> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/policies.md).

# Policies

APIs for managing policies

## List AppSec policies

> Retrieves a list of all Application Security policies. You can filter the results by finding types, actions, status, triggers, and custom policy flag.\
> \
> \> \*\*Required license:\*\*\
> \>\
> \> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing policies"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/policies":{"get":{"operationId":"GetPolicies","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Policy"},"type":"array"}}}}},"parameters":[{"schema":{"type":"array","items":{"$ref":"#/components/schemas/FindingType"}},"in":"query","description":"Type of security finding that the policy targets.","name":"findingTypes","required":false},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnifiedAction"}},"in":"query","name":"actions","description":"Filter policies by action types"},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"$ref":"#/components/schemas/PolicyStatus"},"in":"query","name":"status","description":"Filter policies by status"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Trigger"}},"in":"query","name":"triggers","description":"Filter policies by trigger types","required":false},{"schema":{"type":"boolean"},"in":"query","name":"isCustom","description":"Filter by custom policies (`true`) or system-provided policies (`false`)"}],"tags":["Policies"],"summary":"List AppSec policies","description":"Retrieves a list of all Application Security policies. You can filter the results by finding types, actions, status, triggers, and custom policy flag.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on."}}},"components":{"schemas":{"Policy":{"type":"object","additionalProperties":false,"required":["conditions","id","name","triggers","relatedDetectionRules","createdBy","isCustom","status","version"],"properties":{"dateCreated":{"type":"string","description":"The date and time when the policy was created"},"suggestionHash":{"type":"string","description":"Unique identifier for the suggested policy"},"conditions":{"$ref":"#/components/schemas/CortexCondition"},"description":{"type":"string","description":"Description of the policy"},"id":{"type":"string","description":"Unique identifier for the policy"},"name":{"type":"string","description":"Name of the policy"},"scope":{"$ref":"#/components/schemas/CortexCondition"},"triggers":{"$ref":"#/components/schemas/AppsecPolicyTriggersandActions"},"dateDeleted":{"type":"string","description":"The date and time when the policy was deleted"},"deletedBy":{"type":"string","description":"The user or system that deleted the policy"},"relatedDetectionRules":{"type":"array","description":"List of related detection rules","items":{"type":"string"}},"assetGroupIds":{"type":"array","description":"List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.","items":{"type":"number","format":"double"}},"suggestionId":{"type":"string","description":"Unique identifier for the suggested policy"},"createdBy":{"type":"string","description":"The user or system that created the policy"},"dateModified":{"type":"string","description":"The date and time when the policy was last modified"},"isClonable":{"type":"boolean","description":"Indicates if the policy is cloneable"},"isCustom":{"type":"boolean","description":"Indicates if the policy is a custom policy or a system-provided policy"},"isEditable":{"type":"boolean","description":"Indicates if the policy is editable"},"lastTriggered":{"type":"string","description":"The date and time when the policy was last triggered"},"modifiedBy":{"type":"string","description":"The user or system that last modified the policy"},"overrideIssueSeverity":{"description":"Set the severity of the issue and override the system severity. If not used, system severity is kept.","enum":["Critical","High","Medium","Low"]},"policyType":{"type":"string","description":"Indicates the policy type. Auto-assigned by the API based on the `Finding Type` in conditions. **Possible values**:\n- `code_image_scanners`: for VULNERABILITY, IAC_MISCONFIGURATION, SECRETS, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE\n- `cicd_configuration_scanners`: for CICD_RISKS\n- `drift_detection_scanners`: for DRIFT"},"scopeFields":{"type":"object","description":"Defines all valid scope fields grouped by category for code, CI/CD, drift, and common contexts.","required":["applicationsScopeFields","cicdOnlyScopeFields","codeOnlyScopeFields","commonScopeFields","defaultScopeFields","driftOnlyScopeFields"],"properties":{"applicationsScopeFields":{"description":"Fields that apply applications scopes.","type":"array","items":{"enum":["application_business_criticality","application_business_owner"]}},"cicdOnlyScopeFields":{"type":"array","description":"Fields that only apply to CI/CD related scope