> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manage-applications-via-public-apis.md).

# Manage applications via public APIs

The Cortex Cloud public API for applications enables programmatic management of the application inventory, creating, retrieving, updating, and deleting applications that group assets by business context. The application API automates workflows, enabling security teams to integrate application lifecycle management into CI/CD pipelines, infrastructure-as-code provisioning, and organizational onboarding automation.

{% hint style="info" %}

### Note

The application public API does not execute scans, enforce policies, or create issues. Scanning, policy enforcement, and issue creation are performed by their respective subsystems (Unified Application Security policies, scanner orchestration).
{% endhint %}

## Core achievements

* **Automated application provisioning**: Creating applications programmatically eliminates manual console interaction and enables consistent, repeatable application definitions across environments
* **Business context synchronization**: Updating application metadata (owners, compliance, criticality) through the API ensures the Cortex Cloud inventory reflects current organizational structures without manual drift
* **Posture visibility at scale**: Retrieving application-level issue summaries and insights through the API enables integration with external dashboards, reporting tools, and executive briefing systems
* **Inventory lifecycle management**: Deleting deprecated applications through the API maintains inventory hygiene and prevents stale business context from distorting posture metrics

## Manage Criteria via the public API

The Cortex Cloud Application Security public API for Criteria enables programmatic management of criteria; listing, retrieving, creating, and deleting criteria that define application grouping rules.

For more information refer to [Manage Criteria via the public API](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md).

## Application lifecycle management APIs

The following operations support the core creation, modification, and deletion of application entities in Cortex Cloud:

| Operation                 | Method   | Endpoint                                                                                | Description                                                                                                   |
| ------------------------- | -------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Create application**    | `POST`   | `/public_api/appsec/v1/application`                                                     | Create a new application with a name, business criticality, asset selection criteria, and ownership metadata. |
| **List applications**     | `GET`    | `/public_api/appsec/v1/application`                                                     | Retrieve all applications with pagination support.                                                            |
| **Get application by ID** | `GET`    | `/public_api/appsec/v1/application/{applicationId}`                                     | Retrieve a specific application by the unique application identifier.                                         |
| **Update application**    | `PUT`    | `/public_api/appsec/v1/application/{applicationId}`                                     | Update the metadata of an existing application (business criticality, description, owners, compliance).       |
| **Delete application**    | `DELETE` | `/public_api/appsec/v1/application/{id}`                                                | Delete an application by the unique application identifier.                                                   |
| **Get configuration**     | `GET`    | `/public_api/appsec/v1/application/configuration`                                       | Retrieve the application settings configuration for the tenant.                                               |
| **Get issue summary**     | `GET`    | `/public_api/appsec/v1/application/{applicationId}/issues/{issueType}/summary`          | Retrieve the issue count summary by issue type for a specific application.                                    |
| **Get insights**          | `GET`    | `/public_api/appsec/v1/application/{applicationId}/insights/{issueCategory}/{itemType}` | Retrieve insights data by issue category and item type for a specific application.                            |

### Operational considerations

When designing your automated workflows, keep the following API behaviors in mind:

* **Updating asset boundaries:** The API update operation (`PUT`) strictly modifies metadata. It does not support modifying the application's name or its asset selection criteria. To alter these fields, you must delete the existing application and create a new one
* **Data retention on deletion:** Deleting an application via the API (`DELETE`) only removes the business context grouping. The underlying assets (repositories, packages, IaC resources) and their detected security issues remain in your inventory, but are no longer associated with the deleted application

## Application asset management APIs

You can manage application assets through public API endpoints; discover assets available to add or remove, apply add or remove overrides, review override actions and their audit details, and revert override actions when needed.

| **Operation**         | **Method** | **Endpoint**                   | **Description**                                                               |
| --------------------- | ---------- | ------------------------------ | ----------------------------------------------------------------------------- |
| List addable assets   | GET        | `/assets/addable`              | Lists assets available to add, with filter shortcuts.                         |
| List removable assets | GET        | `/assets/removable`            | Lists assets available to remove.                                             |
| Apply asset override  | POST       | `/assets/override`             | Adds or removes assets using ADD or REMOVE actions and returns an `actionId`. |
| List override actions | GET        | `/assets/overrides`            | Lists override actions, including audit and origin details.                   |
| Revert override       | DELETE     | `/assets/overrides/{actionId}` | Reverts a previously applied override action.                                 |

## **Technical API Reference**

For comprehensive technical details, including request body schemas, status codes, and JSON response examples, refer to the [Application Security API overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/application-security-overview).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manage-applications-via-public-apis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.