> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md).

# Cortex CLI usage for Application Security

To scan Application Security, run:

{% code overflow="wrap" %}

```programlisting
cortexcli –-api-base-url <API URL> --api-key <API key from the "Authenticate" step in the CLI connector screen> --api-key-id <API Key ID> code scan --directory {{DIRECTORY}} --branch main --repo-id organization/repo-name –output json --output-file-path ./output.json
```

{% endcode %}

**Command line reference**

The command structure includes global flags which are used for authentication, and then specifies the module name and command specific to Application Security which are followed by dedicated flags unique to this module as well as flags common to all modules.

* **Global flags**: These flags are part of the initial `cortexcli` command and are necessary to authenticate and connect to Cortex XSIAM

  * `--api-base-url`: (Required = true). The public facing API URL. Refer to [Connect Cortex CLI](/cortex-cli/connect-cortex-cli.md) for more information
  * `--api-key`: (Required = true). The Cortex Cloud API key generated when onboarding the CLI as a data source. Refer to [Connect Cortex CLI](/cortex-cli/connect-cortex-cli.md) for more information
  * `--api-key-id`: (Required = true). The Cortex Cloud API key ID generated when onboarding the CLI as a data source

  For a comprehensive list of Application Security global flags, refer to [Cortex CLI Application Security command line reference](/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md)
* **Application Security specifics**: Following the global flags, the command specifies the module and the commands required for initiating a scan using the Cortex Cloud Application Security module:
  * `code scan`: Required - true. This command instructs the CLI to perform an Application Security scan.
  * For the optional flags, refer to the dedicated Application Security [command line reference](/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md)

**CLI Usage Examples**

* **Send output to a file**: Direct the command's output to a specified file instead of displaying it in the console

  ```programlisting
  ./cortexcli --api-base-url <BASE_URL> --api-key <API_KEY> --api-key-id <API_KEY_ID> code scan --branch <branch name> --repo-id <repo name> --directory <path> --output json --output-file-path <path>
  ```
* **Perform a scan without upload**: Run a scan for local analysis or testing without uploading the results to Cortex XSIAM. This command runs a code scan and saves all standard output (human-readable format) to `scan_results.txt`

  ```programlisting
  ./cortexcli --api-base-url <BASE_URL> --api-key <API_KEY> --api-key-id <API_KEY_ID> code scan --upload-mode no-upload --branch <branch name> --repo-id <repo name> --directory <path>
  ```

**Sample outputs**

The `cortexcli` provides different options for how scan results are presented.

* **Standard output** (stdout): When no specific output format flags (such as `--output json` or `--output sarif)` are provided, the Cortex CLI will produce standard output directly to your terminal or console
* **JSON output**: To obtain the output of a scan command as a JSON file, specify the flags `--output json --output-file-path ./output.json`. This command will save the detailed scan results in JSON format to output.json in the current directory.

**Supported flags**

The Application Security CLI supports both common Cortex CLI and dedicated Application Security flags.

* For dedicated Application Security flags, refer to [Cortex CLI Application Security command line reference](/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md)
* For common flags, refer to [Cortex CLI common command line reference guide](/cortex-cli/cortex-cli-common-command-line-reference-guide.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.