Reference D: CI status values

CI status indicates the policy evaluation result. It corresponds to the Cortex CLI exit code returned to the pipeline. CI status applies to CI scans and pull request scans. Branch periodic scans have no scan status.

CI status	Wire value	Meaning	Exit code	Build consequence
Passed	PASSED	The scan completed. No finding matched a blocking policy.	0	The build continues.
Blocked	FAILED	A finding matched an enabled policy with Block CI/CD.	1	The build fails when the pipeline treats non-zero exit codes as failures.
In Progress	IN_PROGRESS	The scan is executing.	Not yet returned	The pipeline step is still running.
N/A	N/A	The conditions are not confirmed.	Not confirmed	Not confirmed

Error is a Scan Health value only. It never appears as a CI Status value. Filter Scan Health to find scans that failed to execute. See Reference C: Scan health values.

Passed With Issues has a distinct wire value. The console renders it like Passed. Use Issues Found to distinguish them. A Passed row with non-zero issues is Passed With Issues. Use the public API where the distinction must be machine-readable.

Do not treat an errored CLI scan as a clean evaluation. The scan reached no policy verdict.

A finding inside a policy grace period does not fail the build. This is expected during the grace window.