---
title: "Scan Container Vulnerabilities"
method: POST
path: "/api/v2/Vulnerabilities/Containers/scan"
tags: ["Vulnerabilities"]
---

# Scan Container Vulnerabilities

`POST /api/v2/Vulnerabilities/Containers/scan`

Request that FortiCNAPP scans (evaluates) for vulnerabilities in the specified container image. Specify the container image by passing in a tag, repository, and registry in the body parameter. You must specify a container image and repository located in a registry domain that has already been integrated with FortiCNAPP.  

 For registries that are integrated using the FortiCNAPP generic `Docker V2 Registry` type, vulnerability scans can be started only by calling this API operation. 

  For registries that are integrated using any FortiCNAPP registry type except *"Docker V2 Registry"*, vulnerability scans start when the container registry is initially integrated, when specified by the default scan schedule, or when this operation is called. 

  For more information, see https://docs.fortinet.com/document/forticnapp/latest/administration-guide/784472/container-vulnerability-assessment-overview. 

   For more information about creating an API access key and token to run this operation and using this operation with organization resources, see https://docs.fortinet.com/document/forticnapp/latest/api-reference/932048/api-keys-and-access-tokens. 

  Usage Example: 

  > `curl -X POST -H 'Content-Type: application/json' -d '{ "registry": "index.docker.io", "repository":  "yourDockerOrg/yourRepository", "tag": "yourTag" }' "https://YourAccount.lacework.net/api/v2/Vulnerabilities/Containers/scan"  -H "Authorization: Bearer YourAPIToken"` 

 In the JSON body, do not prefix the registry or the repository with the `http://` string. 

   This operation returns a unique requestId in the response that you can use to track the status of this scan/assessment.

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- VulnerabilityContainerScanRequestBodySchema
  - `registry` string, required — The container registry to be assessed.
  - `repository` string, required — The repository within the container registry to be assessed.
  - `tag` string, required — The identifier tag as `key:value` pairs.

## Response `200`

No Error (Request Id and Status)

- object
  - `data` object
    - `requestId` string
    - `status` string

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)