> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/data-sources.md). # Data Sources APIs for managing integrations ## Get all Data Sources > Retrieve a list of all data source instances configured in your Cortex environment. You can filter the results by data source type and category.\ > \ > \> \*\*Required license:\*\* \ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus. ```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/data_source_instances":{"get":{"tags":["Data Sources"],"summary":"Get all Data Sources","description":"Retrieve a list of all data source instances configured in your Cortex environment. You can filter the results by data source type and category.\n\n> **Required license:** \n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","operationId":"GetDataSourceInstances","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"type","in":"query","description":"Type of data source instance to retrieve.","required":false,"schema":{"$ref":"#/components/schemas/UrlIntegrationType"}},{"name":"type_category","in":"query","description":"Category of data source instances to retrieve.","required":false,"schema":{"$ref":"#/components/schemas/UrlIntegrationTypeCategory"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/Integration"},{"type":"object","required":["repositoriesCount"],"properties":{"repositoriesCount":{"type":"number","format":"double","description":"Total number of repositories associated with this data source instance."}}}]}}}}}}}}},"components":{"schemas":{"UrlIntegrationType":{"enum":["github","github-enterprise","gitlab","gitlab-self-managed","azure-repos","cortex-cli","bitbucket","bitbucket-datacenter","aws-code-commit","hcp-tfc-run-tasks","hcp-tfe-run-tasks","sonar-qube","veracode","semgrep","circle-ci-cd","jenkins-server","aws-code-build","circle-ci","github-actions","jenkins","collector","snyk","jfrog"],"type":"string"},"UrlIntegrationTypeCategory":{"type":"string","enum":["external-vendor-integrations","vcs-integrations","ci-cd-scanning-integrations","cli-integrations"]},"Integration":{"type":"object","title":"Integration","description":"Integration details","additionalProperties":false,"required":["creationDate","id","lastUpdateDate","type"],"properties":{"creationDate":{"type":"string","description":"Date and time when the data source instance was created."},"domain":{"$ref":"#/components/schemas/IntegrationDomain"},"id":{"type":"string","description":"Unique identifier (ID) of the data source instance."},"instanceVersion":{"type":"string","description":"Version of the data source instance configuration."},"lastUpdateDate":{"type":"string","description":"Date and time when the data source instance was last updated."},"scanTypes":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/scanType"}},"selectionType":{"$ref":"#/components/schemas/SelectionType"},"selfSignedCertificate":{"type":"string","description":"PEM-encoded self-signed certificate used for secure communication with the data source."},"state":{"type":"array","description":"Integration state","items":{"type":"string"}},"statusDetails":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/IntegrationStatusDetails"}},"tenantId":{"type":"string","description":"Tenant ID that owns this data source instance."},"transporter":{"$ref":"#/components/schemas/Transporter"},"type":{"$ref":"#/components/schemas/IntegrationType"},"typeCategory":{"$ref":"#/components/schemas/TypeCategory"},"uniqueIdentifier":{"type":"string","description":"Unique identifier of the integration"}}},"IntegrationDomain":{"type":"object","title":"IntegrationDomain","description":"Domain configuration specifying the hostname and protocol for the data source instance","additionalProperties":false,"required":["hostname","protocol"],"properties":{"hostname":{"type":"string","description":"Hostname or domain name of the external data source."},"protocol":{"$ref":"#/components/schemas/IntegrationProtocol"}}},"IntegrationProtocol":{"type":"string","enum":["http","https"],"title":"IntegrationProtocol","description":"Communication protocol used to connect to the data source."},"scanType":{"type":"object","additionalProperties":false,"description":"Configuration for a specific scan type within a data source instance.","required":["isEnabled"],"properties":{"isEnabled":{"type":"boolean","description":"Indicates whether this scan type is enabled for the data source instance."}}},"SelectionType":{"type":"string","enum":["CURRENT_STATE","CURRENT_STATE_AND_FUTURE","CURRENT_STATE_PENDING","MANUAL_SELECTION"],"description":"Defines how repositories are selected for scanning within a data source instance."