> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Add a container image > Resolve the reference to a digest, track the image, and start the first scan unless `scan` is false. An image whose compressed size is above the scan limit (8 GiB; self-hosted installs can change it with `STRIX_CONTAINER_MAX_IMAGE_BYTES`) fails with status 400 before Strix tracks it. When the image is already tracked, Strix returns it with `created` false and a `200` status. Session callers must hold the admin or analyst role without asset scopes. Container scanning requires the Enterprise plan. ## OpenAPI ````yaml /openapi.json post /containers/images openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /containers/images: post: tags: - Containers summary: Add a container image description: >- Resolve the reference to a digest, track the image, and start the first scan unless `scan` is false. An image whose compressed size is above the scan limit (8 GiB; self-hosted installs can change it with `STRIX_CONTAINER_MAX_IMAGE_BYTES`) fails with status 400 before Strix tracks it. When the image is already tracked, Strix returns it with `created` false and a `200` status. Session callers must hold the admin or analyst role without asset scopes. Container scanning requires the Enterprise plan. operationId: createContainerImage requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageRequest' responses: '200': description: The image was already tracked. content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageResponse' '201': description: The image was added. content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - containers:write components: schemas: CreateContainerImageRequest: type: object properties: registry_id: type: string format: uuid description: >- Connected registry that hosts the image. Connect a registry first, with or without credentials. reference: type: string description: >- Image reference in the form `name:tag` or `name@sha256:`, without the registry host. platform: type: - string - 'null' description: >- OCI platform to add, for example `linux/amd64`. Null selects `linux/amd64` when the image has it, else the first platform in the index. A platform that you set explicitly must exist in the image index: if it does not, the request fails with status 400 and the response lists the platforms the image has. An image with one manifest and no index is checked against the platform that its image config declares. A later scan of the image uses the stored platform if the scan request does not specify a platform. linked_repository_id: type: - string - 'null' format: uuid description: >- Repository that builds this image. Strix shows the link on the image and uses it for remediation context. watch_tags: type: - string - 'null' description: >- Tag pattern to watch, for example `1.*` or `release-*`. When set, Strix rescans the image when a matching tag moves to a new digest. scan: type: boolean description: Start the first scan when the image is added. Default false. default: false required: - registry_id - reference CreateContainerImageResponse: type: object properties: image: $ref: '#/components/schemas/ContainerImage' created: type: boolean description: False when the image was already tracked. resolved: type: object properties: tag: type: - string - 'null' digest: type: string platform: type: string required: - tag - digest - platform scan: type: - object - 'null' properties: image_snapshot_id: type: string format: uuid scan_id: type: string format: uuid description: UUID of the Strix scan. Use it with the Scans endpoints. required: - image_snapshot_id - scan_id scan_error: type: - string - 'null' description: >- Reason the first scan did not start. Null when `scan` is set or the caller disabled the scan. required: - image - created - resolved - scan - scan_error ContainerImage: type: object properties: id: type: string format: uuid registry_id: type: string format: uuid name: type: string description: Image name without the registry host, for example `acme/api`. latest_tag: type: - string - 'null' description: >- Tag that the latest scan resolved. Tags are labels. Digests are identity. latest_digest: type: - string - 'null' description: Manifest digest that the latest scan resolved. platform: type: string description: >- Platform selected when the image was added, for example `linux/amd64`. A scan request without a platform uses this platform. linked_repository_id: type: - string - 'null' format: uuid linked_repository_name: type: - string - 'null' last_scan_at: type: - string - 'null' format: date-time last_scan_status: oneOf: - $ref: '#/components/schemas/ContainerScanStatus' - type: 'null' findings: $ref: '#/components/schemas/ContainerSeverityCounts' reachable_count: type: integer description: >- Open vulnerabilities that the exploitability pass marked as reachable. secret_count: type: integer misconfiguration_count: type: integer deployed: type: boolean description: True when a deployment integration reports this image as running. watch_tags: type: - string - 'null' description: >- Glob pattern of tags that Strix rescans when they change. Null when no pattern is set. required: - id - registry_id - name - latest_tag - latest_digest - platform - linked_repository_id - linked_repository_name - last_scan_at - last_scan_status - findings - reachable_count - secret_count - misconfiguration_count - deployed - watch_tags description: A tracked container image with counts from its latest completed scan. ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ContainerScanStatus: type: string enum: - queued - running - completed - failed ContainerSeverityCounts: type: object properties: critical: type: integer high: type: integer medium: type: integer low: type: integer total: type: integer required: - critical - high - medium - low - total ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.