Manage registry scanning with APIs

Learn how to onboard and manage registry scanning programatically with APIs for Cortex XSIAM.

1. Onboarding and managing connectors

Third-party integrations

Use the registry onboarding API endpoints to onboard or manage third-party integrations such as JFrog Artifactory, Docker Hub, Harbor, Sonatype Nexus, GitLab Container Registry, Docker V2, and OpenShift.

Cortex provides dedicated, schema-validated Public API endpoints:

Action	Endpoint
Create connector	POST /public_api/v1/cwp/registry_onboarding/instances
Get connector details	GET /public_api/v1/cwp/registry_onboarding/instances/{connectorID}
Update connector	PUT /public_api/v1/cwp/registry_onboarding/instances/{connectorID}
Delete connector	DELETE /public_api/v1/cwp/registry_onboarding/instances/{connectorID}

Managed cloud registries

(AWS ECR, GCP Artifact Registry/GCR, Azure ACR, OCI)

No individual registry-creation endpoints. These are onboarded at the cloud account level through Cloud Account Onboarding APIs.

2. Triggering scans

There is no public API to trigger on-demand registry scans. Registry scanning is automated and event-driven.

3. Retrieving scan results

There's no single dedicated /public_api/.../registry/scan-results endpoint. Because results are normalized into the Unified Asset Inventory, findings, and issues, you retrieve them as follows:

a. Asset SBOM API

• GET /public_api/v1/assets/{assetId}/sbom — returns the SBOM (packages, versions, licenses) for a scanned container image asset.

b. XQL Query API

• POST /public_api/v1/xql/start_xql_query and POST /public_api/v1/xql/get_query_results

  • Image assets & metadata: query the asset_inventory dataset filtered on the container image asset type to inspect tags, digests, repositories, registries, and scan timestamps.
  • Vulnerabilities, secrets, malware: query the findings dataset by asset ID, for finding types such as VULNERABILITY, MALWARE, SECRET, or compliance checks.

c. Platform Issues API

• POST /public_api/v1/issue/search/ and GET /public_api/v1/issue/<issue_id>/ — retrieves security issues generated when scanned images trigger CWP security policies.