API workflows for Code Security issues - Administrator Guide - Cortex Cloud Posture Management - Cortex CLOUD

Base URL: https://<your-tenant>.xdr.us.paloaltonetworks.com/public_api/appsec/v1

Replace <your-tenant> with your tenant identifier. The region-specific domain varies by deployment.

Authentication headers

Generate an API key pair from Settings → Configurations → API Keys in the Cortex Cloud console. The API key role must grant read access to scan results and application resources in the ASPM module.

All scan types follow the same two-step pattern: list scans with filters, then retrieve issues or findings by scanId.

Periodic scans

Periodic scans run every 12 hours against the default branch of your onboarded repositories. Use periodic scan issues for compliance reporting, posture trending, and remediation tracking.

Step 1: List periodic scans: GET /scans/periodic with filters for organization, repository, branch, scan health, and time range (days).

```bash
curl -X GET "https://<your-tenant>[.xdr.us.paloaltonetworks.com/public_api/appsec/v1/scans/periodic?organizationName=my-org&scanHealth=COMPLETED&days=7&limit=50](https://.xdr.us.paloaltonetworks.com/public_api/appsec/v1/scans/periodic?organizationName=my-org&scanHealth=COMPLETED&days=7&limit=50)" \
  -H "x-xdr-auth-id: <KEY_ID>" \
  -H "Authorization: <KEY_SECRET>"
```

Step 2 — Retrieve issues: GET /scans/{scanId}/issues with optional severity filter.

PR scans

PR scans execute when a pull request is opened or updated. PR scan results indicate whether prevention policies blocked the merge; the primary shift-left enforcement point.

Step 1 - List PR scans: GET /scans/pr with filters for organization, repository, branch, PR ID, PR status, and time range.

Step 2 - Retrieve issues from a blocked PR: Use the scanId from the PR scan result. Key response fields: pullRequestStatus (Blocked or Passed), blockingPoliciesNames, userEmail, commitId.

CI/CD scans

CI/CD scans execute during automated build pipelines. I blocking is the second enforcement point after PR scans.

Step 1 — List CI/CD scans: GET /scans/ci with filters for organization, repository, CI status, scan health, and time range.

Step 2 — Retrieve issues from a blocked build: Use the scanId from the CI scan result. Key response fields: ciStatus (Blocked or Passed), blockingPoliciesNames.

Raw findings provide scanner-level detail not available in issue records — git author attribution, suppression status, first/last observed timestamps, and scan source identification. Use findings for false positive investigation, suppression pattern analysis, and detailed forensics.

Endpoint: GET /scans/{scanId}/findings with optional severity filter.

```bash
curl -X GET "https://<your-tenant>[.xdr.us.paloaltonetworks.com/public_api/appsec/v1/scans/scan-a1b2c3d4/findings?severity=High&limit=100](https://.xdr.us.paloaltonetworks.com/public_api/appsec/v1/scans/scan-a1b2c3d4/findings?severity=High&limit=100)" \
  -H "x-xdr-auth-id: <KEY_ID>" \
  -H "Authorization: <KEY_SECRET>"
```

Key fields available in findings but not in issues: git_user, suppression_type, first_observed, last_observed, scan_source, first_hash, platform_id, data_source.

The issue endpoint (/scans/{scanId}/issues) does not support server-side filtering by issue type or detection method. To retrieve issues of a specific type (for example, all IaC misconfigurations), use the issuesTypesBreakdown field to pre-filter scans, then apply client-side filtering on detection_method.

Mapping issuesTypesBreakdown keys to detection_method values

To filter the results in Step 4, use the table below to match each issuesTypesBreakdown key with its corresponding detection_method value. This mapping lets you isolate the relevant scan results.

All Code Security detection_method values:

Application issue summaries provide issue counts by severity for a specific application and issue type, without iterating through individual scans. Use for executive dashboards and application-level posture monitoring.

Endpoint: GET /public_api/appsec/v1/application/{applicationId}/issues/{issueType}/summary.

Supported issue types: