> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/applications.md).
# Applications
APIs for managing applications
## Get an application configuration
> Retrieves the application configuration settings.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/configuration":{"get":{"operationId":"GetApplicationSettingsConfiguration","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplicationConfigurationSettings"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"summary":"Get an application configuration","tags":["Applications"],"description":"Retrieves the application configuration settings.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus."}}},"components":{"schemas":{"ApplicationConfigurationSettings":{"type":"object","properties":{"keepApplicationRefresh":{"type":"boolean","description":"Indicates if the system is configured to automatically and periodically refresh the application's metadata and asset data."},"areSbomIssuesConsideredNew":{"type":"boolean","description":"Indicates if findings from Software Bill of Materials (SBOM) scans are treated as brand-new issues for tracking and compliance purposes."},"sla":{"type":"object","description":"Contains the Service Level Agreement (SLA) configurations, defining the resolution timeframes for various severity levels.","properties":{"CRITICAL":{"type":"object","description":"Defines the SLA target days for issues classified as CRITICAL severity.","properties":{"targetDays":{"type":"integer","description":"The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced."}}},"HIGH":{"type":"object","description":"Defines the SLA target days for issues classified as HIGH severity.","properties":{"targetDays":{"type":"integer","description":"The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced."}}},"MEDIUM":{"type":"object","description":"Defines the SLA target days for issues classified as MEDIUM severity.","properties":{"targetDays":{"type":"integer","description":"The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced."}}},"LOW":{"type":"object","description":"Defines the SLA target days for issues classified as LOW severity.","properties":{"targetDays":{"type":"integer","description":"The number of calendar days set as the target for resolving issues of this specific severity level. A value of **0** indicates the SLA is waived or not enforced."}}},"approaching":{"type":"object","description":"Defines the early warning threshold that triggers notifications before an SLA is officially breached.","properties":{"targetDays":{"type":"integer","description":"The number of calendar days set as the target for defining the 'approaching' window."}}}}}}}}}}
```
## Get applications
> Retrieves a list of all application assets using pagination.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application":{"get":{"operationId":"GetApplications","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BasicPaginatedResponse_ExtendedFields-Array_"}}}}},"parameters":[{"in":"query","name":"page","required":false,"schema":{"format":"double","type":"number"},"description":"Page number of the results to retrieve for pagination."},{"in":"query","name":"pageSize","required":false,"schema":{"format":"double","type":"number"},"description":"Number of records returned per page."},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"summary":"Get applications","tags":["Applications"],"description":"Retrieves a list of all application assets using pagination.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.\n"}}},"components":{"schemas":{"BasicPaginatedResponse_ExtendedFields-Array_":{"type":"object","additionalProperties":false,"required":["data","hasNext"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ExtendedFields"}},"hasNext":{"type":"boolean","description":"Indicates whether additional results are available beyond the current page."}}},"ExtendedFields":{"type":"object","additionalProperties":false,"description":"Exposure attributes associated with the asset.","required":["creationType","config"],"properties":{"criteriaId":{"type":"string","description":"A unique identifier of the criteria."},"criteriaName":{"type":"string","description":"Name of the criteria."},"risk":{"type":"number","format":"double","description":"Calculated risk score associated with the criteria or asset."},"id":{"type":"string","description":"Unique identifier of the resource."},"strongId":{"type":"string","description":"Globally unique, immutable identifier for the resource."},"name":{"type":"string","description":"Name of the application asset."},"description":{"type":"string","description":"Description providing additional details about the asset."},"exposures":{"type":"array","items":{"$ref":"#/components/schemas/Exposures"}},"coverage":{"type":"number","format":"double","description":"Represents the level of coverage applied to the asset."},"businessCriticality":{"$ref":"#/components/schemas/BusinessCriticality"},"businessUnit":{"type":"string","description":"Business unit responsible for the asset."},"creationType":{"$ref":"#/components/schemas/CreationType"},"businessOwner":{"type":"array","description":"Business owners responsible for the asset.","items":{"type":"string"}},"devOwner":{"type":"array","description":"Development owners responsible for building and maintaining the asset.","items":{"type":"string"}},"devOpsOwner":{"type":"array","description":"DevOps owners responsible for deployment and operations.","items":{"type":"string"}},"productManager":{"type":"array","description":"Product managers responsible for the asset.","items":{"type":"string"}},"dataGovernance":{"$ref":"#/components/schemas/DataGovernance"},"compliance":{"$ref":"#/components/schemas/Compliance"},"environments":{"type":"string","description":"Environment in which the asset is deployed (for example, development, staging, or production)."},"assetsCount":{"type":"number","format":"double","description":"Total number of assets included in the response."},"config":{"type":"object","description":"Configuration settings associated with the application.","required":["assetSelection"],"properties":{"lastRefreshDate":{"type":"string","format":"date-time","description":"Date and time when the application data was last refreshed."},"assetSelection":{"$ref":"#/components/schemas/ApplicationAssetSelection"}}},"updatedAt":{"type":"string","format":"date-time","description":"Date and time when the configuration was last updated."},"deletedAt":{"type":"string","format":"date-time","description":"Date and time when the configuration was deleted."},"enrichStatus":{"$ref":"#/components/schemas/ApplicationEnrichStatus"},"unifyAcrossProviders":{"type":"boolean","description":"If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application."