keys.","items":{"enum":["cicd_instance_id","cicd_instance_name","cicd_pipeline_id","cicd_pipeline_name","collaborator_email","collaborator_inactive_days","collaborator_mfa_enabled","collaborator_name","repository_organization","repository_organization_name"]}},"codeOnlyScopeFields":{"type":"array","description":"Fields that only apply to code repository scope keys.","items":{"enum":["has_access_sensitive_data","has_deployed_assets","has_internet_exposed","has_leverage_privileged_capabilities"]}},"commonScopeFields":{"type":"array","description":"Fields that apply to both code and CI/CD scopes.","items":{"enum":["business_application_names","category","is_public_repository","repository_id","repository_name","repository_provider","xdm__asset__tags"]}},"defaultScopeFields":{"type":"array","description":"Fields that comes as default in the finding.","items":{"enum":["xdm__asset__id","xdm__asset__name"]}},"driftOnlyScopeFields":{"type":"array","description":"Fields that only apply to IAC drift scope keys.","items":{"enum":["cloud_account","cloud_region"]}}}},"status":{"$ref":"#/components/schemas/PolicyStatus"},"version":{"type":"number","format":"double","description":"The version of the policy - goes up by one every policy update"}}},"CortexCondition":{"type":"object","title":"CortexCondition","description":"Condition or scope filter for the policy. ","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Field the condition filter matches."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"The value compared against. The type of this field will differ depending on the `SEARCH_FIELD` that was specified.","anyOf":[{"type":"boolean"},{"$ref":"#/components/schemas/ConditionValue"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionOperators":{"type":"string","enum":["ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","CONTAINS","CONTAINS_IN_LIST","EQ","GT","GTE","IN","JSON_WILDCARD","JSON_WILDCARD_NOT","LTE","LT","NCONTAINS","NEQ","NIN","NOT_CONTAINS_IN_LIST","RANGE","RELATIVE_TIMESTAMP","WILDCARD","WILDCARD_NOT","withinGracePeriod"],"title":"ConditionOperators","description":"Condition operator for this filter."},"ConditionValue":{"properties":{"from":{"type":"number","format":"double","description":"The lower bound of a range query."},"to":{"type":"number","format":"double","description":"The upper bound of a range query."},"key":{"type":"string","description":"The key for key-value pair matching."},"value":{"type":"string","description":"The value for key-value pair matching."}},"type":"object","additionalProperties":false,"description":"A structured condition value used for range queries or key-value pair matching."},"AppsecPolicyTriggersandActions":{"title":"AppsecPolicyTriggersandActions","type":"object","description":"Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have `isEnabled` set to `true`.","required":["cicd","ciImage","imageRegistry","periodic","pr"],"properties":{"cicd":{"type":"object","description":"Configuration for the CI Code  trigger. If `true`, the policy is evaluated on CI/CD pipeline events.","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI/CD pipeline."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Code Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"ciImage":{"type":"object","description":"Configuration for the CI image trigger. If `true`, the policy is evaluated during CI image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI image."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI image in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Image Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"imageRegistry":{"type":"object","description":"Configuration for the image registry trigger. If `true`, the policy is evaluated during registry image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the Registry Image Scan trigger is enabled."},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"periodic":{"type":"object","minProperties":1,"maxProperties":3,"description":"Configuration for the periodic code scan (scheduled) trigger. If `true`, the policy is evaluated.","required":["actions","isEnabled"],"properties":{"actions":{"type":"object","minProperties":1,"maxProperties":2,"description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","default":true,"description":"Indicates whether the Periodic Scan trigger is enabled."},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"pr":{"type":"object","description":"Configuration for the pull request (PR) trigger. If `true`, the policy is evaluated on Pull Request (PR) events","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered. ","required":["blockPr","reportIssue","reportPrComment"],"properties":{"blockPr":{"type":"boolean","description":"Indicates if triggering the policy should block the pull request."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."},"reportPrComment":{"type":"boolean","description":"Indicates if triggering the policy should create comments on the pull request."