rule definition and remediation details for each supported IaC framework or secrets detection framework. " }, "FrameworkDetails": { "type": "object", "properties": { "definition": { "type": "string", "description": "The rule definition.", "nullable": true }, "definition_link": { "type": "string", "description": "**http** link to the definition documentation.", "nullable": true }, "name": { "$ref": "#/components/schemas/FrameworkName" }, "remediation_description": { "type": "string", "description": "The remediation steps that will appear on the Appsec rule's findings.", "nullable": true }, "remediation_ids": { "type": "array", "description": "The IDs of related remediation resources.", "nullable": true, "items": { "type": "string" } }, "resource_types": { "type": "array", "description": "The resource types associated with the rule.", "nullable": true, "items": { "type": "string" } } } }, "CreateOrModifyCustomRuleRequestParams": { "type": "object", "title": "CreateOrModifyCustomRuleRequestParams", "description": "Define the Application Security custom rule. The `category` option should match your selection for `scanner`.", "additionalProperties": false, "required": [ "name", "severity", "scanner", "frameworks", "category", "subCategory" ], "properties": { "name": { "type": "string", "description": "A unique name for the Appsec rule.", "example": "S3 Bucket Public Access Check" }, "description": { "type": "string", "description": "Description of the rule", "example": "Detects S3 buckets with public access enabled" }, "severity": { "$ref": "#/components/schemas/Severity" }, "labels": { "type": "array", "description": "Labels to be assigned to the rule", "items": { "type": "string", "example": "S3-Security" } }, "scanner": { "$ref": "#/components/schemas/CustomRuleScanner" }, "frameworks": { "$ref": "#/components/schemas/FrameworkRequestParams" }, "category": { "anyOf": [ { "$ref": "#/components/schemas/CustomRuleIacCategory" }, { "$ref": "#/components/schemas/CustomRuleSecretsCategory" } ] }, "subCategory": { "$ref": "#/components/schemas/CustomRuleIacSubCategory" }, "cspmRuleId": { "type": "string", "description": "The unique identifier of the Cloud Security rule to which the custom Application Security rule will be mapped. Applicable only when `scanner` is set to `IAC`.", "example": "ff6a26a5-f036-4d3a-a650-d5de1d568bab", "nullable": true }, "clonedFromRuleId": { "type": "string", "description": "Optional. ID of the source rule from which this rule was cloned. This field is present only for cloned rules.", "nullable": true } } }, "CustomRuleScanner": { "title": "CustomRuleScanner", "description": "The type of security scanner used to detect findings of this rule. Choose any one of the scanners.", "enum": [ "IAC", "SECRETS" ], "type": "string" }, "FrameworkRequestParams": { "type": "object", "title": "FrameworkRequestParams", "additionalProperties": false, "required": [ "name", "definition" ], "properties": { "name": { "$ref": "#/components/schemas/FrameworkName" }, "definition": { "type": "string", "description": "The rule definition\n\nIaC example:\n`definition:\\n cond_type: attribute\\n resource_types:\\n - aws_s3_bucket_public_access_block\\n attribute: block_public_acls\\n operator: equals\\n value: false`\n\nSecrets example:\n`definition:\\n cond_type: secrets\\n value: AIza[0-9A-Za-z-_]{35}`\n", "example": "definition:\\n cond_type: attribute\\n resource_types:\\n - aws_s3_bucket_public_access_block\\n attribute: block_public_acls\\n operator: equals\\n value: false", "nullable": true }, "definitionLink": { "type": "string", "description": "**http** link to the definition documentation.", "nullable": true }, "remediationDescription": { "type": "string", "description": "The remediation steps that will appear on the Appsec rule's findings.\n\nIaC Example: Set block_public_acls to true in aws_s3_bucket_public_access_block resource\n\nSecrets Example: Revoke the GCP API key immediately through the Google Cloud Console.", "example": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource", "nullable": true } } }, "CustomRuleCategory": { "anyOf": [ { "$ref": "#/components/schemas/CustomRuleIacCategory" }, { "$ref": "#/components/schemas/CustomRuleSecretsCategory" } ] }, "CustomRuleIacCategory": { "type": "string", "enum": [ "AI_ML", "COMPUTE", "IAM", "KUBERNETES", "LOGGING", "MONITORING", "NETWORKING", "PUBLIC", "STORAGE" ], "example": "PUBLIC", "title": "CustomRuleIacCategory", "description": "Custom rule IaC category. Applicable only when `scanner` is set to `IAC`." }, "CustomRuleSecretsCategory": { "type": "string", "enum": [ "API_KEYS", "DATABASE_CREDENTIALS", "ENCRYPTION_KEYS", "CLOUD_SERVICE_PROVIDER_KEYS", "SSH_KEYS", "ENVIRONMENT_VARIABLES", "SENSITIVE_TOKENS", "THIRD_PARTY_SERVICES" ], "title": "CustomRuleSecretsCategory", "description": "Custom rule secret category. Applicable only when `scanner` is set to `SECRETS`." }, "CustomRuleIacSubCategory": { "type": "string", "enum": [ "GUARDRAILS", "RISKY_MODELS", "PUBLIC_EXPOSURE", "PERMISSIONS", "ENCRYPTION", "RETENTION", "FORMATS", "DISABLED_OR_MISSING", "UNDER_USE", "NETWORK_POLICIES", "ACCESS_CONTROL", "LOGGING_AND_MONITORING", "RESOURCE_MANAGEMENT", "NATIVE_SECURITY_CONTROLS", "MANAGEMENT_SERVICES_EXPOSURE", "OVERPROVISIONED", "STARTUP_SCRIPT_LEAKS", "DEFAULT_CREDENTIALS_OR_AUTH", "UNSANCTIONED_RESOURCE_OR_TYPE", "BACKUPS", "VERSIONING", "REPLICATION", "ALERTING", "REDUNDANCY", "ADMIN_INTERFACES", "DATABASE_ENDPOINTS", "STORAGE_BUCKETS", "APIS", "SENSITIVE_PORTS", "LOAD_BALANCING", "INGRESS_CONTROLS", "EGRESS_CONTROLS", "ENCRYPTION_AND_PROTOCOLS", "VPC_VCN_VNET", "FLOW_LOGS", "TAGS_AND_METADATA", "RESOURCE_HEALTH", "PERFORMANCE_MONITORING", "ALERTING_AND_NOTIFICATIONS", "UNINTEGRATED", "STORAGE", "OVERLY_PERMISSIVE", "UNUSED", "CREDENTIAL_EXPOSURE", "MFA", "ROLE_SEPARATION", "SHARED", "EXPIRED_KEY_CONTROLS", "AUTHENTICATION_POLICIES" ], "example": "STORAGE_BUCKETS", "title": "CustomRuleIacSubCategory", "description": "Custom rule subcategory. The supported values depend on the selected category. Refer to the following table for the valid subcategories for each category.\n\nNote: This field is applicable only when `scanner` is set to `IAC`.\n\n## Category and Subcategory Table for IaC Scanner\n\n| Category | Subcategory |\n|----------|-------------|\n| AI and Machine Learning (`AI_ML`) | Guardrails (`GUARDRAILS`) |\n| AI and Machine Learning (`AI_ML`) | Risky models (`RISKY_MODELS`) |\n| AI and Machine Learning (`AI_ML`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| AI and Machine Learning (`AI_ML`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Encryption (`ENCRYPTION`) |\n| Logging (`LOGGING`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Retention (`RETENTION`) |\n| Logging (`LOGGING`) | Formats (`FORMATS`) |\n| Logging (`LOGGING`) | Disabled or missing (`DISABLED_OR_MISSING`) |\n| Logging (`LOGGING`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| Logging (`LOGGING`) | Under Use (`UNDER_USE`) |\n| Kubernetes (`KUBERNETES`) | Network Policies (`NETWORK_POLICIES`) |\n| Kubernetes (`KUBERNETES`) | Access Control (`ACCESS_CONTROL`) |\n| Kubernetes (`KUBERNETES`) | Logging and Monitoring (`LOGGING_AND_MONITORING`) |\n| Kubernetes (`KUBERNETES`) | Resource Management (`RESOURCE_MANAGEMENT`) |\n| Kubernetes (`KUBERNETES`) | Native Security Controls (`NATIVE_SECURITY_CONTROLS`) |\n| Kubernetes (`KUBERNETES`) | Management Services Exposure (`MANAGEMENT_SERVICES_EXPOSURE`) |\n| Compute (`COMPUTE`) | Overprovisioned (`OVERPROVISIONED`) |\n| Compute (`COMPUTE`) | Startup Script Leaks (`STARTUP_SCRIPT_LEAKS`) |\n| Compute (`COMPUTE`) | Default Credentials or Auth (`DEFAULT_CREDENTIALS_OR_AUTH`) |\n| Compute (`COMPUTE`) | Unsanctioned Resource or Type (`UNSANCTIONED_RESOURCE_OR_TYPE`) |\n| Storage (`STORAGE`) | Encryption (`ENCRYPTION`) |\n| Storage (`STORAGE`) | Permissions (`PERMISSIONS`) |\n| Storage (`STORAGE`) | Backups (`BACKUPS`) |\n| Storage (`STORAGE`) | Versioning (`VERSIONING`) |\n| Storage (`STORAGE`) | Replication (`REPLICATION`) |\n| Storage (`STORAGE`) | Alerting (`ALERTING`) |\n| Storage (`STORAGE`) | Redundancy (`REDUNDANCY`) |\n| Public (`PUBLIC`) | Admin Interfaces (`ADMIN_INTERFACES`) |\n| Public (`PUBLIC`) | Database Endpoints (`DATABASE_ENDPOINTS`) |\n| Public (`PUBLIC`) | Storage Buckets (`STORAGE_BUCKETS`) |\n| Public (`PUBLIC`) | APIs (`APIS`) |\n| Public (`PUBLIC`) | Sensitive Ports (`SENSITIVE_PORTS`) |\n| Networking (`NETWORKING`) | Load Balancing (`LOAD_BALANCING`) |\n| Networking (`NETWORKING`) | Ingress Controls (`INGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Egress Controls (`EGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Encryption and Protocols (`ENCRYPTION_AND_PROTOCOLS`) |\n| Networking (`NETWORKING`) | VPC/VCN/VNET (`VPC_VCN_VNET`) |\n| Networking (`NETWORKING`) | Flow Logs (`FLOW_LOGS`) |\n| Monitoring (`MONITORING`) | Tags and metadata (`TAGS_AND_METADATA`) |\n| Monitoring (`MONITORING`) | Resource Health (`RESOURCE_HEALTH`) |\n| Monitoring (`MONITORING`) | Performance Monitoring (`PERFORMANCE_MONITORING`) |\n| Monitoring (`MONITORING`) | Alerting and Notifications (`ALERTING_AND_NOTIFICATIONS`) |\n| Monitoring (`MONITORING`) | Unintegrated (`UNINTEGRATED`) |\n| Monitoring (`MONITORING`) | Storage (`STORAGE`) |\n| IAM (`IAM`) | Overly Permissive (`OVERLY_PERMISSIVE`) |\n| IAM (`IAM`) | Unused (`UNUSED`) |\n| IAM (`IAM`) | Credential Exposure (`CREDENTIAL_EXPOSURE`) |\n| IAM (`IAM`) | MFA (`MFA`) |\n| IAM (`IAM`) | Role Separation (`ROLE_SEPARATION`) |\n| IAM (`IAM`) | Shared (`SHARED`) |\n| IAM (`IAM`) | Expired Key Controls (`EXPIRED_KEY_CONTROLS`) |\n| IAM (`IAM`) | Authentication Policies (`AUTHENTICATION_POLICIES`) |" }, "FrameworksErrorsResponse": { "type": "object", "additionalProperties": false, "properties": { "frameworksErrors": { "type": "array", "items": { "$ref": "#/components/schemas/FrameworkErrorsResponseData" } } } }, "FrameworkErrorsResponseData": { "type": "object", "title": "FrameworkErrorsResponseData", "additionalProperties": false, "properties": { "framework": { "$ref": "#/components/schemas/FrameworkName" }, "errors": { "type": "array", "items": { "type": "string" } } } }, "ModifyRuleParams": { "type": "object", "title": "ModifyRuleParams", "additionalProperties": false, "properties": { "labels": { "type": "array", "description": "List of rule labels", "items": { "type": "string" } } }, "required": [ "labels" ] }, "ModifyRuleResponseObject": { "type": "object", "title": "ModifyRuleResponseObject", "description": "Updated details of the modified Application Security rule", "properties": { "rule": { "$ref": "#/components/schemas/DetectionRule" } } }, "GetLabelsResponse": { "type": "object", "title": "GetLabelsResponse", "description": "A list of labels", "additionalProperties": false, "properties": { "labels": { "type": "array", "items": { "type": "string" } } } }, "ValidateCodeResponse": { "anyOf": [ { "properties": { "frameworksErrors": { "type": "array", "items": { "$ref": "#/components/schemas/FrameworkErrorsResponseData" } } } }, { "properties": { "isValid": { "type": "boolean" } } } ], "type": "object" }, "IntegrationType": { "type": "string", "enum": [ "COLLECTOR" ], "title": "IntegrationType", "description": "Type of the data source instance, indicating the external system it connects to. " }, "Omit_Repository.assetId_": { "$ref": "#/components/schemas/Pick_Repository.Exclude_keyofRepository.assetId__" }, "Pick_Repository.Exclude_keyofRepository.assetId__": { "type": "object", "title": "RepositoryResponse", "properties": { "name": { "type": "string", "description": "The name of the repository in the version control system (VCS)" }, "description": { "type": "string", "description": "Description describing the repository" }, "creationDate": { "type": "string" }, "defaultBranch": { "type": "string" }, "diskSize": { "type": "number", "format": "double" }, "externalId": { "type": "string" }, "id": { "type": "string", "description": "Repository ID" }, "integrationId": { "type": "string" }, "isArchived": { "type": "boolean", "description": "Whether the repository is archived" }, "isBillable": { "type": "boolean", "description": "Whether the repository is billable" }, "isForked": { "type": "boolean", "description": "Whether the repository is forked" }, "isPublic": { "type": "boolean", "description": "Whether the repository is public" }, "isSelected": { "type": "boolean", "description": "Whether the repository is selected" }, "lastScanDate": { "type": "string" }, "observationTime": { "type": "number", "format": "double", "description": "The date the repository was last updated" }, "organizationId": { "type": "string" }, "owner": { "type": "string", "description": "Repository owner" }, "projectId": { "type": "string" }, "scanConfiguration": { "$ref": "#/components/schemas/ScanConfiguration" }, "scannedBranch": { "type": "string" }, "scannedBranches": { "type": "array", "items": { "$ref": "#/components/schemas/Branch" } }, "source": { "$ref": "#/components/schemas/IntegrationType" }, "status": { "$ref": "#/components/schemas/RepositoryStatus" }, "url": { "type": "string", "description": "URL