Data Sources
APIs for managing integrations
Retrieve a list of all data source instances configured in your Cortex environment. You can filter the results by data source type and category.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Type of data source instance to retrieve.
Category of data source instances to retrieve.
{api_key}
your_api_key_here{api_key_id}
1Ok
Integration details
Date and time when the data source instance was created.
Unique identifier (ID) of the data source instance.
Version of the data source instance configuration.
Date and time when the data source instance was last updated.
Defines how repositories are selected for scanning within a data source instance.
PEM-encoded self-signed certificate used for secure communication with the data source.
Integration state
Current connection status of the data source instance.
COMPLETED— The data source instance setup is complete and operational.CONNECTED— The data source instance is actively connected.DESTROYING— The data source instance is being removed.DISABLED— The data source instance is disabled and not actively scanning.ERROR— The data source instance encountered an error and requires attention.PENDING— The data source instance is being set up and is not yet active.TEMPORARY— The data source instance is in a temporary state during configuration.TRANSPORTER_CONNECTION_DISABLED— The transporter connection for this data source instance is disabled.WARNING— The data source instance is operational but has warnings that may require attention.
Tenant ID that owns this data source instance.
Type of the data source instance, indicating the external system it connects to.
Category classification of the data source instance type.
DEFAULT— Standard data source instances such as VCS, CI/CD, and CLI integrations.EXTERNAL_VENDOR_INTEGRATIONS— Third-party external vendor integrations.
Unique identifier of the integration
Total number of repositories associated with this data source instance.
GET /public_api/appsec/v1/data_source_instances HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*
Ok
[
{
"creationDate": "2025-06-15T09:30:00.000Z",
"domain": {
"hostname": "github.example.com",
"protocol": "https"
},
"id": "a1b2c3d4e5f6a7b8c9d0e1f2",
"instanceVersion": "1.0.0",
"lastUpdateDate": "2025-07-20T14:15:30.000Z",
"scanTypes": {
"SAST": {
"isEnabled": true
},
"SCA": {
"isEnabled": false
}
},
"selectionType": "MANUAL_SELECTION",
"selfSignedCertificate": "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIJAL...\n-----END CERTIFICATE-----",
"state": [
"example-org/repo-alpha",
"example-org/repo-beta"
],
"status": "CONNECTED",
"statusDetails": {
"connection": {
"status": "VALID",
"message": "Connection established successfully",
"timestamp": "2025-07-20T14:15:30.000Z"
}
},
"tenantId": "tenant-001",
"transporter": {
"brokerDeviceId": "broker-device-abc123",
"connectionName": "on-prem-github-connection"
},
"type": "GITHUB_ENTERPRISE",
"typeCategory": "DEFAULT",
"uniqueIdentifier": "example-org",
"repositoriesCount": 12
},
{
"creationDate": "2025-08-01T11:00:00.000Z",
"domain": {
"hostname": "api.example-vendor.io",
"protocol": "https"
},
"id": "b2c3d4e5f6a7b8c9d0e1f2a3",
"lastUpdateDate": "2025-08-10T16:45:00.000Z",
"scanTypes": {
"SAST": {
"isEnabled": true
},
"SCA": {
"isEnabled": true
}
},
"selectionType": "CURRENT_STATE_AND_FUTURE",
"status": "CONNECTED",
"type": "SNYK",
"typeCategory": "EXTERNAL_VENDOR_INTEGRATIONS",
"uniqueIdentifier": "snyk-default-org",
"repositoriesCount": 5
},
{
"creationDate": "2025-09-12T08:20:00.000Z",
"id": "c3d4e5f6a7b8c9d0e1f2a3b4",
"lastUpdateDate": "2025-09-12T08:20:00.000Z",
"status": "CONNECTED",
"type": "COLLECTOR",
"uniqueIdentifier": "my-sast-collector",
"repositoriesCount": 0
}
]Create a new data source instance to connect an external system to your Cortex environment.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
your_api_key_here{api_key_id}
1Define the integration configuration
Type of the data source instance, indicating the external system it connects to.
A flexible key-value map for specifying additional properties. Keys are strings and values can be of any type.
PEM-encoded self-signed certificate for secure communication.
Ok
Integration details
Date and time when the data source instance was created.
Unique identifier (ID) of the data source instance.
Version of the data source instance configuration.
Date and time when the data source instance was last updated.
