> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cli/self-service-api-keys-for-cli-scans.md).

# Self-service API keys for CLI scans

This self-service model allows developers to programmatically generate task-specific keys for CLI and IDE scans via the Public API. By using a Primary API key as a master credential, developers can provision restricted-access keys, such as `read-only` for local scans, without requiring administrative permissions in the UI. This approach maintains tenant security by ensuring all scans follow the principle of least privilege.

{% hint style="info" %}
**Prerequisite**: You must have sufficient administrative permissions within your tenant to create new roles and manage API keys.
{% endhint %}

{% hint style="info" %}
**Note:** When generating an API key, select the Standard security level. CLI scans fail with the Advanced security level.
{% endhint %}

### Create custom roles

Navigate to your role management settings in the tenant to generate the following three roles with these exact permission sets.

| Role name              | Required permission and description                                                                                          |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| CLI Read-Only Custom   | **CLI Tools View**: Grants permission to run CLI scans and view output locally without uploading results to the tenant       |
| CLI Write Custom       | **CLI Tools View/Edit**: Grants permission to run CLI scans and upload/manage results within the tenant                      |
| Public API (PAPI) Edit | **Public API View/Edit**: Grants the administrative permission required to programmatically generate and manage new API keys |

### Assign roles to a privileged user

To establish a Primary key holder, you must grant a specific privileged user the permissions from all three custom roles. Because the UI allows only one role to be assigned directly to a user, you must use User Groups to grant multiple roles simultaneously.

1. **Create user groups**: Create three separate User Groups in your tenant, assigning one of the custom roles to each group.
2. **Add user to groups**: Add the designated privileged user to all three of these User Groups.
3. **Verify accumulated permissions**: Edit the primary user and ensure that the User Groups field includes the three user groups.

This user now has the combined authority to generate the Primary API Key required to set up programmatic key generation.

### Generate and use API keys

The designated privileged user must manually generate a Primary API Key through the console. This key must be associated with the `CLI Read-Only Custom`, `CLI Write Custom`, and `Public API (PAPI) Edit` roles. The primary key acts as the master credential for subsequent automation.

Using the Primary Key, developers can now make calls to the Public API to generate subsequent keys as needed for IDE or CLI scans:

* To run scans without uploading the results to the platform: Generate a key and associate it only with the `CLI Read-Only Custom` role.
* To run scans and upload the results to the platform: Generate a key and associate it only with the `CLI Write Custom` role.

The following `curl` command demonstrates how developers can use the Primary Key to generate a new API key assigned with the `CLI Read-Only Custom` role:

```programlisting
 curl --request POST \
  --url https://api-viso-k2ibu8behynsxbzuncdau6.xdr-qa2-uat.us.paloaltonetworks.com/public_api/v1/api_keys/generate \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'authorization: <YOUR_PRIMARY_KEY_HERE>' \
  --header 'x-xdr-auth-id: <YOUR_AUTH_ID>' \
  --data '{
  "request_data": {
    "roles": [
      "CLI Read-Only Custom"
    ],
    "security_level": "standard",
    "comment": "Developer CLI Read-Only scan key",
    "expiration": 1773147108
  }
}'
```

For more information about generating API Keys, refer to [Manage API keys](/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/manage-api-keys.md).

To ensure the keys are configured correctly, privileged users can verify their status by navigating to **Settings** → **API Keys**. Locate the generated key in the API Keys inventory and confirm that the Role column reflects the specific custom role assigned rather than a broad administrative role.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cli/self-service-api-keys-for-cli-scans.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.