of the repository" } } }, "ScanConfiguration": { "type": "object", "title": "ScanConfiguration", "description": "The configuration of an Application Security code scanner", "additionalProperties": false, "properties": { "excludedPaths": { "type": "array", "items": { "type": "string" } }, "prScanning": { "$ref": "#/components/schemas/PRScanning" }, "scanners": { "$ref": "#/components/schemas/ScannerTypes" }, "taggingBot": { "$ref": "#/components/schemas/TaggingBot" } } }, "PRScanning": { "type": "object", "description": "Pull Request (PR) scans are initiated by events triggered by version control systems such as GitHub, GitLab, Bitbucket and Azure Repos, or via webhooks. The scan results are based on default enforcement thresholds.", "additionalProperties": false, "properties": { "blockOnError": { "type": "boolean" }, "isEnabled": { "type": "boolean", "description": "Indicates whether the PR scan is enabled" } }, "required": [ "blockOnError", "isEnabled" ] }, "ScannerTypes": { "type": "object", "title": "ScannerTypes", "description": "Details on each type of scanner: Branch periodic scans, CI scans, IaC scans, Secrets scans", "additionalProperties": false, "properties": { "GIT_HISTORY": { "$ref": "#/components/schemas/ScannerConfig" }, "IAC": { "$ref": "#/components/schemas/ScannerConfig" }, "SCA": { "$ref": "#/components/schemas/ScannerConfig" }, "SECRETS": { "$ref": "#/components/schemas/ScannerConfig" } }, "required": [ "GIT_HISTORY", "IAC", "SCA", "SECRETS" ] }, "ScannerConfig": { "type": "object", "title": "ScannerConfig", "description": "Scanner configuration", "additionalProperties": false, "properties": { "isEnabled": { "type": "boolean", "description": "Indicates whether this scanner is enabled" }, "scanOptions": { "type": "object", "additionalProperties": { "type": "boolean" } } }, "required": [ "isEnabled" ] }, "TaggingBot": { "type": "object", "additionalProperties": false, "properties": { "tagModuleBlocks": { "type": "boolean" }, "tagResourceBlocks": { "type": "boolean" } }, "required": [ "tagModuleBlocks", "tagResourceBlocks" ] }, "Branch": { "type": "object", "additionalProperties": false, "properties": { "diskSize": { "type": "number", "format": "double" }, "firstScanDate": { "type": "string", "description": "Timestamp of the first scan performed" }, "id": { "type": "string", "description": "Branch ID" }, "isPrimary": { "type": "boolean", "description": "Indicates whether or not the branch is the primary branch" }, "lastApiCallDate": { "type": "string" }, "lastCloneDate": { "type": "string" }, "lastCloneSha": { "type": "string" }, "lastScanDate": { "type": "string", "description": "Timestamp of the last scan execution" }, "name": { "type": "string", "description": "Branch name" }, "repositoryId": { "type": "string", "description": "Repository ID" } } }, "RepositoryStatus": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "properties": { "apiRead": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "apiWrite": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "clone": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "connection": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "webhookSubscription": { "$ref": "#/components/schemas/RepositoryStatusDetails" }, "token": { "$ref": "#/components/schemas/RepositoryStatusDetails" } }, "required": [ "apiRead", "apiWrite", "clone", "connection", "webhookSubscription", "token" ] }, "RepositoryStatusDetails": { "type": "object", "additionalProperties": false, "properties": { "reason": { "type": "string" }, "status": { "$ref": "#/components/schemas/StatusValue" } }, "required": [ "status" ] }, "StatusValue": { "type": "string", "enum": [ "INVALID", "VALID" ] }, "UpdateScanConfigurationPublicInput": { "type": "object", "additionalProperties": false, "properties": { "excludedPaths": { "type": "array", "items": { "type": "string" } }, "prScanning": { "$ref": "#/components/schemas/PRScanning" }, "taggingBot": { "$ref": "#/components/schemas/TaggingBot" }, "scanners": { "type": "object", "properties": { "SECRETS": { "type": "object", "properties": { "isEnabled": { "type": "boolean" }, "scanOptions": { "$ref": "#/components/schemas/Partial_any_" } } }, "SCA": { "$ref": "#/components/schemas/Omit_ScannerConfig.scanOptions_" }, "IAC": { "$ref": "#/components/schemas/Omit_ScannerConfig.scanOptions_" } } } } }, "Omit_ScannerConfig.scanOptions_": { "$ref": "#/components/schemas/Pick_ScannerConfig.Exclude_keyofScannerConfig.scanOptions__" }, "Pick_ScannerConfig.Exclude_keyofScannerConfig.scanOptions__": { "type": "object", "description": "From T, pick a set of properties whose keys are in the union K", "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "status": { "$ref": "#/components/schemas/RepositoryStatus" }, "creationDate": { "type": "string" }, "defaultBranch": { "type": "string" }, "diskSize": { "type": "number", "format": "double" }, "externalId": { "type": "string" }, "id": { "type": "string" }, "integrationId": { "type": "string" }, "isArchived": { "type": "boolean" }, "isBillable": { "type": "boolean" }, "isForked": { "type": "boolean" }, "isPublic": { "type": "boolean" }, "isSelected": { "type": "boolean" }, "lastScanDate": { "type": "string" }, "observationTime": { "type": "number", "format": "double" }, "organizationId": { "type": "string" }, "owner": { "type": "string" }, "projectId": { "type": "string" }, "scanConfiguration": { "$ref": "#/components/schemas/ScanConfiguration" }, "scannedBranch": { "type": "string" }, "scannedBranches": { "type": "array", "items": { "$ref": "#/components/schemas/Branch" } }, "source": { "$ref": "#/components/schemas/IntegrationType" }, "url": { "type": "string" } }, "required": [ "name", "description", "status", "creationDate", "defaultBranch", "externalId", "id", "integrationId", "isArchived", "isBillable", "isForked", "isPublic", "isSelected", "organizationId", "owner", "scannedBranch", "source", "url" ] }, "Partial_any_": { "type": "object", "description": "Make all properties in T optional", "properties": { "gitHistory": { "type": "boolean" }, "secretValidation": { "type": "boolean" } } }, "UrlIntegrationType": { "enum": [ "github", "github-enterprise", "gitlab", "gitlab-self-managed", "azure-repos", "cortex-cli", "bitbucket", "bitbucket-datacenter", "aws-code-commit", "hcp-tfc-run-tasks", "hcp-tfe-run-tasks", "sonar-qube", "veracode", "semgrep", "circle-ci-cd", "jenkins-server", "aws-code-build", "circle-ci", "github-actions", "jenkins", "collector", "snyk", "jfrog" ], "type": "string" }, "UrlIntegrationTypeCategory": { "type": "string", "enum": [ "external-vendor-integrations", "vcs-integrations", "ci-cd-scanning-integrations", "cli-integrations" ] }, "Integration": { "type": "object", "title": "Integration", "description": "Integration details", "additionalProperties": false, "required": [ "creationDate", "id", "lastUpdateDate", "type" ], "properties": { "creationDate": { "type": "string", "description": "Date and time when the data source instance was created." }, "domain": { "$ref": "#/components/schemas/IntegrationDomain" }, "id": { "type": "string", "description": "Unique identifier (ID) of the data source instance." }, "instanceVersion": { "type": "string", "description": "Version of the data source instance configuration." }, "lastUpdateDate": { "type": "string", "description": "Date and time when the data source instance was last updated." }, "scanTypes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/scanType" } }, "selectionType": { "$ref": "#/components/schemas/SelectionType" }, "selfSignedCertificate": { "type": "string", "description": "PEM-encoded self-signed certificate used for secure communication with the data source." }, "state": { "type": "array", "description": "Integration state", "items": { "type": "string" } }, "status": { "$ref": "#/components/schemas/IntegrationStatus" }, "statusDetails": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/IntegrationStatusDetails" } }, "tenantId": { "type": "string", "description": "Tenant ID that owns this data source instance." }, "transporter": { "$ref": "#/components/schemas/Transporter" }, "type": { "$ref": "#/components/schemas/IntegrationType" }, "typeCategory": { "$ref": "#/components/schemas/TypeCategory" }, "uniqueIdentifier": { "type": "string", "description": "Unique identifier of the integration" } } }, "IntegrationDomain": { "type": "object", "title": "IntegrationDomain", "description": "Domain configuration specifying the hostname and protocol for the data source instance", "additionalProperties": false, "required": [ "hostname", "protocol" ], "properties": { "hostname": { "type": "string", "description": "Hostname or domain name of the external data source." }, "protocol": { "$ref": "#/components/schemas/IntegrationProtocol" } } }, "IntegrationProtocol": { "type": "string", "enum": [ "http", "https" ], "title": "IntegrationProtocol", "description": "Communication protocol used to connect to the data source." }, "scanType": { "type": "object", "additionalProperties": false, "description": "Configuration for a specific scan type within a data source instance.", "required": [ "isEnabled" ], "properties": { "isEnabled": { "type": "boolean", "description": "Indicates whether this scan type is enabled for the data source instance." } } }, "SelectionType": { "type": "string", "enum": [ "CURRENT_STATE", "CURRENT_STATE_AND_FUTURE", "CURRENT_STATE_PENDING", "MANUAL_SELECTION" ], "description": "Defines how repositories are selected for scanning within a data source instance." }, "IntegrationStatus": { "type": "string", "enum": [ "COMPLETED", "CONNECTED", "DESTROYING", "DISABLED", "ERROR", "PENDING", "TEMPORARY", "TRANSPORTER_CONNECTION_DISABLED", "WARNING" ], "title": "IntegrationStatus", "description": "Current connection status of the data source instance.\n- `COMPLETED` — The data source instance setup is complete and operational.\n- `CONNECTED` — The data source instance is actively connected.\n- `DESTROYING` — The data source instance is being removed.\n- `DISABLED` — The data source instance is disabled and not actively scanning.\n- `ERROR` — The data source instance encountered an error and requires attention.\n- `PENDING` — The data source instance is being set up and is not yet active.\n- `TEMPORARY` — The data source instance is in a temporary state during configuration.\n- `TRANSPORTER_CONNECTION_DISABLED` — The transporter connection for this data source instance is disabled.\n- `WARNING` — The data source instance is operational but has warnings that may require attention." }, "IntegrationStatusDetails": { "description": "Detailed status information for a specific component of the data source instance.", "properties": { "error": { "type": "string", "description": "Error code or identifier if the component is in an error state." }, "message": { "type": "string", "description": "Human-readable message providing additional context about the status." }, "status": { "$ref": "#/components/schemas/StatusValue" }, "timestamp": { "type": "string", "description": "ISO 8601 timestamp indicating when the status was last evaluated." } }, "required": [ "status" ], "type": "object", "additionalProperties": false }, "Transporter": { "description": "Transporter configuration for establishing secure communication between an on-premises or private data source and Cortex.", "properties": { "brokerDeviceId": { "type": "string", "description": "Unique identifier of the broker device used for the transporter connection." }, "connectionName": { "type": "string", "description": "Name of the transporter connection." } }, "required": [ "brokerDeviceId", "connectionName" ], "type": "object", "additionalProperties": false }, "TypeCategory": { "type": "string", "description": "Category classification of the data source instance type.\n- `DEFAULT` — Standard data source instances such as VCS, CI/CD, and CLI integrations.\n- `EXTERNAL_VENDOR_INTEGRATIONS` — Third-party external vendor integrations.", "enum": [ "DEFAULT", "EXTERNAL_VENDOR_INTEGRATIONS" ] }, "CreateIntegrationBody": { "type": "object", "description": "Define the integration configuration", "additionalProperties": false, "required": [ "type" ], "properties": { "type": { "$ref": "#/components/schemas/IntegrationType" }, "domain": { "$ref": "#/components/schemas/IntegrationDomain" }, "credentials": { "$ref": "#/components/schemas/Partial_IntegrationCredentials_" }, "uniqueProperties": { "$ref": "#/components/schemas/Record_string.unknown_" }, "transporter": { "$ref": "#/components/schemas/Transporter" }, "selfSignedCertificate": { "type": "string", "description": "PEM-encoded self-signed certificate for secure communication." } } }, "Partial_IntegrationCredentials_": { "type": "object", "description": "Authentication credentials required to connect to the external data source. All properties are optional to support different authentication methods.", "properties": { "type": { "$ref": "#/components/schemas/IntegrationCredentialsType" }, "token": { "type": "string", "description": "Authentication token, such as a personal access token (PAT), used to authenticate with the data