StackRox ImageService API

openapi: 3.0.0
info:
  title: API Reference AlertService ImageService API
  version: '1'
  description: API reference for the StackRox Kubernetes Security Platform (upstream of Red Hat Advanced Cluster Security). Provides risk analysis, visibility, runtime alerts, policy management, compliance checking, and vulnerability management for containerized workloads. Authentication uses API tokens generated via /v1/apitokens/generate and passed as Bearer tokens.
  contact:
    email: support@stackrox.com
    url: https://www.stackrox.io/
  license:
    name: All Rights Reserved
    url: https://www.stackrox.com/
servers:
- url: https://{central-host}
  description: StackRox Central API server
  variables:
    central-host:
      default: stackrox.localhost
      description: StackRox Central hostname or IP
security:
- ApiToken: []
tags:
- name: ImageService
paths:
  /v1/images:
    get:
      summary: ListImages returns all the images.
      operationId: ListImages
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1ListImagesResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - ImageService
    delete:
      summary: DeleteImage removes the images based on a query
      operationId: DeleteImages
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1DeleteImagesResponse'
      parameters:
      - name: query.query
        in: query
        required: false
        schema:
          type: string
      - name: query.pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: query.pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: query.pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: query.pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      - name: confirm
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - ImageService
  /v1/images/cache/invalidate:
    get:
      summary: InvalidateScanAndRegistryCaches removes the image metadata cache.
      operationId: InvalidateScanAndRegistryCaches
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1Empty'
      tags:
      - ImageService
  /v1/images/scan:
    post:
      summary: ScanImage scans a single image and returns the result
      operationId: ScanImage
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/storageImage'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1ScanImageRequest'
        required: true
      tags:
      - ImageService
  /v1/images/{id}:
    get:
      summary: GetImage returns the image given its ID.
      operationId: GetImage
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/storageImage'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - ImageService
  /v1/imagescount:
    get:
      summary: ListImages returns all the images.
      operationId: CountImages
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1CountImagesResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - ImageService
components:
  schemas:
    storageV1Metadata:
      type: object
      properties:
        digest:
          type: string
        created:
          type: string
          format: date-time
        author:
          type: string
        layers:
          type: array
          items:
            $ref: '#/components/schemas/storageImageLayer'
        user:
          type: string
        command:
          type: array
          items:
            type: string
        entrypoint:
          type: array
          items:
            type: string
        volumes:
          type: array
          items:
            type: string
    EmbeddedImageScanComponentSourceType:
      type: string
      enum:
      - OS
      - PYTHON
      - JAVA
      - RUBY
      - NODEJS
      default: OS
    storageV2Metadata:
      type: object
      properties:
        digest:
          type: string
    storageCVSSV3:
      type: object
      properties:
        vector:
          type: string
        exploitabilityScore:
          type: number
          format: float
        impactScore:
          type: number
          format: float
        attackVector:
          $ref: '#/components/schemas/storageCVSSV3AttackVector'
        attackComplexity:
          $ref: '#/components/schemas/CVSSV3Complexity'
        privilegesRequired:
          $ref: '#/components/schemas/CVSSV3Privileges'
        userInteraction:
          $ref: '#/components/schemas/CVSSV3UserInteraction'
        scope:
          $ref: '#/components/schemas/storageCVSSV3Scope'
        confidentiality:
          $ref: '#/components/schemas/storageCVSSV3Impact'
        integrity:
          $ref: '#/components/schemas/storageCVSSV3Impact'
        availability:
          $ref: '#/components/schemas/storageCVSSV3Impact'
        score:
          type: number
          format: float
        severity:
          $ref: '#/components/schemas/storageCVSSV3Severity'
    storageImageName:
      type: object
      properties:
        registry:
          type: string
        remote:
          type: string
        tag:
          type: string
        fullName:
          type: string
    CVSSV2Authentication:
      type: string
      enum:
      - AUTH_MULTIPLE
      - AUTH_SINGLE
      - AUTH_NONE
      default: AUTH_MULTIPLE
    storageCVSSV2AttackVector:
      type: string
      enum:
      - ATTACK_LOCAL
      - ATTACK_ADJACENT
      - ATTACK_NETWORK
      default: ATTACK_LOCAL
    CVSSV3UserInteraction:
      type: string
      enum:
      - UI_NONE
      - UI_REQUIRED
      default: UI_NONE
    storageEmbeddedVulnerabilityScoreVersion:
      type: string
      enum:
      - V2
      - V3
      default: V2
    v1Empty:
      type: object
    storageCVSSV3Severity:
      type: string
      enum:
      - UNKNOWN
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      default: UNKNOWN
    v1DeleteImagesResponse:
      type: object
      properties:
        numDeleted:
          type: integer
          format: int64
        dryRun:
          type: boolean
          format: boolean
    v1CountImagesResponse:
      type: object
      properties:
        count:
          type: integer
          format: int32
    storageImage:
      type: object
      properties:
        id:
          type: string
        name:
          $ref: '#/components/schemas/storageImageName'
        metadata:
          $ref: '#/components/schemas/storageImageMetadata'
        scan:
          $ref: '#/components/schemas/storageImageScan'
        components:
          type: integer