},"unifyWithinProvider":{"type":"boolean","description":"Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider."}}},"Exposures":{"enum":["DeployedToProduction","SensitiveData","ExternalAccessible"],"type":"string","description":"Represents the risks the system identifies on assets.","title":"Exposures"},"BusinessCriticality":{"enum":["Critical","High","Medium","Low"],"type":"string","description":"The operational importance of the asset."},"CreationType":{"enum":["Auto","Manual"],"type":"string","description":"Defines how the application asset is created."},"DataGovernance":{"enum":["PII","PCI","Financial","PHI","Sensitive"],"type":"string","description":"Type of data governance applied to the asset."},"Compliance":{"enum":["PCI-DSS","ISO 27001","SOX","NIST","GDPR","CCPA","HIPAA","FedRAMP"],"type":"string","description":"The compliance status or requirement category for an asset."},"ApplicationAssetSelection":{"type":"object","additionalProperties":false,"description":"Define the logic for how specific technical assets must be linked to this application.","required":["selectionType","section"],"properties":{"selectionType":{"$ref":"#/components/schemas/ApplicationAssetSelectionType"},"section":{"$ref":"#/components/schemas/ApplicationBuilderStartSection"},"filter":{"$ref":"#/components/schemas/ApplicationAssetSelectionFilter"},"assetIds":{"type":"array","description":"A list of unique identifiers representing the assets to be included.","items":{"type":"string"}}},"title":"Application Asset Selection"},"ApplicationAssetSelectionType":{"enum":["filter","assetIds"],"type":"string","description":"Method to select application assets."},"ApplicationBuilderStartSection":{"enum":["code","run"],"type":"string","description":"Identifies the functional section to which the asset selection applies."},"ApplicationAssetSelectionFilter":{"anyOf":[{"$ref":"#/components/schemas/ManualAndRunCriteriaApplicationAssetSelectionFilter"},{"$ref":"#/components/schemas/ApplicationAssetSelectionFilterValues"},{"type":"string"}],"description":"Defines filter criteria to dynamically select application assets. This field supports one of the supported application asset selection filter types.","title":"Application Asset Selection Filter"},"ManualAndRunCriteriaApplicationAssetSelectionFilter":{"additionalProperties":false,"type":"object","title":"Manual and Run Criteria Application Asset Selection Filter","required":["values","filterType"],"properties":{"values":{"type":"array","description":"If the filterType is `REPOSITORY`, enter the repository ID as the value. \nIf the filterType is `ORGANIZATION`, enter the organization URL of the provider.","items":{"type":"string"}},"provider":{"$ref":"#/components/schemas/Provider"},"filterType":{"$ref":"#/components/schemas/FilterType"}}},"Provider":{"anyOf":[{"$ref":"#/components/schemas/BuildProvider"},{"$ref":"#/components/schemas/CodeProvider"},{"$ref":"#/components/schemas/RunProvider"},{"$ref":"#/components/schemas/DeployProvider"}]},"BuildProvider":{"enum":["CIRCLE_CI","JENKINS","GITLAB_CI","AZURE_PIPELINES","GITHUB_ACTIONS"],"type":"string","description":"Build system or CI provider used for the asset. **Allowed values:** `CIRCLE_CI` `JENKINS` `GITLAB_CI` `AZURE_PIPELINES` `GITHUB_ACTIONS`","title":"Build Provider"},"CodeProvider":{"enum":["GITLAB","GITHUB","BITBUCKET","AZURE_REPOS","AWS_CODE_COMMIT"],"type":"string","description":"Source code management (SCM) or code hosting provider.\n**Allowed values**: `GITLAB`, `GITHUB`, `BITBUCKET`, `AZURE_REPOS`, `AWS_CODE_COMMIT`","title":"Code Provider"},"RunProvider":{"enum":["GCP","AWS","AZURE"],"type":"string","description":"Runtime or execution environment provider for the application or asset. **Allowed Values**: `GCP`, `AWS`, `AZURE`","title":"Run Provider"},"DeployProvider":{"enum":["ACR","ECR","GAR","JFrog","Docker"],"type":"string","description":"Deployment platform or system used to deploy the application or asset. **Allowed values:** `ACR` `ECR` `GAR` `JFrog` `Docker`","title":"Deploy Provider"},"FilterType":{"anyOf":[{"$ref":"#/components/schemas/CodeFilterType"},{"$ref":"#/components/schemas/RunFilterType"}],"description":"The asset attribute used to filter assets from the selected provider."},"CodeFilterType":{"enum":["REPOSITORY","ORGANIZATION","CODE"],"type":"string","title":"Code Filter Type","description":"Specifies the available values for the code type filter."},"RunFilterType":{"enum":["K8S_NAMESPACE","K8S_CLUSTER","ORGANIZATION","RESOURCE_TAG","VPC","ACCOUNT"],"type":"string","title":"Run Type Filter","description":"Specifies the available values for the run type filter."},"ApplicationAssetSelectionFilterValues":{"type":"object","title":"Application Asset Selection Filter Values","description":"Defines the set of values used to evaluate the asset selection filter.","required":["values"],"properties":{"values":{"type":"object","description":"Container for filter values used to match application assets.","properties":{"orgUrl":{"type":"string","description":"Organization URL used to filter assets belonging to a specific organization."},"repositoryId":{"type":"string","description":"Unique identifier of the repository used to filter assets."},"projectUrl":{"type":"string","description":"Project URL used to filter assets belonging to a specific project."},"orgUnifyFilter":{"type":"object","description":"Defines unification rules applied at the organization level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the organization used for asset unification."}}},"projectUnifyFilter":{"type":"object","description":"Defines unification rules applied at the project level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the project used for asset unification."}}},"repositoryUnifyFilter":{"type":"object","description":"Defines unification rules applied at the repository level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the repository used for asset unification."}}}}},"filterType":{"$ref":"#/components/schemas/FilterType"}}},"ApplicationEnrichStatus":{"enum":["IN_PROGRESS","NOT_IN_PROGRESS"],"type":"string","description":"Indicates whether asset enrichment is currently in progress."}}}}
```