},"IntegrationStatusDetails":{"description":"Detailed status information for a specific component of the data source instance.","properties":{"error":{"type":"string","description":"Error code or identifier if the component is in an error state."},"message":{"type":"string","description":"Human-readable message providing additional context about the status."},"status":{"$ref":"#/components/schemas/StatusValue"},"timestamp":{"type":"string","description":"ISO 8601 timestamp indicating when the status was last evaluated."}},"required":["status"],"type":"object","additionalProperties":false},"StatusValue":{"type":"string","enum":["INVALID","VALID"]},"Transporter":{"description":"Transporter configuration for establishing secure communication between an on-premises or private data source and Cortex.","properties":{"brokerDeviceId":{"type":"string","description":"Unique identifier of the broker device used for the transporter connection."},"connectionName":{"type":"string","description":"Name of the transporter connection."}},"required":["brokerDeviceId","connectionName"],"type":"object","additionalProperties":false},"IntegrationType":{"type":"string","enum":["COLLECTOR"],"title":"IntegrationType","description":"Type of the data source instance, indicating the external system it connects to. "},"TypeCategory":{"type":"string","description":"Category classification of the data source instance type.\n- `DEFAULT` — Standard data source instances such as VCS, CI/CD, and CLI integrations.\n- `EXTERNAL_VENDOR_INTEGRATIONS` — Third-party external vendor integrations.","enum":["DEFAULT","EXTERNAL_VENDOR_INTEGRATIONS"]}}}} ``` ## Create AppSec Data Sources > Create a new data source instance to connect an external system to your Cortex environment.\ > \ > \> \*\*Required license:\*\* \ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus. ```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/data_source_instances":{"post":{"operationId":"CreateDataSourceInstance","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"422":{"description":"Validation error.","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code identifying the type of validation failure."},"message":{"type":"string","description":"Human-readable message describing the validation error."},"details":{"type":"object","description":"Detailed validation error information, keyed by field path.","additionalProperties":{"type":"object","properties":{"message":{"type":"string"}}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateIntegrationBody"}}}},"summary":"Create AppSec Data Sources","tags":["Data Sources"],"description":"Create a new data source instance to connect an external system to your Cortex environment.\n\n> **Required license:** \n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus."}}},"components":{"schemas":{"Integration":{"type":"object","title":"Integration","description":"Integration details","additionalProperties":false,"required":["creationDate","id","lastUpdateDate","type"],"properties":{"creationDate":{"type":"string","description":"Date and time when the data source instance was created."},"domain":{"$ref":"#/components/schemas/IntegrationDomain"},"id":{"type":"string","description":"Unique identifier (ID) of the data source instance."},"instanceVersion":{"type":"string","description":"Version of the data source instance configuration."},"lastUpdateDate":{"type":"string","description":"Date and time when the data source instance was last updated."},"scanTypes":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/scanType"}},"selectionType":{"$ref":"#/components/schemas/SelectionType"},"selfSignedCertificate":{"type":"string","description":"PEM-encoded self-signed certificate used for secure communication with the data source."},"state":{"type":"array","description":"Integration state","items":{"type":"string"}},"statusDetails":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/IntegrationStatusDetails"}},"tenantId":{"type":"string","description":"Tenant ID that owns this data source instance."},"transporter":{"$ref":"#/components/schemas/Transporter"},"type":{"$ref":"#/components/schemas/IntegrationType"},"typeCategory":{"$ref":"#/components/schemas/TypeCategory"},"uniqueIdentifier":{"type":"string","description":"Unique identifier of the integration"}}},"IntegrationDomain":{"type":"object","title":"IntegrationDomain","description":"Domain configuration specifying the hostname and protocol for the data source instance","additionalProperties":false,"required":["hostname","protocol"],"properties":{"hostname":{"type":"string","description":"Hostname or domain name of the external data source."