docs(connectors): Quay (Clair) connector reference (#15284)

Document the Quay container-registry connector: prerequisites (OAuth
token, Clair enabled), the Location/Secret/Namespace/Minimum-Severity
mappings, and the repository -> Record + Clair-report -> finding model
(manifest dedupe, skip-unscanned, Negligible/Unknown -> Informational).

Companion to connectors#729 and dojo-pro#1936.

sc-13766

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

Author: 3 people

docs/content/import_data/pro/connectors/connectors_tool_reference.md

@@ -844,6 +844,28 @@ A Qualys user account with **VMDR API access**, and your subscription's **API se
 
 Each Qualys host becomes a Record. Detections Qualys has marked **Fixed** are excluded, so reimport closes remediated findings.
 
+## **Quay**
+
+The Quay connector uses the Project Quay REST API to discover container repositories and import the vulnerability reports produced by Quay's built-in **Clair** scanner. DefectDojo creates a Record for each Quay **repository** and, on each Sync, reads the Clair security report of every active tag's image manifest.
+
+#### Prerequisites
+
+Security scanning (Clair) must be enabled on your Quay instance, and you will need a Quay **OAuth 2 access token**:
+
+* In Quay, create (or open) an Organization, go to **Applications**, create an OAuth application, then **Generate Token** with at least the **Read repositories** scope. A dedicated application for DefectDojo is recommended.
+* The token is sent as a Bearer token on every request and is never logged.
+
+#### Connector Mappings
+
+1. Enter your Quay base URL in the **Location** field, for example `https://quay.io` or your self-hosted `https://quay.example.com`. The URL must be HTTPS; do not include a trailing API path — DefectDojo constructs the API paths automatically.
+2. Enter the OAuth access token in the **Secret** field.
+3. Optionally, set a **Namespace** to restrict discovery to a single Quay organization or user. Leave blank to discover every repository the token can read.
+4. Optionally, set a **Minimum Severity** to limit which findings are imported.
+
+DefectDojo maps each Quay **repository** to a Record. For each repository it lists the active tags, deduplicates them to their unique image manifests (a manifest shared by multiple tags is scanned once), and reads each manifest's Clair report. Manifests Clair has not finished scanning (for example a multi-architecture manifest list, or an image still queued) are skipped until a later Sync. Each Clair vulnerability becomes a finding — the affected package is the component, the fixed version becomes the mitigation, and Clair's **Negligible**/**Unknown** severities are recorded as **Informational**.
+
+See the [Project Quay API documentation](https://docs.projectquay.io/api_quay.html) and the [Clair documentation](https://quay.github.io/clair/) for more information.
+
 ## **Rapid7 InsightAppSec**
 
 The Rapid7 InsightAppSec connector imports **DAST vulnerability findings** from the InsightAppSec cloud platform, enriched with attack\-module metadata (for example *SQL Injection*), CVSS scores, and the evidence collected by the scan. DefectDojo creates a Record for each InsightAppSec **app**.