source." }, "refreshToken": { "type": "string", "description": "Refresh token used to obtain a new authentication token when the current one expires." }, "clientId": { "type": "string", "description": "Client ID for OAuth-based authentication with the data source." }, "clientSecret": { "type": "string", "description": "Client secret for OAuth-based authentication with the data source." }, "username": { "type": "string", "description": "Username for basic authentication with the data source." }, "password": { "type": "string", "description": "Password for basic authentication with the data source." }, "webhookAuthKeyId": { "type": "string", "description": "Webhook authentication key ID used for webhook-based integrations." }, "webhookAuthKey": { "type": "string", "description": "Authentication key used to validate incoming webhook requests from the data source." } } }, "IntegrationCredentialsType": { "type": "string", "enum": [ "OAUTH", "PAT" ], "description": "Type of authentication method used for the data source connection." }, "Record_string.unknown_": { "type": "object", "description": "A flexible key-value map for specifying additional properties. Keys are strings and values can be of any type." }, "UpdateIntegrationPublicBody": { "type": "object", "title": "UpdateIntegrationPublicBody", "description": "Define the integration details", "additionalProperties": false, "properties": { "selectionType": { "$ref": "#/components/schemas/SelectionType" }, "state": { "type": "array", "description": "To update the integration for specific repositories, specify them here in the following format:\n\n`\"state\":\"[\"org1\"/\"repo_name1\", \"org2\"/\"repo_name2\"]`", "items": { "type": "string" } }, "externalProjects": { "type": "array", "items": { "$ref": "#/components/schemas/ExternalProjectInput" } }, "uniqueProperties": { "$ref": "#/components/schemas/Record_string.unknown_" } }, "x-examples": { "Example 1": { "selectionType": "CURRENT_STATE", "state": [ "string" ], "externalProjects": [ { "branchName": "string", "externalBranchName": "string", "externalId": "string", "externalProjectId": "string", "repoId": "string" } ], "uniqueProperties": { "property1": null, "property2": null } } } }, "ExternalProjectInput": { "type": "object", "additionalProperties": false, "properties": { "branchName": { "type": "string", "nullable": true, "description": "Name of the branch" }, "externalBranchName": { "type": "string", "nullable": true, "description": "Name of the external branch" }, "externalId": { "type": "string", "description": "External ID" }, "externalProjectId": { "type": "string", "nullable": true, "description": "External project ID" }, "repoId": { "type": "string", "nullable": true, "description": "Repository ID" } }, "required": [ "branchName", "externalBranchName", "externalId", "externalProjectId", "repoId" ] }, "SetPersistBranchesApi": { "type": "object", "additionalProperties": false, "properties": { "selectedBranches": { "type": "array", "items": { "type": "string" } }, "primaryBranch": { "type": "string" } }, "required": [ "selectedBranches", "primaryBranch" ] }, "Partial_BasePolicyRequest": { "type": "object", "required": [ "conditions", "scope" ], "properties": { "name": { "type": "string", "description": "A unique name for the AppSec policy." }, "description": { "type": "string", "description": "A brief description of the AppSec policy's purpose." }, "conditions": { "$ref": "#/components/schemas/PolicyCondition" }, "scope": { "$ref": "#/components/schemas/PolicyScope" }, "triggers": { "$ref": "#/components/schemas/AppsecPolicyTriggersandActions" }, "relatedDetectionRules": { "type": "array", "description": "List of related detection rules.", "items": { "type": "string" } }, "enabled": { "type": "boolean", "description": "Whether the policy is enabled." }, "suggestionId": { "type": "string", "description": "Unique identifier for the suggested policy." }, "assetGroupIds": { "type": "array", "description": "List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.", "items": { "type": "number", "format": "double" } }, "userSbac": { "type": "array", "description": "Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is modified. Controls which asset groups the policy applies to based on the modifier's access. When empty, the policy applies to all asset groups.", "items": { "type": "number", "format": "double" } } } }, "BasicScanInfo": { "type": "object", "properties": { "organizationId": { "type": "string", "description": "Organization ID" }, "repoName": { "type": "string", "description": "Name of the repository" }, "repoId": { "type": "string", "description": "ID of the repository" } } }, "AppsecPolicyTriggersandActions": { "title": "AppsecPolicyTriggersandActions", "type": "object", "description": "Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have `isEnabled` set to `true`.", "required": [ "cicd", "ciImage", "imageRegistry", "periodic", "pr" ], "properties": { "cicd": { "type": "object", "description": "Configuration for the CI Code trigger. If `true`, the policy is evaluated on CI/CD pipeline events.", "minProperties": 1, "maxProperties": 3, "required": [ "actions", "isEnabled" ], "properties": { "actions": { "type": "object", "description": "Actions to take when the policy detects its target risk and the policy is triggered.", "required": [ "blockCicd", "reportCicd", "reportIssue" ], "properties": { "blockCicd": { "type": "boolean", "description": "Indicates if triggering the policy should block the CI/CD pipeline." }, "reportCicd": { "type": "boolean", "description": "Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform." }, "reportIssue": { "type": "boolean", "description": "Indicates if triggering the policy should create an issue." } } }, "isEnabled": { "type": "boolean", "description": "Indicates whether the CI Code Scan trigger is enabled.", "default": true }, "overrideIssueSeverity": { "description": "**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.", "enum": [ "Critical", "High", "Medium", "Low" ], "nullable": true } } }, "ciImage": { "type": "object", "description": "Configuration for the CI image trigger. If `true`, the policy is evaluated during CI image scans.", "required": [ "actions", "isEnabled", "overrideIssueSeverity" ], "properties": { "actions": { "type": "object", "description": "Actions to take when the policy detects its target risk and the policy is triggered.", "required": [ "blockCicd", "reportCicd", "reportIssue" ], "properties": { "blockCicd": { "type": "boolean", "description": "Indicates if triggering the policy should block the