Manage Criteria via the public API

Manage criteria via the public API

The Criteria Public API enables programmatic creation, retrieval, listing, and deletion of application grouping rules for infrastructure-as-code and onboarding automation.

API prerequisites

Requirement	Description
API key	A valid Cortex Cloud API key generated from the console
API key role	The key must have the AppSec Admin role or a custom role with access to ASPM application resources (Criteria and Applications)
Base URL	The API base URL corresponding to the tenant region
Authentication	The x-redlock-auth header with a valid JWT token, or the Authorization header with the API key

API workflow overview

A standard workflow for managing criteria through the public API follows the sequence below:

1. Authenticate: Generate a JWT token using the API key credentials.
2. Create: Send a POST request with the criteria definition (name, type, configuration).
3. List or Get: Retrieve criteria using GET to verify creation or inspect the current state.
4. Delete: Use DELETE to remove deprecated criteria to maintain inventory hygiene.

Supported API operations

The API uses the base path /public_api/appsec/v1/application/criteria and supports these operations:

Operation	Method	Endpoint	Description
List all criteria	GET	/all	Retrieve all criteria with pagination support
	GET	/{criteriaId}	Retrieve a specific criteria by the unique identifier
Create criteria	POST	/	Create a new criteria to automate application grouping and discovery. You can create two types of criteria: Code Criteria: Group your repositories and their connected runtime or deployment assets to automatically generate business applications based directly on your VCS structure Examples: Create a Code Criteria with organization grouping within a provider, project grouping within a provider, or repository grouping across providers Cloud Criteria: Cloud Criteria group assets by one or more tag keys within a single cloud account. Each unique tag key-value combination automatically produces one application Examples: Create a Cloud Criteria using tag-based grouping to organize assets within a specific cloud provider account (such as AWS, GCP, or Azure)
Delete criteria	DELETE	/{criteriaId}	Delete a criteria by the unique identifier

Reference

Explore the API for detailed configurations and schemas to manage criteria at scale or as part of automation pipelines.

• API documentation: For the complete technical reference, including full request schemas, field validation rules, and authentication, refer to the Cortex Cloud Application Security Criteria API documentation.