## Create an application
> Creates a new application asset based on the provided details, such as name, criticality, and asset selection.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application":{"post":{"operationId":"CreateApplication","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrudResponse"}}},"headers":{}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Displays the error code."},"message":{"type":"string","description":"Displays the error message."}}}}}},"409":{"description":"Conflict. Occurs when an application with the specified name already exists.\n\n**Resolution**\n\nProvide a unique name for the application.\n\n","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Displays the error code."},"message":{"type":"string","description":"Displays the error message."}}}}}},"500":{"description":"Internal Server Error. Occurs when the server encounters an unexpected condition that prevents it from fulfilling the request.\n\n**Resolution**\n\nThis is a server-side issue. No action is required from you. If the problem persists, try again later.\n","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","default":"InternalServerError"},"message":{"type":"string","default":"Internal Server Error"}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApplicationRequest"}}}},"summary":"Create an application","tags":["Applications"],"description":"Creates a new application asset based on the provided details, such as name, criticality, and asset selection.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus."}}},"components":{"schemas":{"CrudResponse":{"type":"object","additionalProperties":false,"required":["status"],"properties":{"status":{"type":"boolean","description":"Displays the status of the application.","default":true},"applicationId":{"type":"string","description":"Displays the Asset ID of the application."}}},"CreateApplicationRequest":{"type":"object","additionalProperties":false,"required":["name","businessCriticality","creationType","assetSelection"],"properties":{"name":{"type":"string","description":"A unique name for the application asset."},"businessCriticality":{"$ref":"#/components/schemas/BusinessCriticality"},"businessUnit":{"type":"string","description":"Business unit responsible for the asset."},"creationType":{"$ref":"#/components/schemas/CreationType"},"description":{"type":"string","description":"A brief description of the asset's purpose."},"compliance":{"$ref":"#/components/schemas/Compliance"},"businessOwner":{"type":"array","description":"A list of stakeholders responsible for the asset from the business side.","items":{"type":"string"}},"devOwner":{"type":"array","description":"A list of primary developers or engineering leads responsible for the code.","items":{"type":"string"}},"devOpsOwner":{"type":"array","description":"A list of SRE or DevOps engineers managing the infrastructure.","items":{"type":"string"}},"productManager":{"type":"array","description":"A list of product managers responsible for overseeing the application asset.","items":{"type":"string"}},"assetSelection":{"$ref":"#/components/schemas/ApplicationAssetSelection"}}},"BusinessCriticality":{"enum":["Critical","High","Medium","Low"],"type":"string","description":"The operational importance of the asset."},"CreationType":{"enum":["Auto","Manual"],"type":"string","description":"Defines how the application asset is created."},"Compliance":{"enum":["PCI-DSS","ISO 27001","SOX","NIST","GDPR","CCPA","HIPAA","FedRAMP"],"type":"string","description":"The compliance status or requirement category for an asset."},"ApplicationAssetSelection":{"type":"object","additionalProperties":false,"description":"Define the logic for how specific technical assets must be linked to this application.","required":["selectionType","section"],"properties":{"selectionType":{"$ref":"#/components/schemas/ApplicationAssetSelectionType"},"section":{"$ref":"#/components/schemas/ApplicationBuilderStartSection"},"filter":{"$ref":"#/components/schemas/ApplicationAssetSelectionFilter"},"assetIds":{"type":"array","description":"A list of unique identifiers representing the assets to be included.","items":{"type":"string"}}},"title":"Application Asset Selection"},"ApplicationAssetSelectionType":{"enum":["filter","assetIds"],"type":"string","description":"Method to select application assets."},"ApplicationBuilderStartSection":{"enum":["code","run"],"type":"string","description":"Identifies the functional section to which the asset selection applies."},"ApplicationAssetSelectionFilter":{"anyOf":[{"$ref":"#/components/schemas/ManualAndRunCriteriaApplicationAssetSelectionFilter"},{"$ref":"#/components/schemas/ApplicationAssetSelectionFilterValues"},{"type":"string"}],"description":"Defines filter criteria to dynamically select application assets. This field supports one of the supported application asset selection filter types.","title":"Application Asset Selection Filter"},"ManualAndRunCriteriaApplicationAssetSelectionFilter":{"additionalProperties":false,"type":"object","title":"Manual and Run Criteria Application Asset Selection Filter","required":["values","filterType"],"properties":{"values":{"type":"array","description":"If the filterType is `REPOSITORY`, enter the repository ID as the value. \nIf the filterType is `ORGANIZATION`, enter the organization URL of the provider.","items":{"type":"string"}},"provider":{"$ref":"#/components/schemas/Provider"},"filterType":{"$ref":"#/components/schemas/FilterType"}}},"Provider":{"anyOf":[{"$ref":"#/components/schemas/BuildProvider"},{"$ref":"#/components/schemas/CodeProvider"},{"$ref":"#/components/schemas/RunProvider"},{"$ref":"#/components/schemas/DeployProvider"}]},"BuildProvider":{"enum":["CIRCLE_CI","JENKINS","GITLAB_CI","AZURE_PIPELINES","GITHUB_ACTIONS"],"type":"string","description":"Build system or CI provider used for the asset. **Allowed values:** `CIRCLE_CI` `JENKINS` `GITLAB_CI` `AZURE_PIPELINES` `GITHUB_ACTIONS`","title":"Build Provider"},"CodeProvider":{"enum":["GITLAB","GITHUB","BITBUCKET","AZURE_REPOS","AWS_CODE_COMMIT"],"type":"string","description":"Source code management (SCM) or code hosting provider.\n**Allowed values**: `GITLAB`, `GITHUB`, `BITBUCKET`, `AZURE_REPOS`, `AWS_CODE_COMMIT`","title":"Code Provider"},"RunProvider":{"enum":["GCP","AWS","AZURE"],"type":"string","description":"Runtime or execution environment provider for the application or asset. **Allowed Values**: `GCP`, `AWS`, `AZURE`","title":"Run Provider"},"DeployProvider":{"enum":["ACR","ECR","GAR","JFrog","Docker"],"type":"string","description":"Deployment platform or system used to deploy the application or asset. **Allowed values:** `ACR` `ECR` `GAR` `JFrog` `Docker`","title":"Deploy Provider"},"FilterType":{"anyOf":[{"$ref":"#/components/schemas/CodeFilterType"},{"$ref":"#/components/schemas/RunFilterType"}],"description":"The asset attribute used to filter assets from the selected provider."},"CodeFilterType":{"enum":["REPOSITORY","ORGANIZATION","CODE"],"type":"string","title":"Code Filter Type","description":"Specifies the available values for the code type filter."},"RunFilterType":{"enum":["K8S_NAMESPACE","K8S_CLUSTER","ORGANIZATION","RESOURCE_TAG","VPC","ACCOUNT"],"type":"string","title":"Run Type Filter","description":"Specifies the available values for the run type filter."