Manage integrations via data source APIs

The Cortex Cloud Application Security Data Source APIs provide programmatic lifecycle management for existing integrations such as version control platforms, CI/CD pipelines, and third-party security tools.

These APIs automate day-to-day governance by allowing you to programmatically create new data sources, list, inspect, update, and delete integrations to audit coverage, modify repository scopes, monitor health, and decommission retired tools.

Scope: These APIs manage the full integration lifecycle, including initial creation and configuration. They do not execute security scans or enforce prevention policies, which are handled natively by the platform once a source is connected.

Prerequisites

Before calling the data sources APIs, verify the following requirements:

• API key pair: Generate an API key (Key ID + Key Secret) from Settings → Configurations → API Keys in the Cortex Cloud tenant. The API key must have sufficient permissions to manage integrations
• Authentication headers: All requests require the x-xdr-auth-id header (Key ID) and the Authorization header (Key Secret). Refer to the Cortex Cloud Platform APIs documentation for the exact authentication format
• Base URL: The base URL depends on the tenant region. The data sources API path is /public_api/appsec/v1/data_source_instances
• RBAC permissions: The API key must be associated with a role that grants read access to list and inspect integrations, and write access to create, update, or delete integrations in the ASPM module
• License: A Cortex Cloud Runtime Security or Cortex Cloud Posture Management base license with the Application Security add-on is required

Data source categories

AppSec data source integrations span multiple categories aligned to the SDLC lifecycle. Each category serves a distinct role in the Code-to-Cloud trace. Understanding the categories is essential for filtering integrations through the API and for building coverage audit scripts.

Category	Integration types	SDLC stage
Version Control Systems	GITHUB, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, BITBUCKET, BITBUCKET_DATACENTER, AZURE_REPOS, AWS_CODE_COMMIT	Code
CI Tools	GITHUB_ACTIONS, JENKINS, JENKINS_SERVER	Build
CI/CD Systems	CIRCLE_CI, CIRCLE_CI_CD, AWS_CODE_BUILD, HCP_TFC_RUN_TASKS, HCP_TFE_RUN_TASKS	Build/Deploy
Third-Party Vendors	SEMGREP, SONARQUBE, VERACODE, SNYK, CHECKMARX, JFROG	Cross-stage
Generic Collectors	COLLECTOR	Cross-stage

Type category filtering

When listing data sources through the API, use the type_category query parameter to scope the response:

• DEFAULT: Native integrations: VCS, CI tools, CI/CD systems, the Cortex CLI (CORTEX_CLI), and the generic collector
• EXTERNAL_VENDOR_INTEGRATIONS: Third-party vendor integrations: Checkmarx, Semgrep, SonarQube, Veracode, Snyk, JFrog

Supported API operations

The data sources public API exposes four endpoints under the base path /public_api/appsec/v1/integrations.

Operation	Method	Endpoint	Description
List data sources	GET	/public_api/appsec/v1/data_source_instances	List all AppSec data source integrations. Filter by type (specific integration type) or type_category (DEFAULT or EXTERNAL_VENDOR_INTEGRATIONS)
Get data source by ID	GET	/public_api/appsec/v1/data_source_instances/{id}	Retrieve the full details of a specific data source integration by its unique identifier
Create data source	POST	/public_api/appsec/v1/data_source_instances	Create and configure a new AppSec data source integration (VCS, CI/CD, or third-party scanner)
Update data source	PUT	/public_api/appsec/v1/data_source_instances/{id}	Update the repository selection, selection type, or external project mappings for an existing data source integration
Delete data source	DELETE	/public_api/appsec/v1/{id}	Delete a data source integration. Removes the integration and all associated repository mappings
Upload SAST findings	POST	/public_api/appsec/v1/collectors/{collectorId}	Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. Accepts scan results in SARIF v2.1.0 format

For the complete API reference, including request and response schemas, query parameter documentation, and error codes, refer to .Cortex API Documentation.