Containers

Add a container image

Verify image-read access and track an image repository. Strix discovers and stores an available tag, digest, and platform without starting a scan. Google Artifact Registry supplies upload times to select the newest tagged version. Other registries use an existing latest tag or a sole tag. Unordered multiple tags require an explicit choice. Set scan to true to start an initial scan with the detected or explicit version. Initial scans and explicit versions must fit the compressed size limit. The default limit is 8 GiB. Self-hosted installs can change it with STRIX_CONTAINER_MAX_IMAGE_BYTES. Existing images return created false and status 200. Session callers need the admin or analyst role without asset scopes. The organization must have container scanning access.

POST

containers

images

Error

A valid request URL is required to generate request examples

{
  "image": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "registry_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "latest_tag": "<string>",
    "latest_digest": "<string>",
    "platform": "<string>",
    "linked_repository_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "linked_repository_name": "<string>",
    "last_scan_at": "2023-11-07T05:31:56Z",
    "last_scan_status": "queued",
    "findings": {
      "critical": 123,
      "high": 123,
      "medium": 123,
      "low": 123,
      "total": 123
    },
    "reachable_count": 123,
    "secret_count": 123,
    "misconfiguration_count": 123,
    "deployed": true,
    "watch_tags": "<string>"
  },
  "created": true,
  "resolved": {
    "tag": "<string>",
    "digest": "<string>",
    "platform": "<string>"
  },
  "scan": {
    "image_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  },
  "scan_error": "<string>"
}

{
  "image": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "registry_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "latest_tag": "<string>",
    "latest_digest": "<string>",
    "platform": "<string>",
    "linked_repository_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "linked_repository_name": "<string>",
    "last_scan_at": "2023-11-07T05:31:56Z",
    "last_scan_status": "queued",
    "findings": {
      "critical": 123,
      "high": 123,
      "medium": 123,
      "low": 123,
      "total": 123
    },
    "reachable_count": 123,
    "secret_count": 123,
    "misconfiguration_count": 123,
    "deployed": true,
    "watch_tags": "<string>"
  },
  "created": true,
  "resolved": {
    "tag": "<string>",
    "digest": "<string>",
    "platform": "<string>"
  },
  "scan": {
    "image_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  },
  "scan_error": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

Authorizations

Authorization

string

header

required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Scopes

containers:write

Body

application/json

registry_id

string<uuid>

required

Connected registry that hosts the image. Connect a registry first, with or without credentials.

reference

string

required

Repository path without the registry host. Google Artifact Registry requires project-id/repository/image. Strix discovers an available version for a repository-only request. Add a tag or digest to override that selection, such as name:v1.2 or name@sha256:.

platform

string | null

OCI platform, for example linux/amd64. Null selects linux/amd64 if available, otherwise the first platform in the discovered or explicit image index. Without a discovered version, null stores linux/amd64. An explicit platform must exist in the image or the request fails with status 400. Later scans use the stored platform by default.

linked_repository_id

string<uuid> | null

Repository that builds this image. Strix shows the link on the image and uses it for remediation context.

watch_tags

string | null

Legacy image inclusion. Use * to include this image in the shared registry rule, or null to exclude it. A different pattern must match the registry's saved rule; otherwise the request fails. Configure the shared rule on the registry webhook endpoint.

scan

boolean

default:false

Start the first scan when the image is added. Use the detected version unless the reference specifies a tag or digest. Ambiguous versions require an explicit selection. Default false.

Response

The image was already tracked.

image

object

required

A tracked container image with counts from its latest completed scan.

Show child attributes

created

boolean

required

False when the image was already tracked.

resolved

object | null

required

Verified metadata for the discovered or explicit version. Null when no version is available or the registry cannot identify one version to use.

Show child attributes

scan

object | null

required

Show child attributes

scan_error

string | null

required

Reason the first scan did not start. Null when scan is set or the caller disabled the scan.

Error

A valid request URL is required to generate request examples

{
  "image": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "registry_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "latest_tag": "<string>",
    "latest_digest": "<string>",
    "platform": "<string>",
    "linked_repository_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "linked_repository_name": "<string>",
    "last_scan_at": "2023-11-07T05:31:56Z",
    "last_scan_status": "queued",
    "findings": {
      "critical": 123,
      "high": 123,
      "medium": 123,
      "low": 123,
      "total": 123
    },
    "reachable_count": 123,
    "secret_count": 123,
    "misconfiguration_count": 123,
    "deployed": true,
    "watch_tags": "<string>"
  },
  "created": true,
  "resolved": {
    "tag": "<string>",
    "digest": "<string>",
    "platform": "<string>"
  },
  "scan": {
    "image_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  },
  "scan_error": "<string>"
}

{
  "image": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "registry_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "latest_tag": "<string>",
    "latest_digest": "<string>",
    "platform": "<string>",
    "linked_repository_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "linked_repository_name": "<string>",
    "last_scan_at": "2023-11-07T05:31:56Z",
    "last_scan_status": "queued",
    "findings": {
      "critical": 123,
      "high": 123,
      "medium": 123,
      "low": 123,
      "total": 123
    },
    "reachable_count": 123,
    "secret_count": 123,
    "misconfiguration_count": 123,
    "deployed": true,
    "watch_tags": "<string>"
  },
  "created": true,
  "resolved": {
    "tag": "<string>",
    "digest": "<string>",
    "platform": "<string>"
  },
  "scan": {
    "image_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  },
  "scan_error": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

Domains

Analytics

Asset Discovery

Audit

Billing

Chat

CLI

Connectors

Containers

Assets

Test Users

Integrations

Knowledge

License

LLM

Run Logs

Organization

Invitations

Members

PR Reviews

Vulnerabilities

Repositories

Supply Chain

Scans

Schedules

Search

Tokens

Uploads

Webhooks

Workspaces

Add a container image

Authorizations

Scopes

Body

Response