API Workflow

When to use the API

Use the public API to check packages for malicious status from external consumers and automation, for example, to evaluate a dependency set outside the tenant. NOTE: The Cortex CLI consumes these same public endpoints because it runs outside the Kubernetes cluster and cannot reach the internal endpoints.

Supported operations

Operation	Method	Endpoint	Description
Check packages (boolean)	POST	public_api/appsec/v1/packages/malicious	Returns, for each submitted package, whether it is malicious.
Query packages (full details)	POST	public_api/appsec/v1/packages/malicious/query	Returns full malicious package details — Malware ID, affected versions, summary, and advisory link — for confirmed malicious packages.

For detailed information on Malicious Package APIs, refer to Cortex API Overview.