},"ApplicationAssetSelectionFilterValues":{"type":"object","title":"Application Asset Selection Filter Values","description":"Defines the set of values used to evaluate the asset selection filter.","required":["values"],"properties":{"values":{"type":"object","description":"Container for filter values used to match application assets.","properties":{"orgUrl":{"type":"string","description":"Organization URL used to filter assets belonging to a specific organization."},"repositoryId":{"type":"string","description":"Unique identifier of the repository used to filter assets."},"projectUrl":{"type":"string","description":"Project URL used to filter assets belonging to a specific project."},"orgUnifyFilter":{"type":"object","description":"Defines unification rules applied at the organization level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the organization used for asset unification."}}},"projectUnifyFilter":{"type":"object","description":"Defines unification rules applied at the project level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the project used for asset unification."}}},"repositoryUnifyFilter":{"type":"object","description":"Defines unification rules applied at the repository level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the repository used for asset unification."}}}}},"filterType":{"$ref":"#/components/schemas/FilterType"}}}}}}
```
## Get an application
> Retrieves detailed information for a specific application asset using its unique ID.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}":{"get":{"operationId":"GetApplication","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExtendedFields"}}}}},"parameters":[{"in":"path","name":"applicationId","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"summary":"Get an application","tags":["Applications"],"description":"Retrieves detailed information for a specific application asset using its unique ID.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.\n"}}},"components":{"schemas":{"ExtendedFields":{"type":"object","additionalProperties":false,"description":"Exposure attributes associated with the asset.","required":["creationType","config"],"properties":{"criteriaId":{"type":"string","description":"A unique identifier of the criteria."},"criteriaName":{"type":"string","description":"Name of the criteria."},"risk":{"type":"number","format":"double","description":"Calculated risk score associated with the criteria or asset."},"id":{"type":"string","description":"Unique identifier of the resource."},"strongId":{"type":"string","description":"Globally unique, immutable identifier for the resource."},"name":{"type":"string","description":"Name of the application asset."},"description":{"type":"string","description":"Description providing additional details about the asset."},"exposures":{"type":"array","items":{"$ref":"#/components/schemas/Exposures"}},"coverage":{"type":"number","format":"double","description":"Represents the level of coverage applied to the asset."},"businessCriticality":{"$ref":"#/components/schemas/BusinessCriticality"},"businessUnit":{"type":"string","description":"Business unit responsible for the asset."},"creationType":{"$ref":"#/components/schemas/CreationType"},"businessOwner":{"type":"array","description":"Business owners responsible for the asset.","items":{"type":"string"}},"devOwner":{"type":"array","description":"Development owners responsible for building and maintaining the asset.","items":{"type":"string"}},"devOpsOwner":{"type":"array","description":"DevOps owners responsible for deployment and operations.","items":{"type":"string"}},"productManager":{"type":"array","description":"Product managers responsible for the asset.","items":{"type":"string"}},"dataGovernance":{"$ref":"#/components/schemas/DataGovernance"},"compliance":{"$ref":"#/components/schemas/Compliance"},"environments":{"type":"string","description":"Environment in which the asset is deployed (for example, development, staging, or production)."},"assetsCount":{"type":"number","format":"double","description":"Total number of assets included in the response."},"config":{"type":"object","description":"Configuration settings associated with the application.","required":["assetSelection"],"properties":{"lastRefreshDate":{"type":"string","format":"date-time","description":"Date and time when the application data was last refreshed."},"assetSelection":{"$ref":"#/components/schemas/ApplicationAssetSelection"}}},"updatedAt":{"type":"string","format":"date-time","description":"Date and time when the configuration was last updated."},"deletedAt":{"type":"string","format":"date-time","description":"Date and time when the configuration was deleted."},"enrichStatus":{"$ref":"#/components/schemas/ApplicationEnrichStatus"},"unifyAcrossProviders":{"type":"boolean","description":"If multiple applications share the same name at the chosen group-by level (org, project, or repository), they are merged across providers to form a single unified application."},"unifyWithinProvider":{"type":"boolean","description":"Repositories with the same name at the selected group-by level (org, project, or repository) are consolidated into a single application within the selected provider."}}},"Exposures":{"enum":["DeployedToProduction","SensitiveData","ExternalAccessible"],"type":"string","description":"Represents the risks the system identifies on assets.","title":"Exposures"},"BusinessCriticality":{"enum":["Critical","High","Medium","Low"],"type":"string","description":"The operational importance of the asset."},"CreationType":{"enum":["Auto","Manual"],"type":"string","description":"Defines how the application asset is created."},"DataGovernance":{"enum":["PII","PCI","Financial","PHI","Sensitive"],"type":"string","description":"Type of data governance applied to the asset."},"Compliance":{"enum":["PCI-DSS","ISO 27001","SOX","NIST","GDPR","CCPA","HIPAA","FedRAMP"],"type":"string","description":"The compliance status or requirement category for an asset."},"ApplicationAssetSelection":{"type":"object","additionalProperties":false,"description":"Define the logic for how specific technical assets must be linked to this application.","required":["selectionType","section"],"properties":{"selectionType":{"$ref":"#/components/schemas/ApplicationAssetSelectionType"},"section":{"$ref":"#/components/schemas/ApplicationBuilderStartSection"},"filter":{"$ref":"#/components/schemas/ApplicationAssetSelectionFilter"},"assetIds":{"type":"array","description":"A list of unique identifiers representing the assets to be included.","items":{"type":"string"}}},"title":"Application Asset Selection"},"ApplicationAssetSelectionType":{"enum":["filter","assetIds"],"type":"string","description":"Method to select application assets."