Applications
APIs for managing applications
Retrieves the application configuration settings.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Ok
Indicates if the system is configured to automatically and periodically refresh the application's metadata and asset data.
Indicates if findings from Software Bill of Materials (SBOM) scans are treated as brand-new issues for tracking and compliance purposes.
GET /public_api/appsec/v1/application/configuration HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Accept: */*
Ok
{
"keepApplicationRefresh": true,
"areSbomIssuesConsideredNew": true,
"sla": {
"CRITICAL": {
"targetDays": 7
},
"HIGH": {
"targetDays": 14
},
"MEDIUM": {
"targetDays": 30
},
"LOW": {
"targetDays": 90
},
"approaching": {
"targetDays": 5
}
}
}Retrieves a list of all application assets using pagination.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Page number of the results to retrieve for pagination.
Number of records returned per page.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Ok
Indicates whether additional results are available beyond the current page.
GET /public_api/appsec/v1/application HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Accept: */*
Ok
{
"data": [
{
"criteriaId": "text",
"criteriaName": "text",
"risk": 1,
"id": "text",
"strongId": "text",
"name": "text",
"description": "text",
"exposures": [
"DeployedToProduction"
],
"coverage": 1,
"businessCriticality": "Critical",
"businessUnit": "text",
"creationType": "Auto",
"businessOwner": [
"text"
],
"devOwner": [
"text"
],
"devOpsOwner": [
"text"
],
"productManager": [
"text"
],
"dataGovernance": "PII",
"compliance": "PCI-DSS",
"environments": "text",
"assetsCount": 1,
"config": {
"lastRefreshDate": "2026-01-01T00:00:00.000Z",
"assetSelection": {
"selectionType": "filter",
"section": "code",
"filter": {
"values": [
"text"
],
"provider": "CIRCLE_CI",
"filterType": "REPOSITORY"
},
"assetIds": [
"text"
]
}
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"deletedAt": "2026-01-01T00:00:00.000Z",
"enrichStatus": "IN_PROGRESS",
"unifyAcrossProviders": true,
"unifyWithinProvider": true
}
],
"hasNext": true
}Creates a new application asset based on the provided details, such as name, criticality, and asset selection.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241A unique name for the application asset.
The operational importance of the asset.
Business unit responsible for the asset.
Defines how the application asset is created.
A brief description of the asset's purpose.
The compliance status or requirement category for an asset.
A list of stakeholders responsible for the asset from the business side.
A list of primary developers or engineering leads responsible for the code.
A list of SRE or DevOps engineers managing the infrastructure.
A list of product managers responsible for overseeing the application asset.
Ok
Displays the status of the application.
trueDisplays the Asset ID of the application.
a7dc11ea688c73dbbc759459ba661d7f7a7edaad229a3fdb50701b6548535f5bNot Found
Conflict. Occurs when an application with the specified name already exists.
Resolution
Provide a unique name for the application.
Internal Server Error. Occurs when the server encounters an unexpected condition that prevents it from fulfilling the request.
Resolution
This is a server-side issue. No action is required from you. If the problem persists, try again later.
POST /public_api/appsec/v1/application HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 396
{
"name": "test-app",
"businessCriticality": "Low",
"businessUnit": "string",
"creationType": "Auto",
"description": "string",
"businessOwner": [],
"devOwner": [],
"devOpsOwner": [],
"productManager": [],
"assetSelection": {
"selectionType": "filter",
"section": "code",
"filter": {
"values": [
"928aa0b599d2df33978d958e96d146fc299ac68f02fda5cc376440f41452c2e0"
],
"provider": "GITHUB",
"filterType": "REPOSITORY"
},
"assetIds": []
}
}{
"status": true,
"applicationId": "a7dc11ea688c73dbbc759459ba661d7f7a7edaad229a3fdb50701b6548535f5b"
}Retrieves detailed information for a specific application asset using its unique ID.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
Unique ID of the Application
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Ok
Exposure attributes associated with the asset.
A unique identifier of the criteria.
Name of the criteria.
Calculated risk score associated with the criteria or asset.
Unique identifier of the resource.
Globally unique, immutable identifier for the resource.
Name of the application asset.
Description providing additional details about the asset.
Represents the level of coverage applied to the asset.
The operational importance of the asset.
Business unit responsible for the asset.
Defines how the application asset is created.
Business owners responsible for the asset.
Development owners responsible for building and maintaining the asset.
DevOps owners responsible for deployment and operations.
Product managers responsible for the asset.
Type of data governance applied to the asset.
The compliance status or requirement category for an asset.
Environment in which the asset is deployed (for example, development, staging, or production).
Total number of assets included in the response.
Date and time when the configuration was last updated.
Date and time when the configuration was deleted.