Defines how repositories are selected for scanning within a data source instance.
PEM-encoded self-signed certificate used for secure communication with the data source.
Integration state
Current connection status of the data source instance.
COMPLETED— The data source instance setup is complete and operational.CONNECTED— The data source instance is actively connected.DESTROYING— The data source instance is being removed.DISABLED— The data source instance is disabled and not actively scanning.ERROR— The data source instance encountered an error and requires attention.PENDING— The data source instance is being set up and is not yet active.TEMPORARY— The data source instance is in a temporary state during configuration.TRANSPORTER_CONNECTION_DISABLED— The transporter connection for this data source instance is disabled.WARNING— The data source instance is operational but has warnings that may require attention.
Tenant ID that owns this data source instance.
Type of the data source instance, indicating the external system it connects to.
Category classification of the data source instance type.
DEFAULT— Standard data source instances such as VCS, CI/CD, and CLI integrations.EXTERNAL_VENDOR_INTEGRATIONS— Third-party external vendor integrations.
Unique identifier of the integration
Validation error.
POST /public_api/appsec/v1/data_source_instances HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 112
{
"type": "COLLECTOR",
"uniqueProperties": {
"name": "my-sast-collector",
"detectionMethod": "SAST",
"fileType": "SARIF"
}
}{
"creationDate": "2025-04-02T08:20:58.381Z",
"id": "d4e5f6a7b8c9d0e1f2a3b4c5",
"status": "CONNECTED",
"type": "COLLECTOR",
"uniqueIdentifier": "my-sast-collector",
"lastUpdateDate": "2025-04-02T08:20:58.381Z",
"credentials": {
"webhookAuthKey": "your_webhook_auth_key_shown_only_once",
"webhookAuthKeyId": 1
},
"detectionMethod": "SAST",
"fileType": "SARIF",
"apiUrl": "https://api-yourfqdn/public_api/appsec/v1/collectors/d4e5f6a7b8c9d0e1f2a3b4c5"
}Retrieve the details of a specific data source instance identified by its ID.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique ID of the data source instance to retrieve. You can retrieve this value from the id field in the response of Get all Data Sources or Create Appsec Data Sources endpoint.
{api_key}
your_api_key_here{api_key_id}
1Ok
Integration details
Date and time when the data source instance was created.
Unique identifier (ID) of the data source instance.
Version of the data source instance configuration.
Date and time when the data source instance was last updated.
Defines how repositories are selected for scanning within a data source instance.
PEM-encoded self-signed certificate used for secure communication with the data source.
Integration state
Current connection status of the data source instance.
COMPLETED— The data source instance setup is complete and operational.CONNECTED— The data source instance is actively connected.DESTROYING— The data source instance is being removed.DISABLED— The data source instance is disabled and not actively scanning.ERROR— The data source instance encountered an error and requires attention.PENDING— The data source instance is being set up and is not yet active.TEMPORARY— The data source instance is in a temporary state during configuration.TRANSPORTER_CONNECTION_DISABLED— The transporter connection for this data source instance is disabled.WARNING— The data source instance is operational but has warnings that may require attention.
Tenant ID that owns this data source instance.
Type of the data source instance, indicating the external system it connects to.
Category classification of the data source instance type.
DEFAULT— Standard data source instances such as VCS, CI/CD, and CLI integrations.EXTERNAL_VENDOR_INTEGRATIONS— Third-party external vendor integrations.
Unique identifier of the integration
Not Found
GET /public_api/appsec/v1/data_source_instances/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*
{
"creationDate": "2025-06-15T09:30:00.000Z",
"domain": {
"hostname": "github.example.com",
"protocol": "https"
},
"id": "a1b2c3d4e5f6a7b8c9d0e1f2",
"instanceVersion": "1.0.0",
"lastUpdateDate": "2025-07-20T14:15:30.000Z",
"scanTypes": {
"SAST": {
"isEnabled": true
},
"SCA": {
"isEnabled": false
}
},
"selectionType": "MANUAL_SELECTION",
"selfSignedCertificate": "-----BEGIN CERTIFICATE-----\nMIIBxTCCAWugAwIBAgIJAL...\n-----END CERTIFICATE-----",
"state": [
"example-org/repo-alpha",
"example-org/repo-beta"
],
"status": "CONNECTED",
"statusDetails": {
"connection": {
"status": "VALID",
"message": "Connection established successfully",
"timestamp": "2025-07-20T14:15:30.000Z"
}
},
"tenantId": "tenant-001",
"transporter": {
"brokerDeviceId": "broker-device-abc123",
"connectionName": "on-prem-github-connection"
},
"type": "GITHUB_ENTERPRISE",
"typeCategory": "DEFAULT",
"uniqueIdentifier": "example-org"
}Update the configuration of an existing data source instance.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique ID of the data source instance to update. You can retrieve this value from the id field in the response of Get all Data Sources or Create Appsec Data Sources endpoint.
