--- title: "Create Container Registries" method: POST path: "/api/v2/ContainerRegistries" tags: ["ContainerRegistries"] --- # Create Container Registries `POST /api/v2/ContainerRegistries` Create a container registry by specifying parameters in the request body when invoking the following endpoint: > `POST https://YourAccount.lacework.net/api/v2/ContainerRegistries` ## Headers - `Authorization` string, required - `Content-Type` string, required - `Org-Access` boolean - `Account-Name` string ## Request body - ContainerRegistriesCreateSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'ContVulnCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` union, required - object - `crossAccountCredentials` object, required — Details of the cross-account role that FortiCNAPP uses to access your AWS resource. - `externalId` string, required — The AWS external ID that is associated with the cross-account role that FortiCNAPP uses to access your AWS resource. This is the External ID specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `roleArn` string, required — The ARN of the cross-account role that FortiCNAPP uses to access your AWS resources. This is the ARN specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `awsAuthType` 'AWS_IAM', required — Your AWS authentication type. The default value is `AWS_IAM`. - `registryType` 'AWS_ECR', required — The container registry's type. - `registryDomain` string, required — The URL of your registry in the following format: `YourAWSAccount.dkr.ecr.YourRegion.amazonaws.com`, where `YourAWSAcount` is the AWS account number for the AWS IAM user that has a role with permissions to access the ECR and `YourRegion` is your AWS region such as us-west-2. **Note**: Do not prefix the URL with `https://`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `accessKeyCredentials` object, required — Your AWS account's credentials. - `accessKeyId` string, required — The AccessKeyId value from your AWS console. - `secretAccessKey` string, password, required — The SecretAccessKey value from your AWS console. - `awsAuthType` 'AWS_ACCESS_KEY', required - `registryType` 'AWS_ECR', required — The container registry's type. - `registryDomain` string, required — The URL of your registry in the following format: `YourAWSAccount.dkr.ecr.YourRegion.amazonaws.com`, where **YourAWSAcount** is the AWS account number for the AWS IAM user that has a role with permissions to access the ECR and **YourRegion** is your AWS region such as us-west-2. **Note**: Do not prefix the URL with `https://`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Docker Hub's credentials. - `username` string, required — The Docker user that has at least read-only permissions to the Docker Hub container repositories that you want to assess for vulnerabilities. For more details on how to grant permissions in Docker, see [Teams and Organizations](https://docs.docker.com/docker-hub/orgs/). Specify a Docker user that has at least read-only permissions to the Docker Hub container repositories that you want to assess for vulnerabilities. Docker uses organizations and teams to grant permissions. - `password` string, password, required — The password for the specified Docker Hub user. Alternatively, you can use personal access tokens to access Hub images from the Docker CLI. For details, see [Managing Access Tokens](https://docs.docker.com/docker-hub/access-tokens/). - `registryType` 'DOCKERHUB', required — The container registry's type. - `registryDomain` 'index.docker.io', required — This field is pre-populated with this URL of Docker Hub, which is `index.docker.io`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Google Container Registry's credentials. - `clientId` string, required — The client ID for the service account that has been [granted access to the organization, folder, or project](https://cloud.google.com/iam/docs/granting-changing-revoking-access) that contains the registry (or registries). For more details about which role to assign to the service account, see [Configure Registry](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryGCRUrl). - `privateKeyId` string, required — The private key ID for the service account that has granted `storage.objectViewer` role for access to the Google project that contains the Google Container Registry (GCR). - `clientEmail` string, required — The client email associated with the service account that has granted `storage.objectViewer` role for access to the Google project that contains the Google Container Registry (GCR). - `privateKey` string, password, required — The private key for the specified private key ID. See [Private Key Format](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url) for guidance on formatting your key. - `registryType` 'GCP_GCR', required — The container registry's