Aqua Security

Aqua Platform REST API at <your-aqua-server>/api/v2. Resources: images (scan results), vulnerabilities, policies, risks, audit events. GET /api/v2/images/{registry}/{repo}/{tag} returns scan status and vulnerability list. POST /api/v2/scanners/registry for triggering scans. Filtering via query params (severity, fix available, package type). Response is JSON with comprehensive vulnerability metadata (CVE IDs, CVSS scores, fix versions). Pagination via page/pagesize.

Structured JSON error responses with code and message. Scan not found returns 404; invalid image reference returns 400 with detail. Rate limits not prominently documented for the REST API; enterprise deployments have configurable scan queue limits. Trivy results are deterministic and exit-code-based (non-zero = vulnerabilities found) — easy to integrate in CI/CD. Aqua SaaS uptime SLA on enterprise agreements.

Aqua Security provides cloud-native security covering container image vulnerability scanning, Kubernetes runtime protection, IaC scanning, and compliance enforcement (CIS benchmarks, NIST). For agents, the most accessible entry point is Trivy (Aqua's open-source scanner, now the industry standard for container image scanning) which has no API key requirement for local scanning. The commercial Aqua Platform adds a REST API for: querying scan results, managing security policies, accessing runtime events, and generating compliance reports. Useful for security-aware agent pipelines that need to gate on vulnerability scan results. Confidence is docs-derived.

API key auth via X-Api-Key header for SaaS; Aqua Platform (self-hosted) uses username/password or service account tokens. Bearer token auth also supported. Scopes tied to RBAC roles configured in Aqua admin. Service accounts recommended for CI/CD integration. HTTPS enforced. Trivy (open-source) requires no auth for local image scanning.

docs.aquasec.com covers the Aqua Platform API, CLI tools (trivy CLI reference), CI/CD integration guides, and policy configuration. Trivy has excellent standalone documentation at aquasecurity.github.io/trivy. Aqua Platform API docs require account login. Getting started with Trivy is immediate (open-source, CLI install). Aqua Platform requires a commercial license and deployment setup.