> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-api-overview/readme.md). # Cortex API Documentation Welcome to the Cortex API documentation. This area is the central reference for APIs across the Cortex platform. ## API Reference By Product Choose a Cortex product below to jump to its API reference.

:cloud: Cortex Cloud

Cloud security posture, runtime protection, and workload security APIs. Covers CSPM, CWP, DSPM, CIEM, AppSec, compliance, and more./spaces/ZuJbX2x7VQJhNovscCwE

:shield-halved: Cortex XDR

Extended detection and response APIs for endpoint, network, and cloud data.XDR 5
XDR 3		/spaces/FK89utN7l3ilSek2DmU5

:shield: Cortex XSIAM

Unified security operations APIs for ingestion, AI-driven threat prioritization, and automated response./spaces/1ZrobAtcwfCDWAJAWeuj

:diagram-project: Cortex XSOAR

Security orchestration, automation, and response APIs for playbooks, integrations, and incident management.XSOAR 8
XSOAR 6		/spaces/dXXxClt1YkGQlGTYJWdB

:robot: Cortex AgentiX

APIs for AI security workflows, analyst automation, and guided actions./spaces/jP7n9HvCP3W3VmkFvzE2

:globe: Cortex Xpanse

Attack surface management APIs for asset discovery, exposure identification, and attack-surface remediation./spaces/F7NvUytdKiwfTl1NbkVR
Developers use the **Cortex APIs** to: * **Automate incident and case management** - Retrieve, search, create, and update issues and cases, then push security findings into your SOAR, ticketing, or automation workflows. * **Query your data with XQL** - Run Cortex Query Language (XQL) queries programmatically for threat hunting and analytics, and pull results into custom reports and dashboards. * **Ingest and stream security data** - Ingest alerts, assets, and telemetry, and stream data to external destinations such as SIEMs, webhooks, and data lakes for centralized monitoring. * **Manage cloud security posture** - Onboard cloud accounts and evaluate posture across CSPM, CWP, DSPM, and CIEM, including vulnerability management across cloud, endpoints, and code. * **Embed security into CI/CD** - Manage applications, repositories, detection rules, and scans to shift application security (AppSec/ASPM) left into your development pipelines. * **Administer identity and access** - Programmatically manage roles, user groups, users, API keys, and scope-based access control (SBAC) across the Cortex platform. ***

Join the Discussion

> Join the Palo Alto Networks Live Community to post questions, get help, and share resources with other Cortex developers.

Join the community

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-api-overview/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.