},"protocol":{"$ref":"#/components/schemas/IntegrationProtocol"}}},"IntegrationProtocol":{"type":"string","enum":["http","https"],"title":"IntegrationProtocol","description":"Communication protocol used to connect to the data source."},"scanType":{"type":"object","additionalProperties":false,"description":"Configuration for a specific scan type within a data source instance.","required":["isEnabled"],"properties":{"isEnabled":{"type":"boolean","description":"Indicates whether this scan type is enabled for the data source instance."}}},"SelectionType":{"type":"string","enum":["CURRENT_STATE","CURRENT_STATE_AND_FUTURE","CURRENT_STATE_PENDING","MANUAL_SELECTION"],"description":"Defines how repositories are selected for scanning within a data source instance."},"IntegrationStatusDetails":{"description":"Detailed status information for a specific component of the data source instance.","properties":{"error":{"type":"string","description":"Error code or identifier if the component is in an error state."},"message":{"type":"string","description":"Human-readable message providing additional context about the status."},"status":{"$ref":"#/components/schemas/StatusValue"},"timestamp":{"type":"string","description":"ISO 8601 timestamp indicating when the status was last evaluated."}},"required":["status"],"type":"object","additionalProperties":false},"StatusValue":{"type":"string","enum":["INVALID","VALID"]},"Transporter":{"description":"Transporter configuration for establishing secure communication between an on-premises or private data source and Cortex.","properties":{"brokerDeviceId":{"type":"string","description":"Unique identifier of the broker device used for the transporter connection."},"connectionName":{"type":"string","description":"Name of the transporter connection."}},"required":["brokerDeviceId","connectionName"],"type":"object","additionalProperties":false},"IntegrationType":{"type":"string","enum":["COLLECTOR"],"title":"IntegrationType","description":"Type of the data source instance, indicating the external system it connects to. "},"TypeCategory":{"type":"string","description":"Category classification of the data source instance type.\n- `DEFAULT` — Standard data source instances such as VCS, CI/CD, and CLI integrations.\n- `EXTERNAL_VENDOR_INTEGRATIONS` — Third-party external vendor integrations.","enum":["DEFAULT","EXTERNAL_VENDOR_INTEGRATIONS"]},"CreateIntegrationBody":{"type":"object","description":"Define the integration configuration","additionalProperties":false,"required":["type"],"properties":{"type":{"$ref":"#/components/schemas/IntegrationType"},"domain":{"$ref":"#/components/schemas/IntegrationDomain"},"credentials":{"$ref":"#/components/schemas/Partial_IntegrationCredentials_"},"uniqueProperties":{"$ref":"#/components/schemas/Record_string.unknown_"},"status":{"$ref":"#/components/schemas/IntegrationStatus"},"transporter":{"$ref":"#/components/schemas/Transporter"},"selfSignedCertificate":{"type":"string","description":"PEM-encoded self-signed certificate for secure communication."}}},"Partial_IntegrationCredentials_":{"type":"object","description":"Authentication credentials required to connect to the external data source. All properties are optional to support different authentication methods.","properties":{"type":{"$ref":"#/components/schemas/IntegrationCredentialsType"},"token":{"type":"string","description":"Authentication token, such as a personal access token (PAT), used to authenticate with the data source."},"refreshToken":{"type":"string","description":"Refresh token used to obtain a new authentication token when the current one expires."},"clientId":{"type":"string","description":"Client ID for OAuth-based authentication with the data source."},"clientSecret":{"type":"string","description":"Client secret for OAuth-based authentication with the data source."},"username":{"type":"string","description":"Username for basic authentication with the data source."},"password":{"type":"string","description":"Password for basic authentication with the data source."},"webhookAuthKeyId":{"type":"string","description":"Webhook authentication key ID used for webhook-based integrations."},"webhookAuthKey":{"type":"string","description":"Authentication key used to validate incoming webhook requests from the data source."}}},"IntegrationCredentialsType":{"type":"string","enum":["OAUTH","PAT"],"description":"Type of authentication method used for the data source connection."},"Record_string.unknown_":{"type":"object","description":"A flexible key-value map for specifying additional properties. Keys are strings and values can be of any type."},"IntegrationStatus":{"type":"string","enum":["COMPLETED","CONNECTED","DESTROYING","DISABLED","ERROR","PENDING","TEMPORARY","TRANSPORTER_CONNECTION_DISABLED","WARNING"],"title":"IntegrationStatus","description":"Current connection status of the data source instance.\n- `COMPLETED` — The data source instance setup is complete and operational.\n- `CONNECTED` — The data source instance is actively connected.\n- `DESTROYING` — The data source instance is being removed.\n- `DISABLED` — The data source instance is disabled and not actively scanning.\n- `ERROR` — The data source instance encountered an error and requires attention.\n- `PENDING` — The data source instance is being set up and is not yet active.\n- `TEMPORARY` — The data source instance is in a temporary state during configuration.\n- `TRANSPORTER_CONNECTION_DISABLED` — The transporter connection for this data source instance is disabled.\n- `WARNING` — The data source instance is operational but has warnings that may require attention."}}}} ``` ## Get an AppSec Data Source > Retrieve the details of a specific data source instance identified by its ID.\ > \ > \> \*\*Required license:\*\* \ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus. ```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/data_source_instances/{id}":{"get":{"tags":["Data Sources"],"summary":"Get an AppSec Data Source","description":"Retrieve the details of a specific data source instance identified by its ID.\n\n> **Required license:** \n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","operationId":"GetDataSourceInstance","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"id","in":"path","description":"Unique ID of the data source instance to retrieve. You can retrieve this value from the `id` field in the response of [Get all Data Sources](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/data-sources#get-public_api-appsec-v1-data_source_instances) or [Create Appsec Data Sources](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/data-sources#post-public_api-appsec-v1-data_source_instances) endpoint.","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code identifying the type of error."},"message":{"type":"string","description":"Human-readable message describing the error."}}}}}}}}}},"components":{"schemas":{"Integration":{"type":"object","title":"Integration","description":"Integration details","additionalProperties":false,"required":["creationDate","id","lastUpdateDate","type"],"properties":{"creationDate":{"type":"string","description":"Date and time when the data source instance was created."},"domain":{"$ref":"#/components/schemas/IntegrationDomain"},"id":{"type":"string","description":"Unique identifier (ID) of the data source instance."},"instanceVersion":{"type":"string","description":"Version of the data source instance configuration."},"lastUpdateDate":{"type":"string","description":"Date and time when the data source instance was last updated."},"scanTypes":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/scanType"}},"selectionType":{"$ref":"#/components/schemas/SelectionType"},"selfSignedCertificate":{"type":"string","description":"PEM-encoded self-signed certificate used for secure communication with the data source."},"state":{"type":"array","description":"Integration state","items":{"type":"string"}},"statusDetails":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/IntegrationStatusDetails"}},"tenantId":{"type":"string","description":"Tenant ID that owns this data source instance."},"transporter":{"$ref":"#/components/schemas/Transporter"},"type":{"$ref":"#/components/schemas/IntegrationType"},"typeCategory":{"$ref":"#/components/schemas/TypeCategory"},"uniqueIdentifier":{"type":"string","description":"Unique identifier of the integration"}}},"IntegrationDomain":{"type":"object","title":"IntegrationDomain","description":"Domain configuration specifying the hostname and protocol for the data source instance","additionalProperties":false,"required":["hostname","protocol"],"properties":{"hostname":{"type":"string","description":"Hostname or domain name of the external data source."},"protocol":{"$ref":"#/components/schemas/IntegrationProtocol"}}},"IntegrationProtocol":{"type":"string","enum":["http","https"],"title":"IntegrationProtocol","description":"Communication protocol used to connect to the data source."