> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read image versions before tracking > Read image versions and verify the selected manifest without adding an image or starting a scan. Requires containers:read and an unscoped admin or analyst. Strix uses the stored registry credential on the server. Google Artifact Registry uses the native API when the service account has artifactregistry.versions.list. Native pages contain up to 50 versions, newest first, with one representative tag per version. Use cursor to read older versions. The first native page selects its newest tagged version. Later native pages return selected null. Pull-only custom roles keep the existing Docker-compatible listing without pagination. Other registries use an existing latest tag or a sole tag. Multiple unordered tags return selected null so the caller can choose. Empty repositories also return selected null. ## OpenAPI ````yaml /openapi.json get /containers/registries/{registryId}/versions openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /containers/registries/{registryId}/versions: get: tags: - Containers summary: Read image versions before tracking description: >- Read image versions and verify the selected manifest without adding an image or starting a scan. Requires containers:read and an unscoped admin or analyst. Strix uses the stored registry credential on the server. Google Artifact Registry uses the native API when the service account has artifactregistry.versions.list. Native pages contain up to 50 versions, newest first, with one representative tag per version. Use cursor to read older versions. The first native page selects its newest tagged version. Later native pages return selected null. Pull-only custom roles keep the existing Docker-compatible listing without pagination. Other registries use an existing latest tag or a sole tag. Multiple unordered tags return selected null so the caller can choose. Empty repositories also return selected null. operationId: listContainerImageVersions parameters: - name: registryId in: path required: true schema: type: string format: uuid description: Connected registry ID. - name: name in: query required: true schema: type: string maxLength: 255 description: >- Repository path without a tag or digest. Google Artifact Registry requires project-id/repository/image. - name: platform in: query schema: type: string description: >- Requested OCI platform, such as linux/amd64. Omit to select linux/amd64 when available, otherwise the first platform. - name: cursor in: query schema: type: string maxLength: 4096 description: >- The next_cursor from the previous Google Artifact Registry page. Keep the same registry, name, and platform. - name: version in: query schema: type: string maxLength: 128 description: >- Tag or sha256 digest to verify. When set, Strix verifies only this version and returns it as selected, with an empty versions list. Use it to read the platforms of a version that the caller picked. responses: '200': description: >- Available versions and verified selection. No credentials or image inventory writes. content: application/json: schema: type: object required: - versions - selected - next_cursor properties: next_cursor: type: - string - 'null' description: >- Cursor for older versions. Null means there are no more pages. versions: type: array items: type: object required: - tag - reference properties: tag: type: - string - 'null' reference: type: string description: Image tag or immutable manifest digest. selected: type: - object - 'null' required: - tag - digest - platform - platforms properties: tag: type: - string - 'null' digest: type: string description: Verified manifest digest for the selected platform. platform: type: string platforms: type: array items: type: string description: >- Every platform the selected version provides, such as linux/amd64 and linux/arm64. '400': description: Invalid image path or unsupported metadata. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - containers:read components: schemas: ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.