Indicates whether asset enrichment is currently in progress.
If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application.
Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider.
GET /public_api/appsec/v1/application/{applicationId} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Accept: */*
Ok
{
"criteriaId": "string",
"risk": -1.7976931348623157e+308,
"id": "string",
"strongId": "string",
"name": "string",
"description": "string",
"exposures": [
"DeployedToProduction"
],
"coverage": -1.7976931348623157e+308,
"businessCriticality": "Critical",
"businessUnit": "string",
"creationType": "Auto",
"businessOwner": [
"string"
],
"devOwner": [
"string"
],
"devOpsOwner": [
"string"
],
"productManager": [
"string"
],
"environments": "string",
"assetsCount": -1.7976931348623157e+308,
"config": {
"lastRefreshDate": "2019-08-24T14:15:22Z",
"assetSelection": {
"selectionType": "filter",
"section": "code",
"filter": {
"values": [
"string"
],
"provider": "CIRCLE_CI",
"filterType": "REPOSITORY"
},
"assetIds": [
"string"
]
}
},
"updatedAt": "2019-08-24T14:15:22Z",
"deletedAt": "2019-08-24T14:15:22Z",
"enrichStatus": "IN_PROGRESS"
}Updates the attributes of an existing application asset identified by its unique ID.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
Unique ID of the Application
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241The operational importance of the asset.
How the asset was created.
Business unit responsible for the asset.
Description providing additional details about the asset.
The compliance status or requirement category for an asset.
Business owners responsible for the asset.
Development owners responsible for building and maintaining the asset.
DevOps owners responsible for deployment and operations.
Product managers responsible for the asset.
Ok
Displays the status of the application.
trueDisplays the Asset ID of the application.
a7dc11ea688c73dbbc759459ba661d7f7a7edaad229a3fdb50701b6548535f5bPUT /public_api/appsec/v1/application/{applicationId} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 216
{
"businessCriticality": "Critical",
"creationType": "Auto",
"businessUnit": "text",
"description": "text",
"compliance": "PCI-DSS",
"businessOwner": [
"text"
],
"devOwner": [
"text"
],
"devOpsOwner": [
"text"
],
"productManager": [
"text"
]
}Ok
{
"status": true,
"applicationId": "a7dc11ea688c73dbbc759459ba661d7f7a7edaad229a3fdb50701b6548535f5b"
}Deletes a specific application asset identified by its unique ID.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
Unique ID of the Application
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Ok
DELETE /public_api/appsec/v1/application/{applicationId} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Accept: */*
Ok
{
"message": "text"
}Returns assets that can be added to the specified application. Use this endpoint to find assets that are not currently associated with the application and manually add them to improve the application's asset inventory. Use the optional filter parameter to return specific subsets of assets, such as orphan assets, recently discovered assets, or assets with shared contributors. Results are paginated, with pages starting at 1.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
The unique identifier of the application. Use the id field from the response of the Get applications endpoint. This value is the SHA-style identifier.
The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.
0The number of assets to return on each page.
100A predefined shortcut that filters the assets that are available to add.
RecentlyDiscovered- Returns assets that were discovered recently.OrphanAssets- Returns assets that are not associated with any application.SameContributors- Returns assets that share contributors with the application.
{api_key}
your-api-key-here{api_key_id}
1A paginated list of the assets that you can add to the application.
A paginated list of assets that you can add to or remove from the application.
The number of the current page. Pages are numbered starting at 1.
The total number of pages that are available for the current page size.
The number of assets that are returned on each page.
The total number of assets that match the request.
GET /public_api/appsec/v1/application/{applicationId}/assets/addable HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Accept: */*
A paginated list of the assets that you can add to the application.
{
"items": [
{
"assetId": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
"assetName": null,
"assetTypeCategory": "Other",
"assetTypeId": "AWS_BACKUP_PROTECTED_RESOURCES",
"assetTypeClass": "Other",
"assetProvider": "AWS",
"assetCloudRegion": "us-east-1"
},
{
"assetId": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0",
"assetName": "example.com",
"assetTypeCategory": "Certificate",
"assetTypeId": "TLS_CERTIFICATE",
"assetTypeClass": "External Surface",
"assetProvider": "OTHER",
"assetCloudRegion": ""
}
],
"currentPage": 1,
"totalPages": 37312,
"pageSize": 3,
"totalItems": 111935
}Returns assets that can be removed from the specified application. Use this endpoint to identify assets that are currently associated with the application and are eligible for manual removal. Results are paginated, with pages starting at 1.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
The unique identifier of the application. Use the id field from the response of the Get applications endpoint. This value is the SHA-style identifier.
The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.
0The number of assets to return on each page.
100{api_key}
your-api-key-here{api_key_id}
1A paginated list of the assets that you can remove from the application.