},"ApplicationBuilderStartSection":{"enum":["code","run"],"type":"string","description":"Identifies the functional section to which the asset selection applies."},"ApplicationAssetSelectionFilter":{"anyOf":[{"$ref":"#/components/schemas/ManualAndRunCriteriaApplicationAssetSelectionFilter"},{"$ref":"#/components/schemas/ApplicationAssetSelectionFilterValues"},{"type":"string"}],"description":"Defines filter criteria to dynamically select application assets. This field supports one of the supported application asset selection filter types.","title":"Application Asset Selection Filter"},"ManualAndRunCriteriaApplicationAssetSelectionFilter":{"additionalProperties":false,"type":"object","title":"Manual and Run Criteria Application Asset Selection Filter","required":["values","filterType"],"properties":{"values":{"type":"array","description":"If the filterType is `REPOSITORY`, enter the repository ID as the value. \nIf the filterType is `ORGANIZATION`, enter the organization URL of the provider.","items":{"type":"string"}},"provider":{"$ref":"#/components/schemas/Provider"},"filterType":{"$ref":"#/components/schemas/FilterType"}}},"Provider":{"anyOf":[{"$ref":"#/components/schemas/BuildProvider"},{"$ref":"#/components/schemas/CodeProvider"},{"$ref":"#/components/schemas/RunProvider"},{"$ref":"#/components/schemas/DeployProvider"}]},"BuildProvider":{"enum":["CIRCLE_CI","JENKINS","GITLAB_CI","AZURE_PIPELINES","GITHUB_ACTIONS"],"type":"string","description":"Build system or CI provider used for the asset. **Allowed values:** `CIRCLE_CI` `JENKINS` `GITLAB_CI` `AZURE_PIPELINES` `GITHUB_ACTIONS`","title":"Build Provider"},"CodeProvider":{"enum":["GITLAB","GITHUB","BITBUCKET","AZURE_REPOS","AWS_CODE_COMMIT"],"type":"string","description":"Source code management (SCM) or code hosting provider.\n**Allowed values**: `GITLAB`, `GITHUB`, `BITBUCKET`, `AZURE_REPOS`, `AWS_CODE_COMMIT`","title":"Code Provider"},"RunProvider":{"enum":["GCP","AWS","AZURE"],"type":"string","description":"Runtime or execution environment provider for the application or asset. **Allowed Values**: `GCP`, `AWS`, `AZURE`","title":"Run Provider"},"DeployProvider":{"enum":["ACR","ECR","GAR","JFrog","Docker"],"type":"string","description":"Deployment platform or system used to deploy the application or asset. **Allowed values:** `ACR` `ECR` `GAR` `JFrog` `Docker`","title":"Deploy Provider"},"FilterType":{"anyOf":[{"$ref":"#/components/schemas/CodeFilterType"},{"$ref":"#/components/schemas/RunFilterType"}],"description":"The asset attribute used to filter assets from the selected provider."},"CodeFilterType":{"enum":["REPOSITORY","ORGANIZATION","CODE"],"type":"string","title":"Code Filter Type","description":"Specifies the available values for the code type filter."},"RunFilterType":{"enum":["K8S_NAMESPACE","K8S_CLUSTER","ORGANIZATION","RESOURCE_TAG","VPC","ACCOUNT"],"type":"string","title":"Run Type Filter","description":"Specifies the available values for the run type filter."},"ApplicationAssetSelectionFilterValues":{"type":"object","title":"Application Asset Selection Filter Values","description":"Defines the set of values used to evaluate the asset selection filter.","required":["values"],"properties":{"values":{"type":"object","description":"Container for filter values used to match application assets.","properties":{"orgUrl":{"type":"string","description":"Organization URL used to filter assets belonging to a specific organization."},"repositoryId":{"type":"string","description":"Unique identifier of the repository used to filter assets."},"projectUrl":{"type":"string","description":"Project URL used to filter assets belonging to a specific project."},"orgUnifyFilter":{"type":"object","description":"Defines unification rules applied at the organization level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the organization used for asset unification."}}},"projectUnifyFilter":{"type":"object","description":"Defines unification rules applied at the project level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the project used for asset unification."}}},"repositoryUnifyFilter":{"type":"object","description":"Defines unification rules applied at the repository level.","required":["providers","name"],"properties":{"providers":{"$ref":"#/components/schemas/Provider"},"name":{"type":"string","description":"Name of the repository used for asset unification."}}}}},"filterType":{"$ref":"#/components/schemas/FilterType"}}},"ApplicationEnrichStatus":{"enum":["IN_PROGRESS","NOT_IN_PROGRESS"],"type":"string","description":"Indicates whether asset enrichment is currently in progress."}}}}
```
## Update an application
> Updates the attributes of an existing application asset identified by its unique ID.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}":{"put":{"operationId":"UpdateApplication","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CrudResponse"}}}}},"parameters":[{"in":"path","name":"applicationId","required":true,"schema":{"type":"string"}},{"in":"header","name":"x-cas-trace-id","required":false,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateApplicationRequest"}}}},"summary":"Update an application","tags":["Applications"],"description":"Updates the attributes of an existing application asset identified by its unique ID.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.\n"}}},"components":{"schemas":{"CrudResponse":{"type":"object","additionalProperties":false,"required":["status"],"properties":{"status":{"type":"boolean","description":"Displays the status of the application.","default":true},"applicationId":{"type":"string","description":"Displays the Asset ID of the application."}}},"UpdateApplicationRequest":{"type":"object","additionalProperties":false,"properties":{"businessCriticality":{"type":"string","enum":["Critical","High","Medium","Low"],"description":"The operational importance of the asset."},"creationType":{"type":"string","enum":["Auto","Manual"],"description":"How the asset was created."},"businessUnit":{"type":"string","description":"Business unit responsible for the asset."},"description":{"type":"string","description":"Description providing additional details about the asset."},"compliance":{"$ref":"#/components/schemas/Compliance"},"businessOwner":{"type":"array","description":"Business owners responsible for the asset.","items":{"type":"string"}},"devOwner":{"type":"array","description":"Development owners responsible for building and maintaining the asset.","items":{"type":"string"}},"devOpsOwner":{"type":"array","description":"DevOps owners responsible for deployment and operations.","items":{"type":"string"}},"productManager":{"type":"array","description":"Product managers responsible for the asset.","items":{"type":"string"}}}},"Compliance":{"enum":["PCI-DSS","ISO 27001","SOX","NIST","GDPR","CCPA","HIPAA","FedRAMP"],"type":"string","description":"The compliance status or requirement category for an asset."}}}}
