Vulnerability Advisor for IBM Cloud Container Registry

Introduction

Vulnerability Advisor checks the security status of container images that are provided by IBM®, third parties, or added to your organization's registry namespace.

For more information about Vulnerability Advisor, see Managing image security with Vulnerability Advisor.

For more information about IBM Cloud Container Registry, see About IBM Cloud Container Registry.

For more information about IBM Cloud Kubernetes Service, see Getting started with IBM Cloud Kubernetes Service.

Endpoint URL

The endpoint for the Vulnerability Advisor for IBM Cloud Container Registry API is in the format: https://<registry_dns_name>/va/api/v3 For example, the API endpoint for Dallas is: https://us.icr.io/va/api/v3 To find out about the available IBM Cloud Container Registry DNS names, see Regions.

Error handling

The Vulnerabiliy Advisor service uses standard HTTP response codes to indicate whether a method completed successfully. A 200 response always indicates success. A 400 type response indicates a failure, and a 500 type response usually indicates an internal system error.

IBM Cloud Container Registry API
REST API for clusters, see Kubernetes service API
REST API JSON for clusters
REST API for logging in clusters, see IBM Cloud Kubernetes Service Logging API Logging API
REST API for managing Ingress application load balancers in clusters, see IBM Cloud Container Service ALB API

Methods

Get the vulnerability assessment for the list of registry images that belong to a specific account.

GET /va/api/v3/report/account

/va/api/v3/report/account

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
The IBM Cloud user authentication agent (UAA) or the IBM Cloud Identity & Access Management (IAM) JSON web token that you receive when you log into IBM Cloud. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Query Parameters

repository
string
The name of the repository for which you want to see the vulnerability assessments for the images in that repository. For example: registry.bluemix.net/namespace/image
includeIBM
string
When set to true, the returned list will contain IBM public images as well as the account images
includePrivate
string
When set to false, the returned list will not contain the private account images

Response

Response Body

report.reportList

Status Code

200
The returned list might contain unscanned results for images in your account that haven't yet been scanned. Try again later. If this issue persists, contact support for help; see https://console.bluemix.net/docs/support/index.html#contacting-support
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Get the vulnerability assessment status for the list of registry images that belong to a specific account.

GET /va/api/v3/report/account/status

/va/api/v3/report/account/status

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
The IBM Cloud user authentication agent (UAA) or the IBM Cloud Identity & Access Management (IAM) JSON web token that you receive when you log into IBM Cloud. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Query Parameters

repository
string
The name of the repository for which you want to see the vulnerability assessments for the images in that repository. For example: registry.bluemix.net/namespace/image
includeIBM
string
When set to true, the returned list will contain IBM public images as well as the account images
includePrivate
string
When set to false, the returned list will not contain the private account images

Response

Response Body

report.imageSummaryList

Status Code

200
The returned list might contain unscanned results for images in your account that haven't yet been scanned. Try again later. If this issue persists, contact support for help; see https://console.bluemix.net/docs/support/index.html#contacting-support
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Get the overall vulnerability status for a registry image.

GET /va/api/v3/report/image/status/{name}

/va/api/v3/report/image/status/{name}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
The IBM Cloud user authentication agent (UAA) or the IBM Cloud Identity & Access Management (IAM) JSON web token that you receive when you log into IBM Cloud. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

name
string
Name of the image, for example: registry.bluemix.net/namespace/image:tag.

Constraints: Value must match regular expression .*

Response

Response Body

report.summary

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
404
Your image hasn't been scanned yet. Try again later. If this issue persists, contact support for help; see https://console.bluemix.net/docs/support/index.html#contacting-support
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Get the vulnerability assessment for a registry image.

GET /va/api/v3/report/image/{name}

/va/api/v3/report/image/{name}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
The IBM Cloud user authentication agent (UAA) or the IBM Cloud Identity & Access Management (IAM) JSON web token that you receive when you log into IBM Cloud. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

name
string
Name of the image, for example: registry.bluemix.net/namespace/image:tag.