},"scanType":{"type":"object","additionalProperties":false,"description":"Configuration for a specific scan type within a data source instance.","required":["isEnabled"],"properties":{"isEnabled":{"type":"boolean","description":"Indicates whether this scan type is enabled for the data source instance."}}},"SelectionType":{"type":"string","enum":["CURRENT_STATE","CURRENT_STATE_AND_FUTURE","CURRENT_STATE_PENDING","MANUAL_SELECTION"],"description":"Defines how repositories are selected for scanning within a data source instance."},"IntegrationStatusDetails":{"description":"Detailed status information for a specific component of the data source instance.","properties":{"error":{"type":"string","description":"Error code or identifier if the component is in an error state."},"message":{"type":"string","description":"Human-readable message providing additional context about the status."},"status":{"$ref":"#/components/schemas/StatusValue"},"timestamp":{"type":"string","description":"ISO 8601 timestamp indicating when the status was last evaluated."}},"required":["status"],"type":"object","additionalProperties":false},"StatusValue":{"type":"string","enum":["INVALID","VALID"]},"Transporter":{"description":"Transporter configuration for establishing secure communication between an on-premises or private data source and Cortex.","properties":{"brokerDeviceId":{"type":"string","description":"Unique identifier of the broker device used for the transporter connection."},"connectionName":{"type":"string","description":"Name of the transporter connection."}},"required":["brokerDeviceId","connectionName"],"type":"object","additionalProperties":false},"IntegrationType":{"type":"string","enum":["COLLECTOR"],"title":"IntegrationType","description":"Type of the data source instance, indicating the external system it connects to. "},"TypeCategory":{"type":"string","description":"Category classification of the data source instance type.\n- `DEFAULT` — Standard data source instances such as VCS, CI/CD, and CLI integrations.\n- `EXTERNAL_VENDOR_INTEGRATIONS` — Third-party external vendor integrations.","enum":["DEFAULT","EXTERNAL_VENDOR_INTEGRATIONS"]}}}} ``` ## Update an AppSec Data Source > Update the configuration of an existing data source instance.\ > \ > \> \*\*Required license:\*\* \ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus. ```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/data_source_instances/{id}":{"put":{"tags":["Data Sources"],"summary":"Update an AppSec Data Source","description":"Update the configuration of an existing data source instance.\n\n> **Required license:** \n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","operationId":"UpdateDataSourceInstance","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"id","in":"path","description":"Unique ID of the data source instance to update. You can retrieve this value from the `id` field in the response of [Get all Data Sources](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/data-sources#get-public_api-appsec-v1-data_source_instances) or [Create Appsec Data Sources](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/data-sources#post-public_api-appsec-v1-data_source_instances) endpoint.","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateIntegrationPublicBody"}}}},"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code identifying the type of error."},"message":{"type":"string","description":"Human-readable message describing the error."}}}}}}}}}},"components":{"schemas":{"UpdateIntegrationPublicBody":{"type":"object","title":"UpdateIntegrationPublicBody","description":"Define the integration details","additionalProperties":false,"properties":{"selectionType":{"$ref":"#/components/schemas/SelectionType"},"state":{"type":"array","description":"To update the integration for specific repositories, specify them here in the following format:\n\n`\"state\":\"[\"org1\"/\"repo_name1\", \"org2\"/\"repo_name2\"]`","items":{"type":"string"}},"externalProjects":{"type":"array","items":{"$ref":"#/components/schemas/ExternalProjectInput"}},"uniqueProperties":{"$ref":"#/components/schemas/Record_string.unknown_"}}},"SelectionType":{"type":"string","enum":["CURRENT_STATE","CURRENT_STATE_AND_FUTURE","CURRENT_STATE_PENDING","MANUAL_SELECTION"],"description":"Defines how repositories are selected for scanning within a data source instance."