{api_key}
your_api_key_here{api_key_id}
1Define the integration details
Defines how repositories are selected for scanning within a data source instance.
To update the integration for specific repositories, specify them here in the following format:
"state":"["org1"/"repo_name1", "org2"/"repo_name2"]
A flexible key-value map for specifying additional properties. Keys are strings and values can be of any type.
Ok
Integration details
Date and time when the data source instance was created.
Unique identifier (ID) of the data source instance.
Version of the data source instance configuration.
Date and time when the data source instance was last updated.
Defines how repositories are selected for scanning within a data source instance.
PEM-encoded self-signed certificate used for secure communication with the data source.
Integration state
Current connection status of the data source instance.
COMPLETED— The data source instance setup is complete and operational.CONNECTED— The data source instance is actively connected.DESTROYING— The data source instance is being removed.DISABLED— The data source instance is disabled and not actively scanning.ERROR— The data source instance encountered an error and requires attention.PENDING— The data source instance is being set up and is not yet active.TEMPORARY— The data source instance is in a temporary state during configuration.TRANSPORTER_CONNECTION_DISABLED— The transporter connection for this data source instance is disabled.WARNING— The data source instance is operational but has warnings that may require attention.
Tenant ID that owns this data source instance.
Type of the data source instance, indicating the external system it connects to.
Category classification of the data source instance type.
DEFAULT— Standard data source instances such as VCS, CI/CD, and CLI integrations.EXTERNAL_VENDOR_INTEGRATIONS— Third-party external vendor integrations.
Unique identifier of the integration
Internal Server Error
PUT /public_api/appsec/v1/data_source_instances/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 218
{
"selectionType": "CURRENT_STATE",
"state": [
"string"
],
"externalProjects": [
{
"branchName": "string",
"externalBranchName": "string",
"externalId": "string",
"externalProjectId": "string",
"repoId": "string"
}
],
"uniqueProperties": {}
}{
"creationDate": "2025-09-12T08:20:00.000Z",
"id": "d4e5f6a7b8c9d0e1f2a3b4c5",
"instanceVersion": "1.0.0",
"lastUpdateDate": "2025-10-05T16:30:00.000Z",
"selectionType": "MANUAL_SELECTION",
"state": [
"example-org/repo-alpha",
"example-org/repo-beta"
],
"status": "CONNECTED",
"type": "COLLECTOR",
"typeCategory": "DEFAULT",
"uniqueIdentifier": "my-collector-updated",
"detectionMethod": "SAST",
"fileType": "SARIF",
"apiUrl": "https://api-yourfqdn/public_api/appsec/v1/collectors/d4e5f6a7b8c9d0e1f2a3b4c5"
}Delete the specified data source instance from your Cortex environment.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique ID of the data source instance to delete.
{api_key}
your_api_key_here{api_key_id}
1No content
No content
DELETE /public_api/appsec/v1/data_source_instances/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*
No content
No content
Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. This endpoint is used specifically for ingesting scan results, not for creating or configuring a generic collector.
The Collector API accepts scan results in SARIF v2.1.0 format. Once uploaded, the SARIF file is parsed to create code findings. These findings can then be elevated to issues, either manually or automatically, depending on your configured policies.
Required license:
Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Prerequisites
Permissions: The following Cortex Cloud user roles or RBAC permissions are required:
User roles:
Cortex Cloud Instance Administrator
AppSec Administrator
RBAC:
View/Edit permissions for Data Sources configurations are required when not using a dedicated user role.
Repository Identification: The repository must already be onboarded in Cortex Cloud before SARIF findings for that repository can be uploaded. To identify the target repository, you must provide at least one of the following query parameters:
repository_id— The repository asset ID. This is theidfield (SHA-256 hash format) returned by the Get repositories endpoint.repository_url— The repository URL (for example,https://github.com/owner/repo).Either
repository_idorrepository_urlmust be provided. Both can be provided simultaneously. If neither is provided, the request returns a 400 error.