          format: int32
        cves:
          type: integer
          format: int32
        fixableCves:
          type: integer
          format: int32
        lastUpdated:
          type: string
          format: date-time
        notPullable:
          type: boolean
          format: boolean
        priority:
          type: string
          format: int64
      title: 'Next Tag: 12'
    CVSSV2AccessComplexity:
      type: string
      enum:
      - ACCESS_HIGH
      - ACCESS_MEDIUM
      - ACCESS_LOW
      default: ACCESS_HIGH
    storageListImage:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        components:
          type: integer
          format: int32
        cves:
          type: integer
          format: int32
        fixableCves:
          type: integer
          format: int32
        created:
          type: string
          format: date-time
        lastUpdated:
          type: string
          format: date-time
        priority:
          type: string
          format: int64
    storageEmbeddedVulnerability:
      type: object
      properties:
        cve:
          type: string
        cvss:
          type: number
          format: float
        summary:
          type: string
        link:
          type: string
        fixedBy:
          type: string
        scoreVersion:
          $ref: '#/components/schemas/storageEmbeddedVulnerabilityScoreVersion'
        cvssV2:
          $ref: '#/components/schemas/storageCVSSV2'
        cvssV3:
          $ref: '#/components/schemas/storageCVSSV3'
        publishedOn:
          type: string
          format: date-time
        lastModified:
          type: string
          format: date-time
        vulnerabilityType:
          $ref: '#/components/schemas/EmbeddedVulnerabilityVulnerabilityType'
      title: 'TODO: Remove when migration is in place'
    storageImageLayer:
      type: object
      properties:
        instruction:
          type: string
        value:
          type: string
        created:
          type: string
          format: date-time
        author:
          type: string
        DEPRECATEDComponents:
          type: array
          items:
            $ref: '#/components/schemas/storageEmbeddedImageScanComponent'
        empty:
          type: boolean
          format: boolean
    storageCVSSV2Impact:
      type: string
      enum:
      - IMPACT_NONE
      - IMPACT_PARTIAL
      - IMPACT_COMPLETE
      default: IMPACT_NONE
    CVSSV3Complexity:
      type: string
      enum:
      - COMPLEXITY_LOW
      - COMPLEXITY_HIGH
      default: COMPLEXITY_LOW
    storageCVSSV3Scope:
      type: string
      enum:
      - UNCHANGED
      - CHANGED
      default: UNCHANGED
    storageCVSSV2Severity:
      type: string
      enum:
      - UNKNOWN
      - LOW
      - MEDIUM
      - HIGH
      default: UNKNOWN
    v1ListImagesResponse:
      type: object
      properties:
        images:
          type: array
          items:
            $ref: '#/components/schemas/storageListImage'
    storageImageScan:
      type: object
      properties:
        scanTime:
          type: string
          format: date-time
        components:
          type: array
          items:
            $ref: '#/components/schemas/storageEmbeddedImageScanComponent'
    storageCVSSV3AttackVector:
      type: string
      enum:
      - ATTACK_LOCAL
      - ATTACK_ADJACENT
      - ATTACK_NETWORK
      - ATTACK_PHYSICAL
      default: ATTACK_LOCAL
    storageImageMetadata:
      type: object
      properties:
        v1:
          $ref: '#/components/schemas/storageV1Metadata'
        v2:
          $ref: '#/components/schemas/storageV2Metadata'
        layerShas:
          type: array
          items:
            type: string
          title: We never need both sets of layers so consolidate them. They will be ordered by oldest->newest
    v1ScanImageRequest:
      type: object
      properties:
        imageName:
          type: string
        force:
          type: boolean
          format: boolean
    storageLicense:
      type: object
      properties:
        name:
          type: string
        type:
          type: string
        url:
          type: string
    storageCVSSV2:
      type: object
      properties:
        vector:
          type: string
        attackVector:
          $ref: '#/components/schemas/storageCVSSV2AttackVector'
        accessComplexity:
          $ref: '#/components/schemas/CVSSV2AccessComplexity'
        authentication:
          $ref: '#/components/schemas/CVSSV2Authentication'
        confidentiality:
          $ref: '#/components/schemas/storageCVSSV2Impact'
        integrity:
          $ref: '#/components/schemas/storageCVSSV2Impact'
        availability:
          $ref: '#/components/schemas/storageCVSSV2Impact'
        exploitabilityScore:
          type: number
          format: float
        impactScore:
          type: number
          format: float
        score:
          type: number
          format: float
        severity:
          $ref: '#/components/schemas/storageCVSSV2Severity'
    storageCVSSV3Impact:
      type: string
      enum:
      - IMPACT_NONE
      - IMPACT_LOW
      - IMPACT_HIGH
      default: IMPACT_NONE
    EmbeddedVulnerabilityVulnerabilityType:
      type: string
      enum:
      - UNKNOWN_VULNERABILITY
      - IMAGE_VULNERABILITY
      - K8S_VULNERABILITY
      - ISTIO_VULNERABILITY
      default: UNKNOWN_VULNERABILITY
    CVSSV3Privileges:
      type: string
      enum:
      - PRIVILEGE_NONE
      - PRIVILEGE_LOW
      - PRIVILEGE_HIGH
      default: PRIVILEGE_NONE
    storageEmbeddedImageScanComponent:
      type: object
      properties:
        name:
          type: string
        version:
          type: string
        license:
          $ref: '#/components/schemas/storageLicense'
        vulns:
          type: array
          items:
            $ref: '#/components/schemas/storageEmbeddedVulnerability'
        layerIndex:
          type: integer
          format: int32
        priority:
          type: string
          format: int64
        source:
          $ref: '#/components/schemas/EmbeddedImageScanComponentSourceType'
        location:
          type: string
      title: 'TODO: Remove when migration is in place'
  securitySchemes:
    ApiToken:
      type: apiKey
      in: header
      name: Authorization
      description: 'StackRox API token. Format: Bearer {token}'