A paginated list of assets that you can add to or remove from the application.
The number of the current page. Pages are numbered starting at 1.
The total number of pages that are available for the current page size.
The number of assets that are returned on each page.
The total number of assets that match the request.
GET /public_api/appsec/v1/application/{applicationId}/assets/removable HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Accept: */*
A paginated list of the assets that you can remove from the application.
{
"items": [
{
"assetId": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
"assetName": "example-collaborator",
"assetTypeCategory": "Human Identity",
"assetTypeId": "VCS_COLLABORATOR",
"assetTypeClass": "Identity",
"assetProvider": "GITHUB",
"assetCloudRegion": null
},
{
"assetId": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0",
"assetName": "example-org/finance-app-code",
"assetTypeCategory": "Repository",
"assetTypeId": "GITHUB_REPOSITORY",
"assetTypeClass": "Code",
"assetProvider": "GITHUB",
"assetCloudRegion": null
}
],
"currentPage": 1,
"totalPages": 41,
"pageSize": 5,
"totalItems": 204
}Adds or removes assets from the specified application. Set the operation field to ADD to associate the specified assets with the application, or to REMOVE to disassociate them. Each request creates a single override action and returns an actionId that identifies the operation and all affected assets. You can use this actionId to undo the operation with Revert asset override action.
To identify assets that can be added, use List addable assets. To identify assets that can be removed, use List removable assets.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
The unique identifier of the application. Use the id field from the response of the Get applications endpoint. This value is the SHA-style identifier.
{api_key}
your-api-key-here{api_key_id}
1The assets to add or remove and the operation to apply.
The unique identifiers of the assets to add or remove. To find assets that you can add, use List addable assets. To find assets that you can remove, use List removable assets.
The override operation to apply to the specified assets.
An optional filter expression that is stored with the override action, such as assetProvider=AWS. The assetIds field is always required, even when you provide a filter. The filter is recorded with the action and is returned in the filter field of List override actions.
The override action completed. The response includes the action identifier and the assets that were processed.
The result of an add or remove override operation.
Indicates whether the override operation completed successfully.
The unique identifier of the override action. Use this value to revert the action with Revert overrides by action ID.
The unique identifiers of the assets that the operation processed successfully.
The specified application was not found. This endpoint validates the applicationId and returns this error when no matching application exists.
The request failed validation. For example, the operation field is missing, the operation value is not one of ADD or REMOVE, or assetIds is empty.
POST /public_api/appsec/v1/application/{applicationId}/assets/override HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 166
{
"assetIds": [
"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
"0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0"
],
"operation": "ADD"
}{
"success": true,
"actionId": "11111111-2222-3333-4444-555555555555",
"processed": [
"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90"
],
"failed": []
}Returns the history of manual asset override actions for the specified application. Each entry represents a single add or remove action and includes the affected assets, the operation, the user who performed it, and the timestamp when it was created. Results are paginated, with pages starting at 1.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
The unique identifier of the application. Use the id field from the response of the Get applications endpoint. This value is the SHA-style identifier.
The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.
0The number of override actions to return on each page.
100{api_key}
your-api-key-here{api_key_id}
1A paginated list of the override actions that were applied to the application.
A paginated list of override actions that were applied to the application.
Indicates whether more pages of results are available. When the value is true, request the next page to retrieve additional results.
GET /public_api/appsec/v1/application/{applicationId}/assets/overrides HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Accept: */*
A paginated list of the override actions that were applied to the application.
{
"data": [
{
"actionId": "11111111-2222-3333-4444-555555555555",
"assetIds": [
"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90"
],
"operationType": "ADD",
"userEmail": "user@example.com",
"filter": null,
"createdAt": "2026-07-31T05:55:43"
}
],
"hasNext": false
}Reverts a manual asset override action by its actionId. Reverting an action undoes the add or remove operation for all assets affected by that override action. To find the actionId, use the value returned by Add or remove assets or the actionId value from List override actions.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.
The unique identifier of the application. Use the id field from the response of the Get applications endpoint. This value is the SHA-style identifier.
The unique identifier of the override action to revert. Retrieve this value from the actionId field in the response of Add or remove assets or List override actions.
{api_key}
your-api-key-here{api_key_id}
1The override action was reverted. The response lists the assets whose override was undone.
The result of a revert operation.
Indicates whether the revert operation completed successfully.
The unique identifiers of the assets whose override was reverted.
The resource was not found. This endpoint returns this error when the specified application does not exist, or when no override action matches the specified action identifier in the application.
DELETE /public_api/appsec/v1/application/{applicationId}/assets/overrides/{actionId} HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 1
Accept: */*
{
"success": true,
"reverted": [
"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90"
]
}Last updated
Was this helpful?