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the PR Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}}}},"PolicyStatus":{"description":"Current status of the policy.","enum":["disabled","enabled"],"type":"string","default":"enabled"},"FindingType":{"enum":["CICD_RISKS","VULNERABILITY","SECRETS","IAC_MISCONFIGURATION","CODE_WEAKNESS","LICENSES","OPERATIONAL_RISK","MALWARE","DRIFT"],"type":"string"},"UnifiedAction":{"description":"The type of action that can be taken when a policy is triggered.\n- `blockCicd`: Block the CI/CD pipeline\n- `blockCiImage`: Block the CI image build\n- `blockPr`: Block the pull request\n- `reportCicd`: Soft fail the CI/CD pipeline\n- `reportIssue`: Create an issue in the connected system\n- `reportPrComment`: Create comments on the pull request","enum":["blockCiImage","blockCicd","blockPr","reportCicd","reportIssue","reportPrComment"],"type":"string"},"Trigger":{"enum":["periodic","cicd","pr","ciImage","imageRegistry"],"type":"string","description":"The type of trigger that evaluates the policy."}}}}
```

## Create an AppSec policy

> Creates a new Application Security policy.\
> \
> An application security policy defines how a system responds to application security threats. Each policy consists of \*\*Conditions\*\*, \*\*Scope\*\*, \*\*Triggers\*\*, and \*\*Actions\*\*. \
> \
> \*\*Triggers\*\* determine the execution context, such as a Pull Request, CI pipeline, registry scan, or periodic code scan, while \*\*Actions\*\* are executed only when both the \*\*Condition\*\* and \*\*Scope\*\* criteria are met. \
> \
> \*\*Actions\*\* can include generating a remediation issue for detection or actively blocking threats within the PR or CI workflow. \
> \
> \> \*\*Note:\*\* To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\
> \
> \
> \> \*\*Required license:\*\*\
> \>\
> \> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\
> \
> \#### Limitations\
> \
> Be aware of the following limitations when creating policies:\
> \
> \##### Trigger and Action Constraints by Finding Type\
> \
> 2\. \*\*Code & Image scanners Finding Types\*\* (for example, \`IAC\_MISCONFIGURATION\`, \`SECRETS\`, \`VULNERABILITY\`, \`LICENSES\`, \`OPERATIONAL\_RISK\`, \`CODE\_WEAKNESS\`, and \`MALWARE\`)\
> \
>    \* For \*\*scope filters\*\*, only the following parameters are supported:\
>      \* Category\
>      \* Asset Type\
>      \* Provider\
>      \* Business Application Names\
>      \* Application Business Criticality\
>      \* Application Business Owner\
>      \* Tags\
>      \* Image Names\
>      \* Source Branch\
>      \* Repository Name\
>      \* Repository Id\
>      \* Is Public Repository\
>      \* Has Deployed Assets\
>      \* Has Internet-exposed deployed assets\
>      \* Has deployed assets with Access to sensitive data\
>      \* Has deployed assets with privileged capabilities\
>      \* Repository labels\
>      \* Image Architecture\
>      \* Organization URL\
>    \* The \`category\` parameter only supports \`Application\`, \`Container Image\` and \`Repository\` values.     \
>    \* Setting the \`overrideIssueSeverity\` parameter is mandatory when \`ciImage\` or \`imageRegistry\` actions are enabled.\
> \
> 2\. \*\*CI/CD Risks Finding Type\*\* (\`CICD\_RISKS\`)\
> \
>    \* Only the Code \*\*Periodic Scan\*\* trigger is supported.\
>    \* Only the \*\*reportIssue\*\* action is available.\
>    \* For \*\*conditions\*\*, the \`category\` parameter supports only the following values:\
>      \* Category\
>      \* Application\
>      \* CI/CD Instance\
>      \* CI/CD Pipeline\
>      \* VCS Collaborator\
>      \* VCS Organization\
>    \* For \*\*scope filters\*\*, only the following parameters are supported:\
>      \* Asset Type\
>      \* Provider\
>      \* Tags\
>      \* Business Application Names\
>      \* Application Business Criticality\
>      \* CI/CD Instance Name\
>      \* CI/CD Instance Id\
>      \* CI/CD Pipeline Name\
>      \* CI/CD Pipeline Id\
>      \* VCS Collaborator Name\
>      \* VCS Collaborator Email\
>      \* VCS Collaborator MFA Enabled\
>      \* VCS Collaborator Last Observed\
>      \* VCS Organization Name\
>      \* Repository Name\
>      \* Repository Id\
>      \* Is Public Repository\
>    \
> 3\. \*\*Drift Finding Type\*\* (\`DRIFT\`)\
> \
>    \* Only the Code \*\*Periodic Scan\*\* trigger is supported.\
>    \* Only the \*\*reportIssue\*\* action is available.\
>    \* For \*\*conditions\*\*, the \`category\` parameter only supports \`Application\` and \`Repository\` values.\
>    \* For \*\*scope filters\*\*, only the following parameters are supported:\
>      \* Category\
>      \* Provider\
>      \* Business Application Names\
>      \* Application Business Criticality\
>      \* Application Business Owner\
>      \* Cloud Account\
>      \* Cloud Region\
>      \* Repository Name\
>      \* Repository Id\
>      \* Is Public Repository\
>      \* Has Deployed Assets\
>      \* Has Internet-exposed deployed assets\
>      \* Has deployed assets with Access to sensitive data\
>      \* Has deployed assets with privileged capabilities\