},"ExternalProjectInput":{"type":"object","additionalProperties":false,"properties":{"branchName":{"type":"string","nullable":true,"description":"Name of the branch"},"externalBranchName":{"type":"string","nullable":true,"description":"Name of the external branch"},"externalId":{"type":"string","description":"External ID"},"externalProjectId":{"type":"string","nullable":true,"description":"External project ID"},"repoId":{"type":"string","nullable":true,"description":"Repository ID"}},"required":["branchName","externalBranchName","externalId","externalProjectId","repoId"]},"Record_string.unknown_":{"type":"object","description":"A flexible key-value map for specifying additional properties. Keys are strings and values can be of any type."},"Integration":{"type":"object","title":"Integration","description":"Integration details","additionalProperties":false,"required":["creationDate","id","lastUpdateDate","type"],"properties":{"creationDate":{"type":"string","description":"Date and time when the data source instance was created."},"domain":{"$ref":"#/components/schemas/IntegrationDomain"},"id":{"type":"string","description":"Unique identifier (ID) of the data source instance."},"instanceVersion":{"type":"string","description":"Version of the data source instance configuration."},"lastUpdateDate":{"type":"string","description":"Date and time when the data source instance was last updated."},"scanTypes":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/scanType"}},"selectionType":{"$ref":"#/components/schemas/SelectionType"},"selfSignedCertificate":{"type":"string","description":"PEM-encoded self-signed certificate used for secure communication with the data source."},"state":{"type":"array","description":"Integration state","items":{"type":"string"}},"statusDetails":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/IntegrationStatusDetails"}},"tenantId":{"type":"string","description":"Tenant ID that owns this data source instance."},"transporter":{"$ref":"#/components/schemas/Transporter"},"type":{"$ref":"#/components/schemas/IntegrationType"},"typeCategory":{"$ref":"#/components/schemas/TypeCategory"},"uniqueIdentifier":{"type":"string","description":"Unique identifier of the integration"}}},"IntegrationDomain":{"type":"object","title":"IntegrationDomain","description":"Domain configuration specifying the hostname and protocol for the data source instance","additionalProperties":false,"required":["hostname","protocol"],"properties":{"hostname":{"type":"string","description":"Hostname or domain name of the external data source."},"protocol":{"$ref":"#/components/schemas/IntegrationProtocol"}}},"IntegrationProtocol":{"type":"string","enum":["http","https"],"title":"IntegrationProtocol","description":"Communication protocol used to connect to the data source."},"scanType":{"type":"object","additionalProperties":false,"description":"Configuration for a specific scan type within a data source instance.","required":["isEnabled"],"properties":{"isEnabled":{"type":"boolean","description":"Indicates whether this scan type is enabled for the data source instance."}}},"IntegrationStatusDetails":{"description":"Detailed status information for a specific component of the data source instance.","properties":{"error":{"type":"string","description":"Error code or identifier if the component is in an error state."},"message":{"type":"string","description":"Human-readable message providing additional context about the status."},"status":{"$ref":"#/components/schemas/StatusValue"},"timestamp":{"type":"string","description":"ISO 8601 timestamp indicating when the status was last evaluated."}},"required":["status"],"type":"object","additionalProperties":false},"StatusValue":{"type":"string","enum":["INVALID","VALID"]},"Transporter":{"description":"Transporter configuration for establishing secure communication between an on-premises or private data source and Cortex.","properties":{"brokerDeviceId":{"type":"string","description":"Unique identifier of the broker device used for the transporter connection."},"connectionName":{"type":"string","description":"Name of the transporter connection."}},"required":["brokerDeviceId","connectionName"],"type":"object","additionalProperties":false},"IntegrationType":{"type":"string","enum":["COLLECTOR"],"title":"IntegrationType","description":"Type of the data source instance, indicating the external system it connects to. "},"TypeCategory":{"type":"string","description":"Category classification of the data source instance type.\n- `DEFAULT` — Standard data source instances such as VCS, CI/CD, and CLI integrations.