Constraints: Value must match regular expression .*

Response

Response Body

report.report

Status Code

202
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
404
Your image hasn't been scanned yet. Try again later. If this issue persists, contact support for help; see https://console.bluemix.net/docs/support/index.html#contacting-support
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List the exemptions that are specified for an account

GET /va/api/v3/exempt/image

/va/api/v3/exempt/image

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Response

Response Body

exemption.Exemption

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Get an exemption that is specified for an account

GET /va/api/v3/exempt/image/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*

Response

Response Body

exemption.Exemption

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Create or update an exemption that is specified for an account

POST /va/api/v3/exempt/image/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*

Response

Response Body

exemption.Exemption

Status Code

201
Created
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Delete an exemption that is specified for an account

DELETE /va/api/v3/exempt/image/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*

Response

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
404
Exemption not found.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List the exemptions that are specified for a resource (account, registry namespace, repository, or image)

GET /va/api/v3/exempt/image/{resource}

/va/api/v3/exempt/image/{resource}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

resource
string
IBM Cloud Registry resource (namespace, namespace/repository, or namespace/repository:tag)

Constraints: Value must match regular expression .*

Response

Response Body

exemption.Exemption

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Get an exemption that is specified for a resource (account, registry namespace, repository, or image)

GET /va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*
resource
string
IBM Cloud Registry resource (namespace, namespace/repository, or namespace/repository:tag)

Constraints: Value must match regular expression .*

Response

Response Body

exemption.Exemption

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Create or update an exemption that is specified for a resource (account, registry namespace, repository, or image)

POST /va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*
resource
string
IBM Cloud Registry resource (namespace, namespace/repository, or namespace/repository:tag)

Constraints: Value must match regular expression .*

Response

Response Body

exemption.Exemption

Status Code

201
Created
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Delete an exemption that is specified for a resource (account, registry namespace, repository, or image)

DELETE /va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

/va/api/v3/exempt/image/{resource}/issue/{issueType}/{issueID}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

issueType
string
Exemption type, e.g. 'cve' or 'sn' or 'configuration'. See /api/v2/exempt/types for more details.
issueID
string
Exemption ID, e.g. 'CVE-2018-9999'. See /api/v2/exempt/types for more details.

Constraints: Value must match regular expression .*
resource
string
IBM Cloud Registry resource (namespace, namespace/repository, or namespace/repository:tag)

Constraints: Value must match regular expression .*

Response

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
404
Exemption not found.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List the types of exemption

GET /va/api/v3/exempt/types

/va/api/v3/exempt/types

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Response

Response Body

exemption.TypeInfo[]

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List all of the exemptions in the given account

GET /va/api/v3/exemptions/account

/va/api/v3/exemptions/account

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Response

Response Body

exemption.Exemption[]

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

Delete all of the exemptions in the given account

POST /va/api/v3/exemptions/deleteAll

/va/api/v3/exemptions/deleteAll

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Response

Response Body

exemption.DeletionInfo

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List all of the exemptions for an image

GET /va/api/v3/exemptions/image/{resource}

/va/api/v3/exemptions/image/{resource}

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Path Parameters

resource
string
IBM Cloud Registry resource (namespace, namespace/repository, or namespace/repository:tag)

Constraints: Value must match regular expression .*

Query Parameters

includeScope
boolean
Include scope on returned exemptions

Default: false

Response

Response Body

exemption.Exemption[]

Status Code

200
OK. If the includeScope query parameter is set to true this endpoint will return a list of exemptions that have an additional field 'scope' that describes the level at which the exemption is set (namespace, repository, tag)
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.

List the exemptions for the given list of images

POST /va/api/v3/exemptions/images

/va/api/v3/exemptions/images

Request

Custom Headers

Account
string
The unique ID for your IBM Cloud account. Run 'bx cr info' to get the ID of the target account.
Authorization
string
An IBM Cloud IAM Bearer token for the Account. Run 'bx iam oauth-tokens' to retrieve your access token. This token includes the prefix 'Bearer'.
Accept-Language
string
The preferred language code for this request.

Request Body

string[]

List of images

Response

Status Code

200
OK
400
A required header is missing. Add the header to the request and try again.
401
You are not authorized to view the requested resource, or your IBM Cloud bearer token is invalid. Run 'bx iam oauth-tokens' to retrieve your access token and try again. If this issue persists, contact your administrator to confirm that you have access to this resource.
403
You don't have authorization to access the specified namespace. Run 'bx cr namespaces' to list your namespaces. Check that your image is in one of your namespaces.
500
Internal server error.
503
Unable to authenticate with IBM Cloud. Try again later.

No Sample Response

This method does not specify any sample responses.