CI image." }, "reportCicd": { "type": "boolean", "description": "Indicates if triggering the policy should soft fail the CI image in the platform." }, "reportIssue": { "type": "boolean", "description": "Indicates if triggering the policy should create an issue." } } }, "isEnabled": { "type": "boolean", "description": "Indicates whether the CI Image Scan trigger is enabled.", "default": true }, "overrideIssueSeverity": { "enum": [ "Critical", "High", "Medium", "Low" ], "description": "Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.", "nullable": true } } }, "imageRegistry": { "type": "object", "description": "Configuration for the image registry trigger. If `true`, the policy is evaluated during registry image scans.", "required": [ "actions", "isEnabled", "overrideIssueSeverity" ], "properties": { "actions": { "type": "object", "description": "Actions to take when the policy detects its target risk and the policy is triggered.", "required": [ "reportIssue" ], "properties": { "reportIssue": { "type": "boolean", "description": "Indicates if triggering the policy should create an issue." } } }, "isEnabled": { "type": "boolean", "description": "Indicates whether the Registry Image Scan trigger is enabled." }, "overrideIssueSeverity": { "enum": [ "Critical", "High", "Medium", "Low" ], "description": "Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.", "nullable": true } } }, "periodic": { "type": "object", "minProperties": 1, "maxProperties": 3, "description": "Configuration for the periodic code scan (scheduled) trigger. If `true`, the policy is evaluated.", "required": [ "actions", "isEnabled" ], "properties": { "actions": { "type": "object", "minProperties": 1, "maxProperties": 2, "description": "Actions to take when the policy detects its target risk and the policy is triggered.", "required": [ "reportIssue" ], "properties": { "reportIssue": { "type": "boolean", "description": "Indicates if triggering the policy should create an issue." } } }, "isEnabled": { "type": "boolean", "default": true, "description": "Indicates whether the Periodic Scan trigger is enabled." }, "overrideIssueSeverity": { "description": "**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.", "enum": [ "Critical", "High", "Medium", "Low" ], "nullable": true } } }, "pr": { "type": "object", "description": "Configuration for the pull request (PR) trigger. If `true`, the policy is evaluated on Pull Request (PR) events", "minProperties": 1, "maxProperties": 3, "required": [ "actions", "isEnabled" ], "properties": { "actions": { "type": "object", "description": "Actions to take when the policy detects its target risk and the policy is triggered. ", "required": [ "blockPr", "reportIssue", "reportPrComment" ], "properties": { "blockPr": { "type": "boolean", "description": "Indicates if triggering the policy should block the pull request." }, "reportIssue": { "type": "boolean", "description": "Indicates if triggering the policy should create an issue." }, "reportPrComment": { "type": "boolean", "description": "Indicates if triggering the policy should create comments on the pull request." } } }, "isEnabled": { "type": "boolean", "description": "Indicates whether the PR Scan trigger is enabled.", "default": true }, "overrideIssueSeverity": { "enum": [ "Critical", "High", "Medium", "Low" ], "description": "**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.", "nullable": true } } } } }, "VcsUserPermissionLevel": { "description": "The permission level of the user within the repository.", "enum": [ "ADMIN", "MAINTAIN", "WRITE", "READ", "TRIAGE", "OWNER", "MAINTAINER", "DEVELOPER", "GUEST", "REPORTER", "PLANNER", "NONE" ], "type": "string", "example": "WRITE" }, "EmailOrigin": { "description": "The source from which the user's email address was obtained.", "enum": [ "API", "GIT" ], "type": "string", "example": "GIT" }, "RepositoryUser": { "description": "Represents a user associated with a repository.", "type": "object", "additionalProperties": false, "required": [ "name", "email", "repositoryId", "creationDate" ], "properties": { "lastCommitDate": { "type": "string", "description": "The date and time of the user's most recent commit. Used to determine contributor activity.\n**Note:** Only users who committed within the last 90 days are considered active contributors for billing.", "example": "2025-02-15T10:30:00.000Z" }, "name": { "type": "string", "description": "The display name of the repository user.", "example": "Jane Doe" }, "userName": { "type": "string", "description": "The username of the repository user on the VCS platform.", "example": "janedoe" }, "email": { "type": "string", "description": "The email address associated with the user. This value is used to uniquely identify contributors across repositories. Emails associated with bots or automated accounts (for example, action@github.com or *@users.noreply.github.com) are excluded.", "example": "janedoe@example.com" }, "repositoryId": { "type": "string", "description": "The unique identifier of the repository associated with the user. The repository must be billable (not archived and with at least one security scanner enabled).", "example": "a1b2c3d4e5f6a7b8c9d0e1f2" }, "creationDate": { "type": "string", "description": "The date and time when the user record was created in the system.", "example": "2025-06-01T08:00:00.000Z" }, "role": { "$ref": "#/components/schemas/VcsUserPermissionLevel" }, "hasMfa": { "type": "boolean", "description": "Indicates whether the user has multi-factor authentication (MFA) enabled on their VCS account.", "example": true }, "teams": { "type": "array", "description": "The names of the teams in the VCS organization that the user belongs to.", "example": [ "backend-team", "security-team" ], "items": { "type": "string" } }, "isGuest": { "type": "boolean", "description": "Indicates whether the user is a guest (external collaborator) in the repository.", "example": false }, "isContributor": { "type": "boolean", "description": "Indicates whether the user is an active contributor.", "example": true }, "isAdmin": { "type": "boolean", "description": "Indicates whether the user has admin permissions for the repository.", "example": false }, "emailOrigin": { "$ref": "#/components/schemas/EmailOrigin" }, "uniqueVcsId": { "type": "string", "description": "A unique identifier assigned to the user by the VCS platform. Used to correlate the user across repositories and systems.", "example": "vcs-user-67890" } } }, "BillingErrorResponse": { "type": "object", "x-examples": { "Example 1": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } }, "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "description": "The HTTP status code of the error." }, "err_msg": { "type": "string", "description": "A short description of the error type." }, "err_extra": { "type": "string", "description": "A detailed message explaining the cause of the error.", "nullable": true } } } } }, "ConditionValue": { "properties": { "from": { "type": "number", "format": "double", "description": "The lower bound of a range query." }, "to": { "type": "number", "format": "double", "description": "The upper bound of a range query." }, "key": { "type": "string", "description": "The key for key-value pair matching." }, "value": { "type": "string", "description": "The value for key-value pair matching." } }, "type": "object", "additionalProperties": false, "description": "A structured condition value used for range queries or key-value pair matching." }, "Trigger": { "enum": [ "periodic", "cicd", "pr", "ciImage", "imageRegistry" ], "type": "string", "description": "The type of trigger that evaluates the policy." }, "UnifiedAction": { "description": "The type of action that can be taken when a policy is triggered.\n- `blockCicd`: Block the CI/CD pipeline\n- `blockCiImage`: Block the CI image build\n- `blockPr`: Block the pull request\n- `reportCicd`: Soft fail the CI/CD pipeline\n- `reportIssue`: Create an issue in the connected system\n- `reportPrComment`: Create comments on the pull request", "enum": [ "blockCiImage", "blockCicd", "blockPr", "reportCicd", "reportIssue", "reportPrComment" ], "type": "string" }, "PackageType": { "type": "string", "enum": [ "OSS", "OS" ], "description": "Type of the package. OSS indicates an open-source software package; OS indicates an operating system package." }, "UsedInCounts": { "type": "object", "additionalProperties": false, "properties": { "code": { "type": "number", "format": "double", "description": "Number of code repositories that include this package.", "example": 9, "nullable": true }, "runtime": { "type": "number", "format": "double", "description": "Number of runtime environments where this package is detected.", "example": 2, "nullable": true }, "deploy": { "type": "number", "format": "double", "description": "Number of deployed artifacts or images that include this package.", "example": 1, "nullable": true } } }, "VulnerabilityCounts": { "type": "object", "additionalProperties": false, "properties": { "critical": { "type": "number", "format": "double", "description": "Number of critical-severity vulnerabilities associated with this package version.", "example": 3, "nullable": true }, "high": { "type": "number", "format": "double", "description": "Number of high-severity vulnerabilities associated with this package version.", "example": 0, "nullable": true }, "medium": { "type": "number", "format": "double", "description": "Number of medium-severity vulnerabilities associated with this package version.", "example": 0, "nullable": true }, "low": { "type": "number", "format": "double", "description": "Number of low-severity vulnerabilities associated with this package version.", "example": 0, "nullable": true }, "info": { "type": "number", "format": "double", "description": "Number of informational vulnerabilities associated with this package version.", "example": 0, "nullable": true } } }, "PackageExplorerResponse": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Name of the package as it appears in the package manager registry.", "example": "com.vaadin.external.google:android-json" }, "version": { "type": "string", "description": "The version of the package.", "example": "0.0.20131108.vaadin1" }, "package_type": { "allOf": [ { "$ref": "#/components/schemas/PackageType" } ], "nullable": true }, "ecosystem": { "type": "string", "description": "The package manager ecosystem where this package is used (for example, NPM, YARN, MAVEN, or GRADLE). Each result represents an ecosystem where the package version was detected.", "example": "MAVEN", "nullable": true }, "operational_risk": { "type": "string", "description": "The assessed operational risk level of the package version (for example, LOW, MEDIUM, or HIGH). Returns `null` if no assessment is available.", "example": "HIGH", "nullable": true }, "used_in": { "allOf": [ { "$ref": "#/components/schemas/UsedInCounts" } ], "nullable": true, "description": "Usage counts showing where this package version is used, including code repositories, runtime environments, and deployed artifacts within the ecosystem." }, "vulnerabilities": { "allOf": [ { "$ref": "#/components/schemas/VulnerabilityCounts" } ], "nullable": true, "description": "Number of known vulnerabilities for this package version by severity level.\n" } } }, "CoveragePublicApiResponse": { "description": "Returns the coverage ratio for the requested `direction` and `type`.", "type": "object", "additionalProperties": false, "properties": { "coverage": { "type": "number", "format": "double", "description": "The coverage ratio, as a decimal between `0` and `1`. Multiply by 100 to get the percentage shown on the Code to Cloud dashboard. Returns `0` if there isn't enough data to calculate coverage.", "example": 0.5 } } }, "CodeToCloudDirection": { "type": "string", "description": "The direction to trace lineage", "enum": [ "code_to_cloud", "cloud_to_code" ] }, "CodeToCloudDashboardType": { "type": "string", "description": "The asset type to calculate coverage", "enum": [ "artifact", "infrastructure" ] }, "OperationType": { "type": "string", "description": "The type of override operation to apply to the specified assets.\n- `ADD` - Adds the assets to the application.