List Scan Policies

GET

/registry/v1/workspaces/{workspace}/engines/{engine}/scan-policies

curl --request GET \
  --url https://example.com/registry/v1/workspaces/example/engines/example/scan-policies

Returns a page of scan policies for the workspace registry, filtered by AIP-160 expression and ordered per AIP-132.

Parameters

Path Parameters

workspace

required

string

engine

required

string

Query Parameters

page_size

integer format: int32

The maximum number of scan policies to return. The service may return fewer than this value. If unspecified, at most 20 scan policies will be returned. The maximum value is 100; values above 100 will be coerced to 100.

page_token

string

filter

string

AIP-160 filter expression. Filterable fields: auto_scan_on_push, block_on_critical_cve, create_time, cve_allowlist, engine, id, update_time, workspace_id.

order_by

string

AIP-132 order_by expression. Sortable fields: create_time, engine, update_time.

skip

string

AIP-158 offset mode: number of resources to skip from the start of the filtered, sorted set. Use EITHER skip (offset paging) OR page_token (cursor paging) — never both in the same request. Supplying both is an invalid request. Default 0 (no skip).

Responses

200

OK

Media type application/json

ListScanPoliciesResponse

Response message for ListScanPolicies.

object

scan_policies

Array<object>

A scan policy configures vulnerability-scanning behaviour for a workspace registry. Scanning is project-wide on the backend, so a scan policy is scoped to the whole workspace.

object

id

stringOutput only

workspace_id

The workspace this scan policy applies to.

stringOutput only

engine

The provider this scan policy applies to.

string format: enum Output only

Allowed values: ENGINE_UNSPECIFIED ENGINE_QIBDO

auto_scan_on_push

Whether every artifact is automatically scanned on push.

boolean

block_on_critical_cve

Whether pushes of artifacts carrying an unresolved critical CVE are blocked.

boolean

cve_allowlist

CVE identifiers that are exempt from the block-on-critical rule.

Array<string>

create_time

string format: date-time Output only

update_time

string format: date-time Output only

next_page_token

string

total_size

Exact count of resources matching the request’s filter and scope (both pagination modes).

string

Example

{
  "scan_policies": [
    {
      "engine": "ENGINE_UNSPECIFIED"
    }
  ]
}

default

Default error response

Media type application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}