> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/manage-integrations-via-data-source-apis.md).

# Manage integrations via data source APIs

The Cortex Cloud Application Security Data Source APIs provide programmatic lifecycle management for existing integrations such as version control platforms, CI/CD pipelines, and third-party security tools.

These APIs automate day-to-day governance by allowing you to programmatically create new data sources, list, inspect, update, and delete integrations to audit coverage, modify repository scopes, monitor health, and decommission retired tools.

**Scope:** These APIs manage the full integration lifecycle, including initial creation and configuration. They do not execute security scans or enforce prevention policies, which are handled natively by the platform once a source is connected.

## Prerequisites

Before calling the data sources APIs, verify the following requirements:

* **API key pair:** Generate an API key (Key ID + Key Secret) from **Settings** → **Configurations** → **API Keys** in the Cortex Cloud tenant. The API key must have sufficient permissions to manage integrations
* **Authentication headers:** All requests require the `x-xdr-auth-id` header (Key ID) and the `Authorization` header (Key Secret). Refer to the Cortex Cloud Platform APIs documentation for the exact authentication format
* **Base URL:** The base URL depends on the tenant region. The data sources API path is `/public_api/appsec/v1/data_source_instances`
* **RBAC permissions:** The API key must be associated with a role that grants read access to list and inspect integrations, and write access to create, update, or delete integrations in the ASPM module
* **License:** A Cortex Cloud Runtime Security or Cortex Cloud Posture Management base license with the Application Security add-on is required

## Data source categories

AppSec data source integrations span multiple categories aligned to the SDLC lifecycle. Each category serves a distinct role in the Code-to-Cloud trace. Understanding the categories is essential for filtering integrations through the API and for building coverage audit scripts.

| Category                    | Integration types                                                                                                                     | SDLC stage   |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| **Version Control Systems** | `GITHUB`, `GITHUB_ENTERPRISE`, `GITLAB`, `GITLAB_SELF_MANAGED`, `BITBUCKET`, `BITBUCKET_DATACENTER`, `AZURE_REPOS`, `AWS_CODE_COMMIT` | Code         |
| **CI Tools**                | `GITHUB_ACTIONS`, `JENKINS`, `JENKINS_SERVER`                                                                                         | Build        |
| **CI/CD Systems**           | `CIRCLE_CI`, `CIRCLE_CI_CD`, `AWS_CODE_BUILD`, `HCP_TFC_RUN_TASKS`, `HCP_TFE_RUN_TASKS`                                               | Build/Deploy |
| **Third-Party Vendors**     | `SEMGREP`, `SONARQUBE`, `VERACODE`, `SNYK`, `CHECKMARX`, `JFROG`                                                                      | Cross-stage  |
| **Generic Collectors**      | `COLLECTOR`                                                                                                                           | Cross-stage  |

### Type category filtering

When listing data sources through the API, use the `type_category` query parameter to scope the response:

* **`DEFAULT`**: Native integrations: VCS, CI tools, CI/CD systems, the Cortex CLI (`CORTEX_CLI`), and the generic collector
* **`EXTERNAL_VENDOR_INTEGRATIONS`**: Third-party vendor integrations: Checkmarx, Semgrep, SonarQube, Veracode, Snyk, JFrog

## Supported API operations

The data sources public API exposes four endpoints under the base path `/public_api/appsec/v1/integrations`.

| Operation             | Method   | Endpoint                                           | Description                                                                                                                                                    |
| --------------------- | -------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| List data sources     | `GET`    | `/public_api/appsec/v1/data_source_instances`      | List all AppSec data source integrations. Filter by `type` (specific integration type) or `type_category` (`DEFAULT` or `EXTERNAL_VENDOR_INTEGRATIONS`)        |
| Get data source by ID | `GET`    | `/public_api/appsec/v1/data_source_instances/{id}` | Retrieve the full details of a specific data source integration by its unique identifier                                                                       |
| Create data source    | `POST`   | `/public_api/appsec/v1/data_source_instances`      | Create and configure a new AppSec data source integration (VCS, CI/CD, or third-party scanner)                                                                 |
| Update data source    | `PUT`    | `/public_api/appsec/v1/data_source_instances/{id}` | Update the repository selection, selection type, or external project mappings for an existing data source integration                                          |
| Delete data source    | `DELETE` | `/public_api/appsec/v1/{id}`                       | Delete a data source integration. Removes the integration and all associated repository mappings                                                               |
| Upload SAST findings  | `POST`   | `/public_api/appsec/v1/collectors/{collectorId}`   | Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. Accepts scan results in SARIF v2.1.0 format |

For the complete API reference, including request and response schemas, query parameter documentation, and error codes, refer to .[Cortex API Documentation](/cortex-api-overview/readme.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/manage-integrations-via-data-source-apis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.