Manage API keys

Create and manage API keys for Cortex AgentiX integrations.

API keys are used to manage and secure API interactions. An API key is essentially a unique string of alphanumeric characters that acts as a credential, allowing a specific user or application to access and interact with a particular API. When you request data or perform an action through an API call, you must include this API key in the header. Cortex AgentiX then verifies the key's authenticity and, if valid, grants the requested access.

How to create an API key

1. Select Settings → Configurations → Integrations → API Keys → New Key.

2. In the Role tab, perform for the following:

   1. Under Security Level, select the type of API Key you want to generate: Advanced or Standard. The Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks. cURL does not support this but it is suitable with scripts.

   2. Under Role, select the desired level of access for this key. You can select from predefined roles or custom roles. Roles are available according to what was defined in either the Cortex Gateway or Cortex AgentiX Access Management. You can view the configuration of the role selected by expanding the sections under Components. For more information, see Users, groups, and roles in Cortex AgentiX.

      Important

      Ensure the selected role has the appropriate Credentials permission. If you select a role where Credentials is set to None, such as the predefined CLI Role, any API calls made using this key that attempt to fetch, list, create, or modify stored credentials will return a 403 Forbidden error.

   3. (Optional) Under Comment, provide a comment that describes the purpose of the API key.

   4. (Optional) If you want to define a time limit on the API key authentication, select Enable Expiration Date, and select the expiration date and time. You can track the expiration date of each API key in the API Keys page. In addition, Cortex AgentiX displays a API Key Expiration notification in the Notification Center one week and one day prior to the defined expiration date.

3. (Optional) To configure and manage granular scoping for Scope-Based Access Control (SBAC), click the Scope tab, and under Scope Definition, expand the scoping areas that you want to grant the user role access to for this API by clicking the chevron icon (>) beside the scoping area title. The following table explains the options available to configure:

   Important

   Before configuring, ensure that you review the Manage user scope topic.

   Scoping Area	Granular Scoping Configurations
   Cases and Issues	Set the Scope by selecting one of the following: No cases and issues: Defines access to no cases and issues. All cases and issues: Defines access to all cases and issues. Select domains: Defines access to the domains selected to view their related cases and issues. Under Select domains, define the specific domains that you want to grant access.

   Important

   By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensures that the users, user groups, and API Keys defined in Cortex AgentiX are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.

4. Click Generate to generate the API key.

5. Copy the generated API key and click Done.

   Important

   You will not be able to view the API key again after you complete this step. Ensure that you copy the API key before closing the notification.

Actions available on API Keys

Below are some of the main pivot (right-click) options for actions available on each API key listed in the API Keys table. Only tasks that need further explanation are explained below.

Action	Description
View Examples	Copies the Python 3 example, so you can edit it to set up your own API calls.
Copy text to clipboard / Copy entire row	Copies the value of an API setting, such as the ID, to the clipboard by right-clicking the setting and selecting Copy text to clipboard. You can copy all the settings of an API key by right-clicking and selecting Copy entire row.
Filter API keys	Filters the API keys by selecting one of the filter options, such as Show rows 30 days prior to.... You can then adjust the filter options to filter the API keys according to all the available fields.

API enforcement for credentials

If an API key is assigned a role with Credentials set to None:

• Data access: GET or List calls to credential endpoints will fail.

• Modification: POST, PUT, or DELETE calls to create or update credentials will fail.

• Automation: Any scripts or external integrations using this API key to retrieve secrets from the credential store will return an unauthorized error