> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/administration-and-troubleshooting/integrations/manage-api-keys.md). # Manage API keys API keys are used to manage and secure API interactions. An API key is essentially a unique string of alphanumeric characters that acts as a credential, allowing a specific user or application to access and interact with a particular API. When you request data or perform an action through an API call, you must include this API key in the header. Cortex AgentiX then verifies the key's authenticity and, if valid, grants the requested access.
How to create an API key 1. Select **Settings** → **Configurations** → **Integrations** → **API Keys** → **New Key**. 2. In the **Role** tab, perform for the following: 1. Under **Security Level**, select the type of API Key you want to generate: **Advanced** or **Standard**. The Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks. cURL does not support this but it is suitable with scripts. 2. Under **Role**, select the desired level of access for this key. You can select from predefined roles or custom roles. Roles are available according to what was defined in either the Cortex Gateway or Cortex AgentiX Access Management. You can view the configuration of the role selected by expanding the sections under **Components**. For more information, see [Users, groups, and roles in Cortex AgentiX](/cortex-agentix/configure-cortex-agentix/users-and-roles-management/users-and-roles-in-cortex-agentix.md).

Important

Ensure the selected role has the appropriate Credentials permission. If you select a role where Credentials is set to None, such as the predefined CLI Role, any API calls made using this key that attempt to fetch, list, create, or modify stored credentials will return a 403 Forbidden error.

3. (Optional) Under **Comment**, provide a comment that describes the purpose of the API key. 4. (Optional) If you want to define a time limit on the API key authentication, select **Enable Expiration Date**, and select the expiration date and time. You can track the expiration date of each API key in the **API Keys** page. In addition, Cortex AgentiX displays a API Key Expiration notification in the Notification Center one week and one day prior to the defined expiration date. 3. (Optional) To configure and manage granular scoping for Scope-Based Access Control (SBAC), click the **Scope** tab, and under **Scope Definition**, expand the scoping areas that you want to grant the user role access to for this API by clicking the chevron icon (**>**) beside the scoping area title. The following table explains the options available to configure:

Important

Before configuring, ensure that you review the Manage user scope topic.

| Scoping Area | Granular Scoping Configurations | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cases and Issues |

Set the Scope by selecting one of the following:

|

Important

By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensures that the users, user groups, and API Keys defined in Cortex AgentiX are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.

4. Click **Generate** to generate the API key. 5. Copy the generated API key and click **Done**.

Important

You will not be able to view the API key again after you complete this step. Ensure that you copy the API key before closing the notification.

Actions available on API Keys Below are some of the main pivot (right-click) options for actions available on each API key listed in the API Keys table. Only tasks that need further explanation are explained below. | Action | Description | | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | View Examples | Copies the Python 3 example, so you can edit it to set up your own API calls. | | Copy text to clipboard / Copy entire row | Copies the value of an API setting, such as the ID, to the clipboard by right-clicking the setting and selecting **Copy text to clipboard**. You can copy all the settings of an API key by right-clicking and selecting **Copy entire row**. | | Filter API keys | Filters the API keys by selecting one of the filter options, such as **Show rows 30 days prior to...**. You can then adjust the filter options to filter the API keys according to all the available fields. |
API enforcement for credentials If an API key is assigned a role with **Credentials** set to **None**: * **Data access**: `GET` or `List` calls to credential endpoints will fail. * **Modification**: `POST`, `PUT`, or `DELETE` calls to create or update credentials will fail. * **Automation**: Any scripts or external integrations using this API key to retrieve secrets from the credential store will return an unauthorized error
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/administration-and-troubleshooting/integrations/manage-api-keys.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.