Trivy ACR Scan API

On-demand vulnerability scanning for Azure Container Registry images — devops.azendtech.io

Authentication

All scan and report endpoints require a Bearer token in the Authorization header.

e63183b58b4cc492ffe38654d0b15bb42ded5ae7f85c86ada645537292dee2fb

Endpoints

POST/trivy/scanScan an image — returns findings immediately
GET/trivy/reportsList all past scan reports (summary)
GET/trivy/reports/{scan_id}Full report for a specific scan
GET/trivy/healthHealth check (no auth required)
GET/trivy/metricsPrometheus metrics (no auth required)
GET/trivy/docsInteractive Swagger UI

Scan an image

Provide the full ACR image reference. The severity field is optional (default: CRITICAL,HIGH).

curl -s -X POST https://devops.azendtech.io/trivy/scan   -H "Authorization: Bearer e63183b58b4cc492ffe38654d0b15bb42ded5ae7f85c86ada645537292dee2fb"   -H "Content-Type: application/json"   -d '{"image": "saral.azurecr.io/backend:latest"}'

With a custom severity filter:

curl -s -X POST https://devops.azendtech.io/trivy/scan   -H "Authorization: Bearer e63183b58b4cc492ffe38654d0b15bb42ded5ae7f85c86ada645537292dee2fb"   -H "Content-Type: application/json"   -d '{"image": "saral.azurecr.io/frontend:v2.1", "severity": "CRITICAL,HIGH,MEDIUM"}'

List & retrieve reports

## List all scans (most recent first)
curl -s https://devops.azendtech.io/trivy/reports   -H "Authorization: Bearer e63183b58b4cc492ffe38654d0b15bb42ded5ae7f85c86ada645537292dee2fb" | jq .

## Get a specific report by scan_id
curl -s https://devops.azendtech.io/trivy/reports/20260611-052740-saral.azurecr.io-backend-latest   -H "Authorization: Bearer e63183b58b4cc492ffe38654d0b15bb42ded5ae7f85c86ada645537292dee2fb" | jq .

Available ACR registries

RegistryLogin Server
saralsaral.azurecr.io
pdfgenpdfgen.azurecr.io
registrycchregistrycch.azurecr.io
hlccchhlccch.azurecr.io
acrufngsupae7zycacrufngsupae7zyc.azurecr.io
ignitechatapi20250324185524ignitechatapi20250324185524.azurecr.io

Severity levels

SeverityDescription
CRITICALRemote code execution, data breach risk — fix immediately
HIGHSignificant risk — fix in current sprint
MEDIUMModerate risk — schedule for next release
LOWMinimal risk — track and address periodically
Email alerts are sent to the ops team automatically when a scan finds CRITICAL or HIGH vulnerabilities.

Trivy v0.71.0 — Swagger UI — devops-svr / vm-azdevops-dev