```
## Delete an application
> Deletes a specific application asset identified by its unique ID.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}":{"delete":{"operationId":"DeleteApplicationById","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"properties":{"message":{"type":"string"}},"required":["message"],"type":"object"}}}}},"parameters":[{"in":"path","name":"applicationId","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"summary":"Delete an application","tags":["Applications"],"description":"Deletes a specific application asset identified by its unique ID.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus."}}}}
```
## List addable assets
> Returns assets that can be added to the specified application. Use this endpoint to find assets that are not currently associated with the application and manually add them to improve the application's asset inventory. Use the optional \`filter\` parameter to return specific subsets of assets, such as orphan assets, recently discovered assets, or assets with shared contributors. Results are paginated, with pages starting at \`1\`.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}/assets/addable":{"get":{"operationId":"GetAddableAssets","summary":"List addable assets","description":"Returns assets that can be added to the specified application. Use this endpoint to find assets that are not currently associated with the application and manually add them to improve the application's asset inventory. Use the optional `filter` parameter to return specific subsets of assets, such as orphan assets, recently discovered assets, or assets with shared contributors. Results are paginated, with pages starting at `1`.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","parameters":[{"in":"path","name":"applicationId","required":true,"description":"The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.","schema":{"type":"string"}},{"in":"query","name":"page","required":false,"description":"The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.","schema":{"format":"double","type":"number","default":0}},{"in":"query","name":"pageSize","required":false,"description":"The number of assets to return on each page.","schema":{"format":"double","type":"number","default":100,"maximum":500}},{"in":"query","name":"filter","required":false,"description":"A predefined filter that limits the assets returned. Supported values:\n- `RecentlyDiscovered`: Returns assets ingested into UAI within the last 7 days.\n- `OrphanAssets`: Returns assets that are not associated with any application.\n- `SameContributors`: Returns assets whose contributors overlap with contributors of assets already associated with the application.","schema":{"$ref":"#/components/schemas/AddableAssetFilter"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"A paginated list of the assets that you can add to the application.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetManageableAssetsResponse"}}}}},"tags":["Applications"]}}},"components":{"schemas":{"AddableAssetFilter":{"type":"string","description":"A predefined shortcut that filters the assets that are available to add.\n- `RecentlyDiscovered` - Returns assets that were discovered recently.\n- `OrphanAssets` - Returns assets that are not associated with any application.\n- `SameContributors` - Returns assets that share contributors with the application.","enum":["RecentlyDiscovered","OrphanAssets","SameContributors"]},"GetManageableAssetsResponse":{"type":"object","description":"A paginated list of assets that you can add to or remove from the application.","additionalProperties":false,"properties":{"items":{"type":"array","description":"The assets on the current page.","items":{"$ref":"#/components/schemas/ManageableAsset"}},"currentPage":{"type":"number","format":"double","description":"The number of the current page. Pages are numbered starting at 1."},"totalPages":{"type":"number","format":"double","description":"The total number of pages that are available for the current page size."},"pageSize":{"type":"number","format":"double","description":"The number of assets that are returned on each page."},"totalItems":{"type":"number","format":"double","description":"The total number of assets that match the request."}}},"ManageableAsset":{"type":"object","description":"An asset that you can add to or remove from the application.","additionalProperties":false,"properties":{"assetId":{"type":"string","description":"The unique identifier of the asset. Use this value in the `assetIds` field when you add or remove assets."},"assetName":{"type":"string","description":"The display name of the asset, or `null` when the asset does not have a name."},"assetTypeCategory":{"type":"string","description":"The category of the asset type, such as `Certificate` or `Repository`."},"assetTypeId":{"type":"string","description":"The identifier of the asset type, such as `TLS_CERTIFICATE` or `GITHUB_REPOSITORY`."},"assetTypeClass":{"type":"string","description":"The class of the asset type, such as `Identity`, `Code`, or `Compute`."},"assetProvider":{"type":"string","description":"The provider that the asset belongs to, such as `AWS`, `GITHUB`, or `OTHER`."},"assetCloudRegion":{"type":"string","description":"The cloud region where the asset is located, such as `us-east-1`. The value is empty or `null` when a region does not apply to the asset."}}}}}}
```
## List removable assets
> Returns assets that can be removed from the specified application. Use this endpoint to identify assets that are currently associated with the application and are eligible for manual removal. Results are paginated, with pages starting at \`1\`.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}/assets/removable":{"get":{"operationId":"GetRemovableAssets","summary":"List removable assets","description":"Returns assets that can be removed from the specified application. Use this endpoint to identify assets that are currently associated with the application and are eligible for manual removal. Results are paginated, with pages starting at `1`.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","parameters":[{"in":"path","name":"applicationId","required":true,"description":"The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.","schema":{"type":"string"}},{"in":"query","name":"page","required":false,"description":"The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.","schema":{"format":"double","type":"number","default":0}},{"in":"query","name":"pageSize","required":false,"description":"The number of assets to return on each page.","schema":{"format":"double","type":"number","maximum":500,"default":100}},{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"responses":{"200":{"description":"A paginated list of the assets that you can remove from the application.