Application Management - Anchore API

{
   "name": "Application name",
   "description": "Application description"
}

{
   "name": "Updated application name",
   "description": "Updated application description"
}

1 - Application Version Management - Anchore API

Use the Anchore API to manage your application versions. For more information about using Anchore APIs via Swagger, see: Using the Anchore API.

The API application workflow would be like the following.

Create an Application Version

To use the Anchore API to create an application version that is associated with an already-existing application, POST the JSON in the block below to http://<host:port>/v2/applications/<application_id>/versions/.

{
   "version_name": "v1.0.0"
}

GET the List of All Application Versions

GET the list of all application versions for the application from http://<host:port>/v2/applications/<application_id>/ versions.

GET a Single Application Version

GET a specific application version from http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>.

Update an Existing Application

To update the name of an existing application version, PUT the following to http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>

{
    "version_name": "v1.0.1"
}

Remove a Specified Application Version

To delete an application version, Send a DELETE to http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>.

2 - Associate Artifacts with Application Versions - Anchore API

Add an Artifact Association

The following commands require source or image artifacts to already be added to the Anchore Enterprise instance before they can be associated with the application version.

Note: Keep track of the uuid of the sources, and the digest of the images that you will add to the application version. These are the values used to associate each artifact with the application version.

The response body for each artifact association request will contain an artifact_association_metadata block with an association_id field in it. This field uniquely identifies the association between the artifact and the application version, and is used in requests to remove the association.

Associate a Source Artifact

To associate a source artifact, POST the following body to http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/artifacts.

Note the fields specific to source artifacts in contrast to the image artifact in the next example.

{
    "artifact_type": "source",
    "artifact_keys": {
        "uuid": "<source uuid>"
    }
}

Associate an Image Artifact

To associate an image artifact, POST the following body to http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/artifacts.

Note the fields specific to image artifacts in contrast to the source artifact in the previous example.

{
    "artifact_type": "image",
    "artifact_keys": {
        "image_digest": "<image_digest>"
    }
}

List All Associated Artifacts

Each artifact in the response body will contain an artifact_association_metadata block with an association_id field in it. This field uniquely identifies the association between the artifact and the application version, and is used in requests to remove the association.

List All Artifacts Associated with an Application Version

To list all artifacts associated with an application version, GET http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/artifacts.

Filter the Results by Artifact Type

To filter the results by artifact type, add the artifact_types=<source,image> query parameter.

Remove an Artifact Association

Send a DELETE request to http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/artifacts/<association_id>.

3 - Application Version Operations - Anchore API

Users can perform queries against specific versions of an application.

SBOM for a specific Application Version

Using the application API to generate a combined software bill of materials (SBOM) for all artifacts within an application version. This lets you easily archive the components, or provide them to others for verification process compliance requirements. The data structure metadata for the application and application version, along with the SBOMs for each artifact associated with the application version.

Download a Combined SBOM

To download a combined SBOM, GET the application version SBOM from http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/sboms/native-json.

To filter the results by artifact type, add the artifact_types=<source,image> query parameter.

Vulnerabilities for a specific Application Version

Using the application API, a user can generate a combined list of vulnerabilities found among all artifacts within an application version. This allows easier vulnerability management for any Application Version.

Get a Combined Vulnerabilities List

http://<host:port>/v2/applications/<application_id>/versions/<application_version_id>/vulnerabilities.

Optional query parameter of will_not_fix=<true | false> is provided. When true, the results will include any vulnerabilities that the vendor of an image distribution either disagrees with or does not intend to prioritize for remediation