type. - `registryDomain` 'gcr.io' | 'us.gcr.io' | 'eu.gcr.io' | 'asia.gcr.io', required — The supported GCP region to access. For more information, see [Container Registry Pushing and pulling images](https://cloud.google.com/container-registry/docs/pushing-and-pulling). - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Google Artifact Registry's credentials. - `clientId` string, required — The client ID for the service account that has been [granted access to the organization, folder, or project](https://cloud.google.com/iam/docs/granting-changing-revoking-access) that contains the registry (or registries). For more details about which role to assign to the service account, see [Configure Registry](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryGCRUrl). - `privateKeyId` string, required — The private key ID for the private key that should be used to authenticate the service account that was specified in the *Client ID* setting. - `clientEmail` string, required — The client email associated with the service account that was specified in the *Client ID* setting. - `privateKey` string, password, required — The private key that should be used to authenticate the service account that was specified in the *Client ID* setting. To view the private key raw text, enter the following command, where `YourFileName.json` is the name of the file downloaded when you created the GCP Service Account to be used for the integration: `$ cat YourFileName.json | jq -r '.private_key'` - `registryType` 'GCP_GAR', required — The container registry's type. - `registryDomain` 'africa-south1-docker.pkg.dev' | 'asia-docker.pkg.dev' | 'asia-east1-docker.pkg.dev' | 'asia-east2-docker.pkg.dev' | 'asia-northeast1-docker.pkg.dev' | 'asia-northeast2-docker.pkg.dev' | 'asia-northeast3-docker.pkg.dev' | 'asia-south1-docker.pkg.dev' | 'asia-south2-docker.pkg.dev' | 'asia-southeast1-docker.pkg.dev' | 'asia-southeast2-docker.pkg.dev' | 'australia-southeast1-docker.pkg.dev' | 'australia-southeast2-docker.pkg.dev' | 'docker.me-central2.rep.pkg.dev' | 'europe-central2-docker.pkg.dev' | 'europe-docker.pkg.dev' | 'europe-north1-docker.pkg.dev' | 'europe-southwest1-docker.pkg.dev' | 'europe-west1-docker.pkg.dev' | 'europe-west10-docker.pkg.dev' | 'europe-west12-docker.pkg.dev' | 'europe-west2-docker.pkg.dev' | 'europe-west3-docker.pkg.dev' | 'europe-west4-docker.pkg.dev' | 'europe-west6-docker.pkg.dev' | 'europe-west8-docker.pkg.dev' | 'europe-west9-docker.pkg.dev' | 'me-central1-docker.pkg.dev' | 'me-central2-docker.pkg.dev' | 'me-west1-docker.pkg.dev' | 'northamerica-northeast1-docker.pkg.dev' | 'northamerica-northeast2-docker.pkg.dev' | 'southamerica-east1-docker.pkg.dev' | 'southamerica-west1-docker.pkg.dev' | 'us-central1-docker.pkg.dev' | 'us-docker.pkg.dev' | 'us-east1-docker.pkg.dev' | 'us-east4-docker.pkg.dev' | 'us-east5-docker.pkg.dev' | 'us-south1-docker.pkg.dev' | 'us-west1-docker.pkg.dev' | 'us-west2-docker.pkg.dev' | 'us-west3-docker.pkg.dev' | 'us-west4-docker.pkg.dev' | 'us-west8-docker.pkg.dev', required — The supported GCP region to access. For details, see [Repository and Image Names](https://cloud.google.com/artifact-registry/docs/docker/names). - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Docker V2 Registry's credentials. - `username` string, required — The user that has permissions to pull the images (that will be assessed) from the container registry. - `password` string, password, required — The password for the specified user. - `ssl` boolean — When sending a request, set to `True` if the registry uses SSL. You can use either a valid SSL certificate issued by a trusted Certificate Authority (CA) or a self-signed certificate. If you set it to `False`, you will use an unencrypted communication channel.
When included in a response, returns `True` for enabled SSL encryption, or returns `False` for disabled SSL encryption. **Known Issue for JFrog:** JFrog Cloud integrations must be SSL-enabled due to a known issue. - `registryType` 'V2_REGISTRY', required — The container registry's type. - `registryDomain` string, required — When sending a request, if you use `docker login `:`, specify the domain as `:`. If you use `docker login `, specify the domain as: ``. If you use `docker login :`, specify the domain as: `:`. When included in a response, returns the registry domain. - `registryNotifications` boolean — When sending a request, if the [container registry supports notifications](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url), you can optionally set to `True`. When included in a response, returns `True` if registry notifications are enabled; or returns `False` if registry notifications are disabled. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `registryType` 'INLINE_SCANNER', required — The container registry's type. - `limitNumScan` string — The maximum number of scans per hour that this integration can perform. - `identifierTag` object[] — Identifier tags as `key:value` pairs. - object - `credentials` object, required — Your GitHub Container Registry's credentials. - `username` string, required — The user that has permissions to pull the images (that will be assessed) from the container registry. - `password` string, password, required — The GitHub token. For details about generating a new token, see [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). The required permission is `read:packages`. - `ssl` boolean — When sending a request, set to `True` if the registry uses SSL. You can use either a valid SSL certificate issued by a trusted Certificate Authority (CA) or a self-signed certificate. If you set it to `False`, you will use an unencrypted communication channel. When included in a response, returns `True` for enabled SSL encryption, or returns `False` for disabled SSL encryption. - `registryType` 'GHCR', required — The container registry's type. - `registryDomain` 'ghcr.io', required — The URL of your registry. The default URL is `ghcr.io`. - `registryNotifications` boolean — When sending a request, if the [container registry supports notifications](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url), you can optionally set to `True`. When included in a response, returns `True` if registry notifications are enabled, or returns `False` if registry notifications are disabled. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `registryType` 'PROXY_SCANNER', required — The container registry's type. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. ## Response `201` No Error - object - `data` ContainerRegistriesResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'ContVulnCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` union, required - object - `crossAccountCredentials` object, required — Details of the cross-account role that FortiCNAPP uses to access your AWS resource. - `externalId` string, required — The AWS external ID that is associated with the cross-account role that FortiCNAPP uses to access your AWS resource. This is the External ID specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `roleArn` string, required — The ARN of the cross-account role that FortiCNAPP uses to access your AWS resources. This is the ARN specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `awsAuthType` 'AWS_IAM', required — Your AWS authentication type. The default value is `AWS_IAM`. - `registryType` 'AWS_ECR', required — The container registry's type. - `registryDomain` string, required — The URL of your registry in the following format: `YourAWSAccount.dkr.ecr.YourRegion.amazonaws.com`, where `YourAWSAcount` is the AWS account number for the AWS IAM user that has a role with permissions to access the ECR and `YourRegion` is your AWS region such as us-west-2. **Note**: Do not prefix the URL with `https://`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `accessKeyCredentials` object, required — Your AWS account's credentials. - `accessKeyId` string, required — The AccessKeyId value from your AWS console. - `secretAccessKey` string, password, required — The SecretAccessKey value from your AWS console. - `awsAuthType` 'AWS_ACCESS_KEY', required - `registryType` 'AWS_ECR', required — The container registry's type. - `registryDomain` string, required — The URL of your registry in the following format: `YourAWSAccount.dkr.ecr.YourRegion.amazonaws.com`, where **YourAWSAcount** is the AWS account number for the AWS IAM user that has a role with permissions to access the ECR and **YourRegion** is your AWS region such as us-west-2. **Note**: Do not prefix the URL with `https://`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Docker Hub's credentials. - `username` string, required — The Docker user that has at least read-only permissions to the Docker Hub container repositories that you want to assess for vulnerabilities. For more details on how to grant permissions in Docker, see [Teams and Organizations](https://docs.docker.com/docker-hub/orgs/). Specify a Docker user that has at least read-only permissions to the Docker Hub container repositories that you want to assess for vulnerabilities. Docker uses organizations and teams to grant permissions. - `password` string, password, required — The password for the specified Docker Hub user. Alternatively, you can use personal access tokens to access Hub images from the Docker CLI. For details, see [Managing Access Tokens](https://docs.docker.com/docker-hub/access-tokens/). - `registryType` 'DOCKERHUB', required — The container registry's type. - `registryDomain` 'index.docker.io', required — This field is pre-populated with this URL of Docker Hub, which is `index.docker.io`. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Google Container Registry's credentials. - `clientId` string, required — The client ID for the service account that has been [granted access to the organization, folder, or project](https://cloud.google.com/iam/docs/granting-changing-revoking-access) that contains the registry (or registries). For more details about which role to assign to the service account, see [Configure Registry](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryGCRUrl). - `privateKeyId` string, required — The private key ID for the service account that has granted `storage.objectViewer` role for access to the Google project that contains the Google Container Registry (GCR). - `clientEmail` string, required — The client email associated with the service account that has granted `storage.objectViewer` role for access to the Google project that contains the Google Container Registry (GCR). - `privateKey` string, password, required — The private key for the specified private key ID. See [Private Key Format](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url) for guidance on formatting your key. - `registryType` 'GCP_GCR', required — The container registry's type. - `registryDomain` 'gcr.io' | 'us.gcr.io' | 'eu.gcr.io' | 'asia.gcr.io', required — The supported GCP region to access. For more information, see [Container Registry Pushing and pulling images](https://cloud.google.com/container-registry/docs/pushing-and-pulling). - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Google Artifact Registry's credentials. - `clientId` string, required — The client ID for the service account that has been [granted access to the organization, folder, or project](https://cloud.google.com/iam/docs/granting-changing-revoking-access) that contains the registry (or registries). For more details about which role to assign to the service account, see [Configure Registry](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryGCRUrl). - `privateKeyId` string, required — The private key ID for the private key that should be used to authenticate the service account that was specified in the *Client ID* setting. - `clientEmail` string, required — The client email associated with the service account that was specified in the *Client ID* setting. - `privateKey` string, password, required — The private key that should be used to authenticate the service account that was specified in the *Client ID* setting. To view the private key raw text, enter the following command, where `YourFileName.json` is the name of the file downloaded when you created the GCP Service Account to be used for the integration: `$ cat YourFileName.json | jq -r '.private_key'` - `registryType` 'GCP_GAR', required — The container registry's type. - `registryDomain` 'africa-south1-docker.pkg.dev' | 'asia-docker.pkg.dev' | 'asia-east1-docker.pkg.dev' | 'asia-east2-docker.pkg.dev' | 'asia-northeast1-docker.pkg.dev' | 'asia-northeast2-docker.pkg.dev' | 'asia-northeast3-docker.pkg.dev' | 'asia-south1-docker.pkg.dev' | 'asia-south2-docker.pkg.dev' | 'asia-southeast1-docker.pkg.dev' | 'asia-southeast2-docker.pkg.dev' | 'australia-southeast1-docker.pkg.dev' | 'australia-southeast2-docker.pkg.dev' | 'docker.me-central2.rep.pkg.dev' | 'europe-central2-docker.pkg.dev' | 'europe-docker.pkg.dev' | 'europe-north1-docker.pkg.dev' | 'europe-southwest1-docker.pkg.dev' | 'europe-west1-docker.pkg.dev' | 'europe-west10-docker.pkg.dev' | 'europe-west12-docker.pkg.dev' | 'europe-west2-docker.pkg.dev' | 'europe-west3-docker.pkg.dev' | 'europe-west4-docker.pkg.dev' | 'europe-west6-docker.pkg.dev' | 'europe-west8-docker.pkg.dev' | 'europe-west9-docker.pkg.dev' | 'me-central1-docker.pkg.dev' | 'me-central2-docker.pkg.dev' | 'me-west1-docker.pkg.dev' | 'northamerica-northeast1-docker.pkg.dev' | 'northamerica-northeast2-docker.pkg.dev' | 'southamerica-east1-docker.pkg.dev' | 'southamerica-west1-docker.pkg.dev' | 'us-central1-docker.pkg.dev' | 'us-docker.pkg.dev' | 'us-east1-docker.pkg.dev' | 'us-east4-docker.pkg.dev' | 'us-east5-docker.pkg.dev' | 'us-south1-docker.pkg.dev' | 'us-west1-docker.pkg.dev' | 'us-west2-docker.pkg.dev' | 'us-west3-docker.pkg.dev' | 'us-west4-docker.pkg.dev' | 'us-west8-docker.pkg.dev', required — The supported GCP region to access. For details, see [Repository and Image Names](https://cloud.google.com/artifact-registry/docs/docker/names). - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] — When sending a request, if you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. When included in a response, returns a list of repositories to discover/assess. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `credentials` object, required — Your Docker V2 Registry's credentials. - `username` string, required — The user that has permissions to pull the images (that will be assessed) from the container registry. - `password` string, password, required — The password for the specified user. - `ssl` boolean — When sending a request, set to `True` if the registry uses SSL. You can use either a valid SSL certificate issued by a trusted Certificate Authority (CA) or a self-signed certificate. If you set it to `False`, you will use an unencrypted communication channel.
