API workflow - Use the public API workflow to perform CRUD operations on collector instances and upload SARIF files. Validate SARIF files in the tenant console before upload. - Administrator Guide - Cortex Cloud Posture Management - Cortex CLOUD

Cortex Cloud Runtime Security Documentation

Product
Cortex Cloud Application Security > Cortex CLOUD
License
Cloud Runtime Security
Creation date
2024-12-24
Last date published
2026-06-10
Category
Administrator Guide
Abstract

Use the public API workflow to perform CRUD operations on collector instances and upload SARIF files. Validate SARIF files in the tenant console before upload.

The Collector can be managed and findings can be uploaded programmatically through the Cortex Cloud API. The API is the only channel for uploading SARIF findings to the platform.

The public API supports CRUD operations on collector instances through the /public_api/appsec/v1/data_source_instances endpoint and SARIF upload through the /public_api/appsec/v1/collectors/{collectorId} endpoint. SARIF validation is not available through the public API. Validate SARIF files through the tenant workflow before uploading.

When to use the API

Use the API for automated, recurring uploads from CI/CD pipelines and for programmatic management. Use the Cortex Cloud console for initial setup and one-time configuration.

Supported operations

Operation

Method

Endpoint

Description

Create collector

POST

/public_api/appsec/v1/data_source_instances

Create a new collector instance with the specified configuration. Returns the API URL and credentials. Must be used with type=collector

List collectors

GET

/public_api/appsec/v1/data_source_instances?type=collector

Retrieve all collector instances. Filter by type=collector to return only 3rd Party AppSec Collector instances

Get collector

GET

/public_api/appsec/v1/data_source_instances/{id}

Retrieve a specific collector instance by its unique identifier

Update collector

PUT

/public_api/appsec/v1/data_source_instances/{id}

Update an existing collector configuration

Delete collector

DELETE

/public_api/appsec/v1/data_source_instances/{id}

Delete a collector instance. Invalidates the associated API credentials

Upload findings

POST

/public_api/appsec/v1/collectors/{collectorId}

Upload a SARIF file to ingest findings. Accepts repository_id, repository_url, and branch as query parameters. Uses collector-specific credentials (Token ID + API Token). This is the only public endpoint for SARIF ingestion

Note

The apiUrl returned during collector creation resolves to the public upload endpoint at /public_api/appsec/v1/collectors/{collectorId}. Use the apiUrl value directly in upload requests.

Refer to the Cortex Cloud API documentation for more information about APIs.