> \
> \##### General Policy Constraints\
> 1\. \*\*Third-Party Integration Data\*\*\
> \
>    \* For ingested data from third-party integrations:\
> \
>      \* Only the \*\*periodic\*\* scan trigger is supported, along with the \`ingestedData\` action that must be explicitly configured.\
> \
> \
> 2\. \*\*Multiple Finding Types in Conditions\*\*\
> \
>    \* When selecting multiple \`Finding Type\` values within a single condition, only common filters across those types are available.\
>    \* To use filters specific to a \`Finding Type\`, add another condition group that is separated by the \*\*OR\*\* operator.\
> \
> 3\. \*\*Condition and Scope Depth\*\*\
> \
>    \* The UI supports up to \*\*2 levels\*\* of depth for conditions and scope.\
>    \* The API allows up to \*\*10 levels\*\* of depth for more complex policy configurations.\
> \
> 4\. \*\*Scope vs. Asset Groups\*\*\
> \
>    \* You must define either a \*\*scope\*\* (detailed asset filters) or specify \*\*assetGroupIds\*\*, but \*\*not\*\* both in the same policy.\
>    \* If both fields are defined (contain values), then only the \*\*assetGroupIds\*\* will be applied and the \*\*scope\*\* will be ignored.\
> \
> 5\. \*\*Empty Results during Configuration\*\*\
> \
>    \* \`Conditions\` and \`scope\` filters may return \*\*empty results\*\* during policy configuration.\
>    \* Policies can still be saved for future use. \
> &#x20;  \* Once the policies are active, they will evaluate the conditions and trigger defined actions if matching results are found.<br>

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing policies"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/policies":{"post":{"tags":["Policies"],"summary":"Create an AppSec policy","description":"Creates a new Application Security policy.\n\nAn application security policy defines how a system responds to application security threats. Each policy consists of **Conditions**, **Scope**, **Triggers**, and **Actions**. \n\n**Triggers** determine the execution context, such as a Pull Request, CI pipeline, registry scan, or periodic code scan, while **Actions** are executed only when both the **Condition** and **Scope** criteria are met. \n\n**Actions** can include generating a remediation issue for detection or actively blocking threats within the PR or CI workflow. \n\n> **Note:** To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\n\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n\n#### Limitations\n\nBe aware of the following limitations when creating policies:\n\n##### Trigger and Action Constraints by Finding Type\n\n2. **Code & Image scanners Finding Types** (for example, `IAC_MISCONFIGURATION`, `SECRETS`, `VULNERABILITY`, `LICENSES`, `OPERATIONAL_RISK`, `CODE_WEAKNESS`, and `MALWARE`)\n\n   * For **scope filters**, only the following parameters are supported:\n     * Category\n     * Asset Type\n     * Provider\n     * Business Application Names\n     * Application Business Criticality\n     * Application Business Owner\n     * Tags\n     * Image Names\n     * Source Branch\n     * Repository Name\n     * Repository Id\n     * Is Public Repository\n     * Has Deployed Assets\n     * Has Internet-exposed deployed assets\n     * Has deployed assets with Access to sensitive data\n     * Has deployed assets with privileged capabilities\n     * Repository labels\n     * Image Architecture\n     * Organization URL\n   * The `category` parameter only supports `Application`, `Container Image` and `Repository` values.     \n   * Setting the `overrideIssueSeverity` parameter is mandatory when `ciImage` or `imageRegistry` actions are enabled.\n\n2. **CI/CD Risks Finding Type** (`CICD_RISKS`)\n\n   * Only the Code **Periodic Scan** trigger is supported.\n   * Only the **reportIssue** action is available.\n   * For **conditions**, the `category` parameter supports only the following values:\n     * Category\n     * Application\n     * CI/CD Instance\n     * CI/CD Pipeline\n     * VCS Collaborator\n     * VCS Organization\n   * For **scope filters**, only the following parameters are supported:\n     * Asset Type\n     * Provider\n     * Tags\n     * Business Application Names\n     * Application Business Criticality\n     * CI/CD Instance Name\n     * CI/CD Instance Id\n     * CI/CD Pipeline Name\n     * CI/CD Pipeline Id\n     * VCS Collaborator Name\n     * VCS Collaborator Email\n     * VCS Collaborator MFA Enabled\n     * VCS Collaborator Last Observed\n     * VCS Organization Name\n     * Repository Name\n     * Repository Id\n     * Is Public Repository\n   \n3. **Drift Finding Type** (`DRIFT`)\n\n   * Only the Code **Periodic Scan** trigger is supported.\n   * Only the **reportIssue** action is available.\n   * For **conditions**, the `category` parameter only supports `Application` and `Repository` values.