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetManageableAssetsResponse"}}}}},"tags":["Applications"]}}},"components":{"schemas":{"GetManageableAssetsResponse":{"type":"object","description":"A paginated list of assets that you can add to or remove from the application.","additionalProperties":false,"properties":{"items":{"type":"array","description":"The assets on the current page.","items":{"$ref":"#/components/schemas/ManageableAsset"}},"currentPage":{"type":"number","format":"double","description":"The number of the current page. Pages are numbered starting at 1."},"totalPages":{"type":"number","format":"double","description":"The total number of pages that are available for the current page size."},"pageSize":{"type":"number","format":"double","description":"The number of assets that are returned on each page."},"totalItems":{"type":"number","format":"double","description":"The total number of assets that match the request."}}},"ManageableAsset":{"type":"object","description":"An asset that you can add to or remove from the application.","additionalProperties":false,"properties":{"assetId":{"type":"string","description":"The unique identifier of the asset. Use this value in the `assetIds` field when you add or remove assets."},"assetName":{"type":"string","description":"The display name of the asset, or `null` when the asset does not have a name."},"assetTypeCategory":{"type":"string","description":"The category of the asset type, such as `Certificate` or `Repository`."},"assetTypeId":{"type":"string","description":"The identifier of the asset type, such as `TLS_CERTIFICATE` or `GITHUB_REPOSITORY`."},"assetTypeClass":{"type":"string","description":"The class of the asset type, such as `Identity`, `Code`, or `Compute`."},"assetProvider":{"type":"string","description":"The provider that the asset belongs to, such as `AWS`, `GITHUB`, or `OTHER`."},"assetCloudRegion":{"type":"string","description":"The cloud region where the asset is located, such as `us-east-1`. The value is empty or `null` when a region does not apply to the asset."}}}}}}
```
## Add or remove assets
> Adds or removes assets from the specified application. Set the \`operation\` field to \`ADD\` to associate the specified assets with the application, or to \`REMOVE\` to disassociate them. Each request creates a single override action and returns an \`actionId\` that identifies the operation and all affected assets. You can use this \`actionId\` to undo the operation with \*\*Revert asset override action\*\*.\
> \
> To identify assets that can be added, use \*\*List addable assets\*\*. To identify assets that can be removed, use \*\*List removable assets\*\*.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}/assets/override":{"post":{"operationId":"OverrideAssets","summary":"Add or remove assets","description":"Adds or removes assets from the specified application. Set the `operation` field to `ADD` to associate the specified assets with the application, or to `REMOVE` to disassociate them. Each request creates a single override action and returns an `actionId` that identifies the operation and all affected assets. You can use this `actionId` to undo the operation with **Revert asset override action**.\n\nTo identify assets that can be added, use **List addable assets**. To identify assets that can be removed, use **List removable assets**.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","parameters":[{"in":"path","name":"applicationId","required":true,"description":"The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.","schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OverrideAssetsRequest"}}}},"responses":{"200":{"description":"The override action completed. The response includes the action identifier and the assets that were processed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OverrideAssetsResponse"}}}},"404":{"description":"The specified application was not found. This endpoint validates the `applicationId` and returns this error when no matching application exists.","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code or message"},"message":{"type":"string","description":"Detailed error message with resolution."}}}}}},"422":{"description":"The request failed validation. For example, the `operation` field is missing, the `operation` value is not one of `ADD` or `REMOVE`, or `assetIds` is empty.","content":{"application/json":{"schema":{"type":"object","properties":{"value":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code"},"message":{"type":"string","description":"Error message"},"details":{"type":"object","description":"Error details","properties":{"body.operation":{"type":"object","properties":{"message":{"type":"string"},"value":{"type":"string"}}}}}}}}}}}}},"tags":["Applications"]}}},"components":{"schemas":{"OverrideAssetsRequest":{"type":"object","description":"The assets to add or remove and the operation to apply.","properties":{"assetIds":{"type":"array","description":"The unique identifiers of the assets to add or remove. To find assets that you can add, use List addable assets. To find assets that you can remove, use List removable assets.","items":{"type":"string"}},"operation":{"description":"The override operation to apply to the specified assets.","$ref":"#/components/schemas/OperationType"},"filter":{"type":"string","description":"An optional filter expression that is stored with the override action, such as `assetProvider=AWS`. The `assetIds` field is always required, even when you provide a filter. The filter is recorded with the action and is returned in the `filter` field of List override actions."}},"required":["assetIds","operation"],"additionalProperties":false},"OperationType":{"type":"string","description":"The type of override operation to apply to the specified assets.\n- `ADD` - Adds the assets to the application.\n- `REMOVE` - Removes the assets from the application.","enum":["ADD","REMOVE"]},"OverrideAssetsResponse":{"type":"object","description":"The result of an add or remove override operation.","additionalProperties":false,"properties":{"success":{"type":"boolean","description":"Indicates whether the override operation completed successfully."},"actionId":{"type":"string","description":"The unique identifier of the override action. Use this value to revert the action with Revert overrides by action ID."},"processed":{"type":"array","description":"The unique identifiers of the assets that the operation processed successfully.","items":{"type":"string"}},"failed":{"type":"array","description":"The assets that the operation failed to process, together with the reason for each failure.","items":{"type":"object","properties":{"reason":{"type":"string","description":"The reason that the asset failed to process."},"assetId":{"type":"string","description":"The unique identifier of the asset that failed to process."}}}}}}}}}
