CWPP API Documentation or Examples on usage of query parameters search and fields

[TommyHunt]

I want to see ALL of the docker labels for a scanned image so I am trying this API, https://prisma.pan.dev/api/cloud/cwpp/registry#operation/get-registry

Invoking that API with query parameter name...

curl -k \
-u "${PRISMA_KEY_ID}:${PGE_PRISMA_SECRET}" \
-H 'Content-Type: application/json' \
-X GET \
"${PRISMA_CLOUD_COMPUTE_CONSOLE_API_ADDR}/api/v22.06/registry?name=https://jfrog.nonprod.secret.com/artifactory/cscoe-prisma-automation-docker-virtual/simple-ecs-task:latest

... returns a HUGE json object containing a field called labels which is the only field that I am interested in testing...

So, I see that there is a query parameter called "fields" then I invoke the API like this hoping to see only the json array, labels...

curl -k \
-u "${PRISMA_KEY_ID}:${PGE_PRISMA_SECRET}" \
-H 'Content-Type: application/json' \
-X GET \
"${PRISMA_CLOUD_COMPUTE_CONSOLE_API_ADDR}/api/v22.06/registry?name=https://jfrog.nonprod.secret.com/artifactory/cscoe-prisma-automation-docker-virtual/simple-ecs-task:latest&fields=labels"

but that returns some odd JSON of null values...

{"_id":"jfrog.nonprod.secret.com/artifactory/cscoe-prisma-automation-docker-virtual/simple-ecs-task:latest","type":"","hostname":"","scanTime":"0001-01-01T00:00:00Z","binaries":null,"Secrets":null,"startupBinaries":null,"osDistro":"","osDistroVersion":"","osDistroRelease":"","distro":"","packages":null,"files":null,"packageManager":false,"isARM64":false,"image":{"created":"0001-01-01T00:00:00Z"},"history":null,"complianceIssues":null,"allCompliance":{},"vulnerabilities":null,"repoTag":null,"tags":null,"repoDigests":null,"creationTime":"0001-01-01T00:00:00Z","vulnerabilitiesCount":0,"complianceIssuesCount":0,"vulnerabilityDistribution":{"critical":0,"high":0,"medium":0,"low":0,"total":0},"complianceDistribution":{"critical":0,"high":0,"medium":0,"low":0,"total":0},"vulnerabilityRiskScore":0,"complianceRiskScore":0,"riskFactors":null,"installedProducts":{},"firstScanTime":"0001-01-01T00:00:00Z","cloudMetadata":{},"instances":null,"hosts":{},"err":"","collections":null,"scanID":0,"trustStatus":"","firewallProtection":{"enabled":false,"supported":false,"outOfBandMode":""},"appEmbedded":false,"wildFireUsage":null,"agentless":false}

what am I doing wrong?

how do i get query parameter, "fields", to work?

is there some documenation / examples of how query parameters, fields and search, are to be specified in the URL?

[musiddiqui]

Hi TommyHunt,

I hope you are doing well. Thank you for letting us know. It is indeed not working as expected. I have tested it on my end as well and it is not returning a proper output. Please go ahead and create a support case for us and the next available support engineer can assist you with it.

Regards,

[TommyHunt]

CASE 02355270

[RahulMeedaboina]

We already created a support case for this. The reply was, the documentation is wrong and rather than fixing the tool, they will change the documentation. 😀

[TommyHunt]

Thanks @RahulMeedaboina  but here is an example of a GET scans API invocation.  https://github.com/PaloAltoNetworks/prismacloud-cli/blob/39b60c85882919f1d12115c29f0b5123622e8f88/pr...

Now, how is the search criteria specified?

[TommyHunt · Accepted solution]

FYI... there exists a prisma cli tool on github,  https://github.com/PaloAltoNetworks/prismacloud-cli

You can use the --help option of that CLI tool...

and I am interested in searching the scan reports...

At this point, I have a quick feedback cycle to experiment with search terms...