\n- `EXTERNAL_VENDOR_INTEGRATIONS` — Third-party external vendor integrations.","enum":["DEFAULT","EXTERNAL_VENDOR_INTEGRATIONS"]}}}} ``` ## Delete an AppSec Data Source > Delete the specified data source instance from your Cortex environment.\ > \ > \> \*\*Required license:\*\* \ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus. ```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/data_source_instances/{id}":{"delete":{"tags":["Data Sources"],"summary":"Delete an AppSec Data Source","description":"Delete the specified data source instance from your Cortex environment.\n\n> **Required license:** \n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.","operationId":"DeleteDataSourceInstance","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"id","description":"Unique ID of the data source instance to delete.","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No content"}}}}}} ``` ## 3rd Party AppSec Collector > Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. This endpoint is used specifically for ingesting scan results, not for creating or configuring a generic collector.\ > \ > The Collector API accepts scan results in SARIF v2.1.0 format. Once uploaded, the SARIF file is parsed to create code findings. These findings can then be elevated to issues, either manually or automatically, depending on your configured policies.\ > \ > \ > \> #### Required license:\ > \>\ > \> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.\ > \ > \### Prerequisites\ > 1\. \*\*Permissions\*\*: The following Cortex Cloud user roles or RBAC permissions are required:\ > \- \*\*User roles:\*\*\ > \- Cortex Cloud Instance Administrator\ > \- AppSec Administrator\ > \- \*\*RBAC:\*\*\ > \- \*\*View/Edit\*\* permissions for \*\*Data Sources\*\* configurations are required when not using a dedicated user role.\ > 2\. \*\*Repository Identification\*\*: The repository must already be onboarded in Cortex Cloud before SARIF findings for that repository can be uploaded. To identify the target repository, you must provide at least one of the following query parameters:\ > \- \`repository\_id\`— The repository asset ID. This is the \`id\` field (SHA-256 hash format) returned by the \[Get Repository Assets]\() endpoint.\ > \- \`repository\_url\` — The repository URL (for example, \` > \- Either \`repository\_id\` or \`repository\_url\` must be provided. Both can be provided simultaneously. If neither is provided, the request returns a 400 error.\ > 3\. \*\*SARIF specifications:\*\* The following table outlines the mandatory and optional JSON fields required to successfully validate and ingest SAST findings. \ > \ > Field | Required | Description\ > \---------|----------|---------\ > \`version\` | Yes | Must be "2.1.0"\ > \`tool.driver.name\` | Yes | Analysis tool name\ > \`driver.rules\` or \`extensions\[].rules\` | Yes | At least one rule definition\ > \`results\[].ruleId\`| Yes | Must match a defined rule \`id\`\ > \`results\[].message.text\`| Yes | Finding description\ > \`results\[].locations\[].physicalLocation.artifactLocation.uri\`| Yes | File path\ > \`results\[].locations\[].physicalLocation.region.startLine\` | Yes | Line number\ > \`results\[].level\`| Yes | \`error\` \\| \`warning\` \\| \`note\` \\| \`none\`. Defaults to \`High\`\ > \ > \ > \ > \### Limitations\ > \- \*\*Maximum file size\*\*: \*\*10 MB\*\* per request.\ > \- \*\*SARIF version\*\*: Only SARIF \*\*v2.1.0\*\* is supported. Files with invalid formats or schema will return a 400 error.
```json {"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Data Sources","description":"APIs for managing integrations"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/collectors/{collectorId}":{"post":{"summary":"3rd Party AppSec Collector","tags":["Data Sources"],"responses":{"201":{"description":"Returned when the SARIF file is accepted and the ingestion process has started.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Ingestion status.","type":"string","enum":["INGESTED","PARTIALLY_VALID"]},"message":{"type":"string","description":"Human-readable result message including the number of findings to be ingested."}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","description":"Error response for validation failures or bad requests.","properties":{"status":{"type":"string","description":"Status of the request (for example, `INVALID`, `INGESTED_FAILED`)."},"message":{"type":"string","description":"Human-readable error message."},"errorCode":{"type":"string","description":"Error code identifying the type of error."