Container Analysis API
Container Analysis API
Container Analysis API stores and queries container image metadata — vulnerability scan results (CVE), build provenance, signed attestations, compliance checks.
Native integration with Artifact Registry (auto-scan on push)
Only scans known CVEs — no help for 0-days
Enable Artifact Registry API + Container Analysis API. Pushed images to Artifact Registry are auto-scanned. GET /v1/projects/{project}/notes/{note} to fetch results.
Uptime · 30-day window
About this API
Container Analysis is the core of GCP's container supply-chain security stack. Any image pushed to Artifact Registry is auto-scanned — analyzing base layer OS, installed packages, detecting known CVEs. Results are stored in Container Analysis "occurrences", queryable or pushable via Pub/Sub. This data integrates with CI/CD: CI calls the API before deploy to check "does this image have critical CVEs", failing if so. Combined with Binary Authorization, you can enforce stricter policies — only images signed by attestors (e.g. security-team attestation) can deploy to GKE. Core implementation for SLSA, SBOM, and other supply-chain security standards.
What you can build
- 1CI/CD integration to block deploys on vulnerable images
- 2Generate Software Bill of Materials (SBOM)
- 3Pre-deploy signature verification via Binary Authorization
- 4Compliance audit
Strengths & limitations
Strengths
- Native integration with Artifact Registry (auto-scan on push)
- Based on CVE databases (NVD + multiple commercial sources)
- Combined with Binary Authorization for supply-chain security
Limitations
- Only scans known CVEs — no help for 0-days
- Coverage incomplete for low-code apps (e.g. some game engines)
Example request
curl https://google.com/<endpoint>Getting started
Enable Artifact Registry API + Container Analysis API. Pushed images to Artifact Registry are auto-scanned. GET /v1/projects/{project}/notes/{note} to fetch results.
FAQ
How long does scanning take?+
Small images: a few minutes. Complex images (hundreds of MB + many OS packages): 10-20 minutes.
What are the CVE data sources?+
NVD (public CVE database) + official security advisories from Distroless / Ubuntu / Debian / Alpine + some commercial sources.
Technical details
- Auth type
- unknown
- Pricing
- unknown
- Protocols
- REST
- SDKs
- python, javascript, go, java
- Response time
- 41 ms
- Last health check
- 5/12/2026, 7:37:30 AM
More from Google
Google Workspace Admin SDK API programmatically manages Workspace organizations — users, groups, devices, domains, audit logs, organizational units.
Retrieve AdMob accounts, apps, ad units, ad sources, and generate mediation or network reports.
Work with AdSense Host accounts, ad clients, ad units, reports, and ad code generation from one API surface.
Programmatically manage Apigee organizations, API proxy deployments, attributes, certificates, and hybrid operations.
Google BigQuery API is the REST interface to GCP's flagship data warehouse — execute SQL queries, manage datasets/tables, stream inserts, and use built-in ML.
Control Binary Authorization attestors and policy checks for container images deployed to GKE and Anthos.
Fetch Business Profile location metrics, daily time series, and monthly search keyword impressions.
Google Calendar API lets apps create, read, and update calendar events programmatically — the go-to integration for scheduling apps.