> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md).
# Manage Criteria via the public API
## Manage criteria via the public API
The [Criteria Public API](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/sites/site_gHT7E/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/application-security-overview) enables programmatic creation, retrieval, listing, and deletion of application grouping rules for infrastructure-as-code and onboarding automation.
**API prerequisites**
| Requirement | Description |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| API key | A valid Cortex Cloud API key generated from the console |
| API key role | The key must have the AppSec Admin role or a custom role with access to ASPM application resources (Criteria and Applications) |
| Base URL | The API base URL corresponding to the tenant region |
| Authentication | The `x-redlock-auth` header with a valid JWT token, or the `Authorization` header with the API key |
## API workflow overview
A standard workflow for managing criteria through the public API follows the sequence below:
1. **Authenticate**: Generate a `JWT` token using the API key credentials.
2. **Create**: Send a `POST` request with the criteria definition (name, type, configuration).
3. **List** or **Get**: Retrieve criteria using `GET` to verify creation or inspect the current state.
4. **Delete**: Use `DELETE` to remove deprecated criteria to maintain inventory hygiene.
## Supported API operations
The API uses the base path `/public_api/appsec/v1/application/criteria` and supports these operations:
| Operation | Method | Endpoint | Description |
| ------------------- | ------ | --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `List all criteria` | GET | `/all` | Retrieve all criteria with pagination support |
| | GET | `/{criteriaId}` | Retrieve a specific criteria by the unique identifier |
| `Create criteria` | POST | `/` | Create a new criteria to automate application grouping and discovery. You can create two types of criteria:
Code Criteria: Group your repositories and their connected runtime or deployment assets to automatically generate business applications based directly on your VCS structure
Examples: Create a Code Criteria with organization grouping within a provider, project grouping within a provider, or repository grouping across providers
Cloud Criteria: Cloud Criteria group assets by one or more tag keys within a single cloud account. Each unique tag key-value combination automatically produces one application
Examples: Create a Cloud Criteria using tag-based grouping to organize assets within a specific cloud provider account (such as AWS, GCP, or Azure)
|
| `Delete criteria` | DELETE | `/{criteriaId}` | Delete a criteria by the unique identifier |
## Reference
Explore the API for detailed configurations and schemas to manage criteria at scale or as part of automation pipelines.
* **API documentation**: For the complete technical reference, including full request schemas, field validation rules, and authentication, refer to the [Cortex Cloud Application Security Criteria API documentation](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/aspm-ci-cd-and-application-security/criteria).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.