\n- `REMOVE` - Removes the assets from the application.", "enum": [ "ADD", "REMOVE" ] }, "OverrideAssetsRequest": { "type": "object", "description": "The assets to add or remove and the operation to apply.", "properties": { "assetIds": { "type": "array", "description": "The unique identifiers of the assets to add or remove. To find assets that you can add, use List addable assets. To find assets that you can remove, use List removable assets.", "items": { "type": "string" } }, "operation": { "description": "The override operation to apply to the specified assets.", "$ref": "#/components/schemas/OperationType" }, "filter": { "type": "string", "description": "An optional filter expression that is stored with the override action, such as `assetProvider=AWS`. The `assetIds` field is always required, even when you provide a filter. The filter is recorded with the action and is returned in the `filter` field of List override actions." } }, "required": [ "assetIds", "operation" ], "additionalProperties": false }, "OverrideAssetsResponse": { "type": "object", "description": "The result of an add or remove override operation.", "additionalProperties": false, "properties": { "success": { "type": "boolean", "description": "Indicates whether the override operation completed successfully." }, "actionId": { "type": "string", "description": "The unique identifier of the override action. Use this value to revert the action with Revert overrides by action ID." }, "processed": { "type": "array", "description": "The unique identifiers of the assets that the operation processed successfully.", "items": { "type": "string" } }, "failed": { "type": "array", "description": "The assets that the operation failed to process, together with the reason for each failure.", "items": { "type": "object", "properties": { "reason": { "type": "string", "description": "The reason that the asset failed to process." }, "assetId": { "type": "string", "description": "The unique identifier of the asset that failed to process." } } } } } }, "ApplicationAssetOverrideResponse": { "type": "object", "description": "A single override action that was applied to the application.", "additionalProperties": false, "properties": { "actionId": { "type": "string", "description": "The unique identifier of the override action. Use this value to revert the action with Revert overrides by action ID." }, "assetIds": { "type": "array", "description": "The unique identifiers of the assets that the override action affected.", "items": { "type": "string" } }, "operationType": { "$ref": "#/components/schemas/OperationType" }, "userEmail": { "type": "string", "description": "The email address of the user who performed the override action. When an API token performs the action, this value identifies the token." }, "filter": { "type": "string", "description": "The filter expression that was used to select the assets, or `null` if the action did not use a filter.", "nullable": true }, "createdAt": { "type": "string", "description": "The date and time when the override action was created, in ISO 8601 format." } } }, "BasicPaginatedResponse_ApplicationAssetOverrideResponse-Array_": { "type": "object", "description": "A paginated list of override actions that were applied to the application.", "additionalProperties": false, "properties": { "data": { "type": "array", "description": "The override actions on the current page.", "items": { "$ref": "#/components/schemas/ApplicationAssetOverrideResponse" } }, "hasNext": { "type": "boolean", "description": "Indicates whether more pages of results are available. When the value is `true`, request the next page to retrieve additional results." } } }, "RevertOverridesResponse": { "type": "object", "description": "The result of a revert operation.", "additionalProperties": false, "properties": { "success": { "type": "boolean", "description": "Indicates whether the revert operation completed successfully." }, "reverted": { "type": "array", "description": "The unique identifiers of the assets whose override was reverted.", "items": { "type": "string" } } } }, "ManageableAsset": { "type": "object", "description": "An asset that you can add to or remove from the application.", "additionalProperties": false, "properties": { "assetId": { "type": "string", "description": "The unique identifier of the asset. Use this value in the `assetIds` field when you add or remove assets." }, "assetName": { "type": "string", "description": "The display name of the asset, or `null` when the asset does not have a name." }, "assetTypeCategory": { "type": "string", "description": "The category of the asset type, such as `Certificate` or `Repository`." }, "assetTypeId": { "type": "string", "description": "The identifier of the asset type, such as `TLS_CERTIFICATE` or `GITHUB_REPOSITORY`." }, "assetTypeClass": { "type": "string", "description": "The class of the asset type, such as `Identity`, `Code`, or `Compute`." }, "assetProvider": { "type": "string", "description": "The provider that the asset belongs to, such as `AWS`, `GITHUB`, or `OTHER`." }, "assetCloudRegion": { "type": "string", "description": "The cloud region where the asset is located, such as `us-east-1`. The value is empty or `null` when a region does not apply to the asset." } } }, "GetManageableAssetsResponse": { "type": "object", "description": "A paginated list of assets that you can add to or remove from the application.", "additionalProperties": false, "properties": { "items": { "type": "array", "description": "The assets on the current page.", "items": { "$ref": "#/components/schemas/ManageableAsset" } }, "currentPage": { "type": "number", "format": "double", "description": "The number of the current page. Pages are numbered starting at 1." }, "totalPages": { "type": "number", "format": "double", "description": "The total number of pages that are available for the current page size." }, "pageSize": { "type": "number", "format": "double", "description": "The number of assets that are returned on each page." }, "totalItems": { "type": "number", "format": "double", "description": "The total number of assets that match the request." } } }, "AddableAssetFilter": { "type": "string", "description": "A predefined shortcut that filters the assets that are available to add.\n- `RecentlyDiscovered` - Returns assets that were discovered recently.\n- `OrphanAssets` - Returns assets that are not associated with any application.\n- `SameContributors` - Returns assets that share contributors with the application.", "enum": [ "RecentlyDiscovered", "OrphanAssets", "SameContributors" ] } }, "responses": { "BadRequest": { "description": "Bad Request - The request was malformed or contains invalid parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingErrorResponse" } } } }, "Unauthorized": { "description": "Unauthorized - The request is unauthenticated. Pass the correct auth credentials.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } } } } } }, "Forbidden": { "description": "Forbidden - Access to the resource is prohibited. Try with different auth credentials.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 403, "err_msg": "Forbidden. Access was denied to this resource.", "err_extra": "Insufficient permissions for api key" } } } } } } }, "NotFound": { "description": "Not Found - The requested resource could not be found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingErrorResponse" } } } } } }, "security": [ { "XDRAuth": [], "XDRAuthToken": [] } ] }