When included in a response, returns `True` for enabled SSL encryption, or returns `False` for disabled SSL encryption. **Known Issue for JFrog:** JFrog Cloud integrations must be SSL-enabled due to a known issue. - `registryType` 'V2_REGISTRY', required — The container registry's type. - `registryDomain` string, required — When sending a request, if you use `docker login `:`, specify the domain as `:`. If you use `docker login `, specify the domain as: ``. If you use `docker login :`, specify the domain as: `:`. When included in a response, returns the registry domain. - `registryNotifications` boolean — When sending a request, if the [container registry supports notifications](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url), you can optionally set to `True`. When included in a response, returns `True` if registry notifications are enabled; or returns `False` if registry notifications are disabled. - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `registryType` 'INLINE_SCANNER', required — The container registry's type. - `limitNumScan` string — The maximum number of scans per hour that this integration can perform. - `identifierTag` object[] — Identifier tags as `key:value` pairs. - object - `credentials` object, required — Your GitHub Container Registry's credentials. - `username` string, required — The user that has permissions to pull the images (that will be assessed) from the container registry. - `password` string, password, required — The GitHub token. For details about generating a new token, see [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). The required permission is `read:packages`. - `ssl` boolean — When sending a request, set to `True` if the registry uses SSL. You can use either a valid SSL certificate issued by a trusted Certificate Authority (CA) or a self-signed certificate. If you set it to `False`, you will use an unencrypted communication channel. When included in a response, returns `True` for enabled SSL encryption, or returns `False` for disabled SSL encryption. - `registryType` 'GHCR', required — The container registry's type. - `registryDomain` 'ghcr.io', required — The URL of your registry. The default URL is `ghcr.io`. - `registryNotifications` boolean — When sending a request, if the [container registry supports notifications](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=containerRegistryDockerV2Url), you can optionally set to `True`. When included in a response, returns `True` if registry notifications are enabled, or returns `False` if registry notifications are disabled. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] - `nonOsPackageEval` boolean — This feature is enabled by default. When sending a request, set to `False` if you want to disable scanning of [language libraries](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=CONTAINER_IMAGE_SUPPORT). When included in a response, returns `True` if the scanning of language libraries is enabled, or returns `False` if the scanning of language libraries is disabled. - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - object - `registryType` 'PROXY_SCANNER', required — The container registry's type. - `limitNumImg` 5 | 10 | 15 — When sending a request, if you do not want to assess all images in this registry, specify the maximum number of newest container images to discover/assess per repository. The default value is `5`. When included in a response, returns the number of newest container images to discover/assess per repository. - `limitByRep` string[] - `limitByTag` string[] — When sending a request, if you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of texts that will be used to assess images. - `baseImageRepo` string[] — If you have base images that you want to discover/assess, add a comma-separated list with base image repositories - `limitByLabel` object[] — When sending a request, if you do not want to assess all images in this registry, specify `key:value` pairs so that only images with matching label `key:value` pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: `key:value`. If you specify tag and label limits, they function as an AND. When included in a response, returns a list of labels that will be used to assess images. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. ## Other responses - `4XX` — Client Error - `5XX` — Internal Server Error --- [API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)