```
## List override actions
> Returns the history of manual asset override actions for the specified application. Each entry represents a single add or remove action and includes the affected assets, the operation, the user who performed it, and the timestamp when it was created. Results are paginated, with pages starting at 1.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}/assets/overrides":{"get":{"operationId":"GetOverrides","summary":"List override actions","description":"Returns the history of manual asset override actions for the specified application. Each entry represents a single add or remove action and includes the affected assets, the operation, the user who performed it, and the timestamp when it was created. Results are paginated, with pages starting at 1.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","parameters":[{"in":"path","name":"applicationId","required":true,"description":"The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.","schema":{"type":"string"}},{"in":"query","name":"page","required":false,"description":"The page number to return. Pages are numbered starting at 1. If you omit this parameter, the first page is returned.","schema":{"format":"double","type":"number","default":0}},{"in":"query","name":"pageSize","required":false,"description":"The number of override actions to return on each page.","schema":{"format":"double","type":"number","default":100,"maximum":500}},{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"responses":{"200":{"description":"A paginated list of the override actions that were applied to the application.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BasicPaginatedResponse_ApplicationAssetOverrideResponse-Array_"}}}}},"tags":["Applications"]}}},"components":{"schemas":{"BasicPaginatedResponse_ApplicationAssetOverrideResponse-Array_":{"type":"object","description":"A paginated list of override actions that were applied to the application.","additionalProperties":false,"properties":{"data":{"type":"array","description":"The override actions on the current page.","items":{"$ref":"#/components/schemas/ApplicationAssetOverrideResponse"}},"hasNext":{"type":"boolean","description":"Indicates whether more pages of results are available. When the value is `true`, request the next page to retrieve additional results."}}},"ApplicationAssetOverrideResponse":{"type":"object","description":"A single override action that was applied to the application.","additionalProperties":false,"properties":{"actionId":{"type":"string","description":"The unique identifier of the override action. Use this value to revert the action with Revert overrides by action ID."},"assetIds":{"type":"array","description":"The unique identifiers of the assets that the override action affected.","items":{"type":"string"}},"operationType":{"$ref":"#/components/schemas/OperationType"},"userEmail":{"type":"string","description":"The email address of the user who performed the override action. When an API token performs the action, this value identifies the token."},"filter":{"type":"string","description":"The filter expression that was used to select the assets, or `null` if the action did not use a filter.","nullable":true},"createdAt":{"type":"string","description":"The date and time when the override action was created, in ISO 8601 format."}}},"OperationType":{"type":"string","description":"The type of override operation to apply to the specified assets.\n- `ADD` - Adds the assets to the application.\n- `REMOVE` - Removes the assets from the application.","enum":["ADD","REMOVE"]}}}}
```
## Revert asset override action
> Reverts a manual asset override action by its \`actionId\`. Reverting an action undoes the add or remove operation for all assets affected by that override action. To find the \`actionId\`, use the value returned by \*\*Add or remove assets\*\* or the \`actionId\` value from \*\*List override actions\*\*.\
> \
> \> #### Required license:\
> \>\
> \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Applications","description":"APIs for managing applications"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/application/{applicationId}/assets/overrides/{actionId}":{"delete":{"operationId":"RevertOverrides","summary":"Revert asset override action","description":"Reverts a manual asset override action by its `actionId`. Reverting an action undoes the add or remove operation for all assets affected by that override action. To find the `actionId`, use the value returned by **Add or remove assets** or the `actionId` value from **List override actions**.\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","parameters":[{"in":"path","name":"applicationId","required":true,"description":"The unique identifier of the application. Use the `id` field from the response of the Get applications endpoint. This value is the SHA-style identifier.","schema":{"type":"string"}},{"in":"path","name":"actionId","required":true,"description":"The unique identifier of the override action to revert. Retrieve this value from the `actionId` field in the response of Add or remove assets or List override actions.","schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"The override action was reverted. The response lists the assets whose override was undone.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevertOverridesResponse"}}}},"404":{"description":"The resource was not found. This endpoint returns this error when the specified application does not exist, or when no override action matches the specified action identifier in the application.","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code or message"},"message":{"type":"string","description":"Detailed error message."}}}}}}},"tags":["Applications"]}}},"components":{"schemas":{"RevertOverridesResponse":{"type":"object","description":"The result of a revert operation.","additionalProperties":false,"properties":{"success":{"type":"boolean","description":"Indicates whether the revert operation completed successfully."},"reverted":{"type":"array","description":"The unique identifiers of the assets whose override was reverted.","items":{"type":"string"}}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/applications.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.