}}}}}},"403":{"description":"Forbidden\n\nThe API key lacks required permissions. Required role: Instance Admin, AppSec Admin, or Data Sources edit permission.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message."},"err_extra":{"type":"string"}}}}}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"Error code identifying the type of error."},"message":{"type":"string","description":"Human-readable error message."}}}}}},"503":{"description":"Service Unavailable. Returned when the collector is disabled."}},"operationId":"uploadSarifFindings","description":"Upload SAST findings from third-party security tools to Cortex Cloud Application Security using the Collector API. This endpoint is used specifically for ingesting scan results, not for creating or configuring a generic collector.\n\nThe Collector API accepts scan results in SARIF v2.1.0 format. Once uploaded, the SARIF file is parsed to create code findings. These findings can then be elevated to issues, either manually or automatically, depending on your configured policies.\n\n\n> #### Required license:\n>\n> Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on. Not supported in XSIAM Enterprise Plus.\n\n### Prerequisites\n1. **Permissions**: The following Cortex Cloud user roles or RBAC permissions are required:\n - **User roles:**\n - Cortex Cloud Instance Administrator\n - AppSec Administrator\n - **RBAC:**\n - **View/Edit** permissions for **Data Sources** configurations are required when not using a dedicated user role.\n2. **Repository Identification**: The repository must already be onboarded in Cortex Cloud before SARIF findings for that repository can be uploaded. To identify the target repository, you must provide at least one of the following query parameters:\n - `repository_id`— The repository asset ID. This is the `id` field (SHA-256 hash format) returned by the [Get Repository Assets](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/repositories#get-public_api-appsec-v1-repositories) endpoint.\n - `repository_url` — The repository URL (for example, `https://github.com/owner/repo`).\n - Either `repository_id` or `repository_url` must be provided. Both can be provided simultaneously. If neither is provided, the request returns a 400 error.\n3. **SARIF specifications:** The following table outlines the mandatory and optional JSON fields required to successfully validate and ingest SAST findings. \n\nField | Required | Description\n---------|----------|---------\n `version` | Yes | Must be \"2.1.0\"\n `tool.driver.name` | Yes | Analysis tool name\n `driver.rules` or `extensions[].rules` | Yes | At least one rule definition\n `results[].ruleId`| Yes | Must match a defined rule `id`\n `results[].message.text`| Yes | Finding description\n `results[].locations[].physicalLocation.artifactLocation.uri`| Yes | File path\n `results[].locations[].physicalLocation.region.startLine` | Yes | Line number\n `results[].level`| Yes | `error` \\| `warning` \\| `note` \\| `none`. Defaults to `High`\n\n\n\n### Limitations\n- **Maximum file size**: **10 MB** per request.\n- **SARIF version**: Only SARIF **v2.1.0** is supported. Files with invalid formats or schema will return a 400 error.\n","parameters":[{"schema":{"type":"string"},"in":"query","name":"repository_id","required":true,"description":"The asset ID of the target repository. This is the `id` field (SHA-256 hash format) returned by the [Get Repository Assets](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/aspm-cicd-and-application-security/repositories#get-public_api-appsec-v1-repositories) endpoint. At least one of `repository_url` or `repository_id` must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request."},{"schema":{"type":"string"},"in":"query","name":"repository_url","description":"The URL of the target repository. At least one of `repository_url` or `repository_id` must be provided. Both may be included. If neither is supplied, the request returns a 400 Bad Request.","required":true},{"schema":{"type":"string"},"in":"query","name":"branch","description":"Optional. Branch name to associate findings with. Defaults to the repository's default branch when omitted."},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{}}}},"description":"A SARIF v2.1.0 document that contains SAST scan results. The file must strictly adhere to the SARIF v2.1.0 specification. The maximum file size is 10 MB. For an example, see **Request sample**."}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/data-sources.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.