SARIF specifications: The following table outlines the mandatory and optional JSON fields required to successfully validate and ingest SAST findings.
version
Yes
Must be "2.1.0"
tool.driver.name
Yes
Analysis tool name
driver.rules or extensions[].rules
Yes
At least one rule definition
results[].ruleId
Yes
Must match a defined rule id
results[].message.text
Yes
Finding description
results[].locations[].physicalLocation.artifactLocation.uri
Yes
File path
results[].locations[].physicalLocation.region.startLine
Yes
Line number
results[].level
Yes
error | warning | note | none. Defaults to High
Limitations
Maximum file size: 10 MB per request.
SARIF version: Only SARIF v2.1.0 is supported. Files with invalid formats or schema will return a 400 error.
Unique identifier for the collector instance. This is the id field returned by the Get all Data Sources endpoint (with type=collector). The collector must be of type COLLECTOR with detectionMethod: SAST and fileType: SARIF
col_7f2a9b4e1c3d5f8a0b6e2d4cThe asset ID of the target repository. This is the id field (SHA-256 hash format) returned by the Get repositories endpoint. At least one of repository_url or repository_id must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request.
a3b8f2e1c7d4509a6b1e3f8c2d7a4b9e5f0c1d6a8b3e7f2c4d9a0b5e1f6c3d8The URL of the target repository. At least one of repository_url or repository_id must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request.
https://github.com/testapp/cvesOptional. Branch name to associate findings with. Defaults to the repository's default branch when omitted.
main{api_key}
your_api_key_here{api_key_id}
1Returned when the SARIF file is accepted and the ingestion process has started.
Ingestion status.
Human-readable result message including the number of findings to be ingested.
Bad Request
Forbidden
The API key lacks required permissions. Required role: Instance Admin, AppSec Admin, or Data Sources edit permission.
Not Found
Service Unavailable. Returned when the collector is disabled.
POST /public_api/appsec/v1/collectors/{collectorId}?repository_id=a3b8f2e1c7d4509a6b1e3f8c2d7a4b9e5f0c1d6a8b3e7f2c4d9a0b5e1f6c3d8&repository_url=https%3A%2F%2Fgithub.com%2Ftestapp%2Fcves HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 2343
{
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
"version": "2.1.0",
"runs": [
{
"tool": {
"driver": {
"name": "Veracode Static Analysis Policy Scan",
"rules": [
{
"id": "78",
"name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
"shortDescription": {
"text": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
},
"helpUri": "https://cwe.mitre.org/data/definitions/78.html",
"properties": {
"category": "STATIC",
"tags": [
"STATIC"
]
},
"defaultConfiguration": {
"level": "error"
}
},
{
"id": "89",
"name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"shortDescription": {
"text": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
},
"helpUri": "https://cwe.mitre.org/data/definitions/89.html",
"properties": {
"category": "STATIC",
"tags": [
"STATIC"
]
},
"defaultConfiguration": {
"level": "error"
}
}
],
"version": "1.0"
}
},
"results": [
{
"level": "error",
"rank": 5,
"message": {
"text": "This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"uri": "com/scalesec/vulnado/Cowsay.java"
},
"region": {
"startLine": 16
}
},
"logicalLocations": [
{
"name": "Cowsay.java",
"fullyQualifiedName": "com.scalesec.vulnado.Cowsay.run",
"kind": "function"
}
]
}
],
"ruleId": "78",
"partialFingerprints": {
"context_guid": "",
"file_path": "",
"procedure": ""
}
},
{
"level": "error",
"rank": 4,
"message": {
"text": "This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database."
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"uri": "com/scalesec/vulnado/User.java"
},
"region": {
"startLine": 49
}
},
"logicalLocations": [
{
"name": "User.java",
"fullyQualifiedName": "com.scalesec.vulnado.User.fetch",
"kind": "function"
}
]
}
],
"ruleId": "89",
"partialFingerprints": {
"context_guid": "",
"file_path": "",
"procedure": ""
}
}
]
}
]
}{
"status": "INGESTED",
"message": "SARIF file uploaded successfully. Ingestion in progress, findings may take a few minutes to show. 1 findings will be ingested"
}Last updated
Was this helpful?