> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Add a container image > Resolve the reference to a digest, track the image, and start the first scan unless `scan` is false. When the image is already tracked, Strix returns it with `created` false and a `200` status. Session callers must hold the admin or analyst role. Container scanning requires the Enterprise plan. ## OpenAPI ````yaml /openapi.json post /containers/images openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /containers/images: post: tags: - Containers summary: Add a container image description: >- Resolve the reference to a digest, track the image, and start the first scan unless `scan` is false. When the image is already tracked, Strix returns it with `created` false and a `200` status. Session callers must hold the admin or analyst role. Container scanning requires the Enterprise plan. operationId: createContainerImage requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageRequest' responses: '200': description: The image was already tracked. content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageResponse' '201': description: The image was added. content: application/json: schema: $ref: '#/components/schemas/CreateContainerImageResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - containers:write components: schemas: CreateContainerImageRequest: type: object properties: registry_id: type: - string - 'null' format: uuid description: Registry that hosts the image. Null uses the public Docker Hub. reference: type: string description: Image reference in the form `name:tag` or `name@sha256:`. platform: type: - string - 'null' description: >- OCI platform to add, for example `linux/amd64`. Null selects `linux/amd64`. A later scan of the image uses this platform if the scan request does not specify a platform. linked_repository_id: type: - string - 'null' format: uuid description: >- Repository that builds this image. Strix shows the link on the image and uses it for remediation context. watch_tags: type: - string - 'null' description: >- Tag pattern to watch, for example `1.*` or `release-*`. When set, Strix rescans the image when a matching tag moves to a new digest. scan: type: boolean description: Start the first scan when the image is added. Default false. default: false required: - reference CreateContainerImageResponse: type: object properties: image: $ref: '#/components/schemas/ContainerImage' created: type: boolean description: False when the image was already tracked. resolved: type: object properties: tag: type: - string - 'null' digest: type: string platform: type: string required: - tag - digest - platform scan: type: - object - 'null' properties: image_snapshot_id: type: string format: uuid scan_id: type: string format: uuid description: UUID of the Strix scan. Use it with the Scans endpoints. required: - image_snapshot_id - scan_id scan_error: type: - string - 'null' description: >- Reason the first scan did not start. Null when `scan` is set or the caller disabled the scan. required: - image - created - resolved - scan - scan_error ContainerImage: type: object properties: id: type: string format: uuid registry_id: type: string format: uuid name: type: string description: Image name without the registry host, for example `acme/api`. latest_tag: type: - string - 'null' description: >- Tag that the latest scan resolved. Tags are labels. Digests are identity. latest_digest: type: - string - 'null' description: Manifest digest that the latest scan resolved. platform: type: string description: >- Platform selected when the image was added, for example `linux/amd64`. A scan request without a platform uses this platform. linked_repository_id: type: - string - 'null' format: uuid linked_repository_name: type: - string - 'null' last_scan_at: type: - string - 'null' format: date-time last_scan_status: oneOf: - $ref: '#/components/schemas/ContainerScanStatus' - type: 'null' findings: $ref: '#/components/schemas/ContainerSeverityCounts' reachable_count: type: integer description: >- Open vulnerabilities that the exploitability pass marked as reachable. secret_count: type: integer misconfiguration_count: type: integer deployed: type: boolean description: True when a deployment integration reports this image as running. watch_tags: type: - string - 'null' description: >- Glob pattern of tags that Strix rescans when they change. Null when no pattern is set. required: - id - registry_id - name - latest_tag - latest_digest - platform - linked_repository_id - linked_repository_name - last_scan_at - last_scan_status - findings - reachable_count - secret_count - misconfiguration_count - deployed - watch_tags description: A tracked container image with counts from its latest completed scan. ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ContainerScanStatus: type: string enum: - queued - running - completed - failed ContainerSeverityCounts: type: object properties: critical: type: integer high: type: integer medium: type: integer low: type: integer total: type: integer required: - critical - high - medium - low - total ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ````