Search Inventory

The Inventory API enables you to retrieve information about resources in your cloud integrations, such as virtual machines, S3 buckets, security groups, and more, using the following endpoint:

POST /api/v2/Inventory/search

By default, FortiCNAPP collects resource information once a day. You can view and modify when resource collection starts using the Compliance Report Schedule setting.

The time filter allows you to see your resource inventory at a specific point of time. When using the Inventory API, keep in mind that the information returned reflects the inventory when the resource collector last ran within the specified time range. If you use a recent time range that does not encompass the last time inventory collection occurred, the query returns an empty array. In this case, expand the time span to include the last collection time.

For details about what cloud resource information is available, see CLOUD_CONFIGURATION_V View.

The rlike and not_rlike operators are useful for filtering results. For example, if the result contains the security group ID sg-0a1b2c3d4e5f6g7h in the path resourceConfig.SecurityGroups.GroupId, and SecurityGroups is an array, you can filter by ID for that pattern as follows:

"filters" : [ {"field":"resourceConfig","expression": "rlike", "value":".*sg-0a1b2c3d4e5f6g7h.*" } ]

Here are additional example body payloads:

• { "timeFilter": { "startTime" : "2022-06-08T00:00:00Z", "endTime": "2022-06-10T12:00:00Z"}, "csp": "AWS" }
• { "timeFilter": { "startTime": "2022-06-08T00:00:00Z", "endTime": "2022-06-10T12:00:00Z"}, "filters" : [ { "field": "resourceConfig.Architecture", "expression": "eq", "value": "x86_64" }, { "field": "resourceRegion", "expression": "eq", "value" : "us-east-2" } ],
  "returns": [ "cloudDetails", "csp", "resourceConfig" , "resourceId", "resourceType" ],
  "csp": "GCP" }