\n   * For **scope filters**, only the following parameters are supported:\n     * Category\n     * Provider\n     * Business Application Names\n     * Application Business Criticality\n     * Application Business Owner\n     * Cloud Account\n     * Cloud Region\n     * Repository Name\n     * Repository Id\n     * Is Public Repository\n     * Has Deployed Assets\n     * Has Internet-exposed deployed assets\n     * Has deployed assets with Access to sensitive data\n     * Has deployed assets with privileged capabilities\n\n##### General Policy Constraints\n1. **Third-Party Integration Data**\n\n   * For ingested data from third-party integrations:\n\n     * Only the **periodic** scan trigger is supported, along with the `ingestedData` action that must be explicitly configured.\n\n\n2. **Multiple Finding Types in Conditions**\n\n   * When selecting multiple `Finding Type` values within a single condition, only common filters across those types are available.\n   * To use filters specific to a `Finding Type`, add another condition group that is separated by the **OR** operator.\n\n3. **Condition and Scope Depth**\n\n   * The UI supports up to **2 levels** of depth for conditions and scope.\n   * The API allows up to **10 levels** of depth for more complex policy configurations.\n\n4. **Scope vs. Asset Groups**\n\n   * You must define either a **scope** (detailed asset filters) or specify **assetGroupIds**, but **not** both in the same policy.\n   * If both fields are defined (contain values), then only the **assetGroupIds** will be applied and the **scope** will be ignored.\n\n5. **Empty Results during Configuration**\n\n   * `Conditions` and `scope` filters may return **empty results** during policy configuration.\n   * Policies can still be saved for future use. \n   * Once the policies are active, they will evaluate the conditions and trigger defined actions if matching results are found.\n","operationId":"CreatePolicy","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateRequest"}}}},"responses":{"204":{"description":"No content"},"400":{"description":"Bad Request\r\n\r\nThe error occurs when the server cannot process the request due to client-side errors in the request body. The error is returned when:  \r\n* Required fields are missing\r\n* Field values are invalid (for example, incorrect `SEARCH_TYPE` for the given `SEARCH_FIELD`)\r\n* The JSON request body is not structured properly (invalid payload structure)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"The HTTP error category. Indicates the general type of error that occurred."},"message":{"type":"string","description":"A human-readable message with specific details about why the request failed."}}}}}},"409":{"description":"Conflict.\r\n\r\n**Resolution**\r\n\r\nUse a unique policy name that does not match any existing policy.\r\n\r\n","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"The HTTP error category. Indicates the general type of error that occurred."},"message":{"type":"string","description":"A human-readable message with specific details about why the request failed."}}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string","description":"The HTTP error category. Indicates the general type of error that occurred."},"message":{"type":"string","description":"A human-readable message with specific details about why the request failed."}}}}}}}}}},"components":{"schemas":{"CreateRequest":{"type":"object","title":"CreateRequest","description":"Define the Application Security policy. \n\n**Notes:** \n- The `policyType` field is auto-assigned by the API based on the `Finding Type` in conditions, it is not set in the request body.\n- The `conditions` and `scope` fields are required. The `scope` can be set to `{}` for global scope.\"","additionalProperties":false,"required":["conditions","name","scope","triggers"],"properties":{"conditions":{"$ref":"#/components/schemas/PolicyCondition"},"description":{"type":"string","description":"A brief description of the AppSec policy's purpose."},"name":{"type":"string","description":"A unique name for the AppSec policy."},"scope":{"$ref":"#/components/schemas/PolicyScope"},"triggers":{"$ref":"#/components/schemas/AppsecPolicyTriggersandActions"},"enabled":{"type":"boolean","description":"Whether the policy is enabled upon creation."},"assetGroupIds":{"type":"array","description":"A list of asset group IDs that the policy should apply to. If the list is empty, the policy applies globally, unless other scope conditions are defined.\r\n**Note** : Cannot be used with the `scope` parameter.","items":{"type":"number","format":"double"}},"suggestionId":{"type":"string","description":"Unique identifier for the suggested policy to link this policy to."},"userSbac":{"type":"array","description":"Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is created. Controls which asset groups the policy applies to based on the creator's access. When empty, the policy applies to all user scoped asset groups.","items":{"type":"number","format":"double"}}}},"PolicyCondition":{"type":"object","title":"PolicyCondition","description":"Defines the specific criteria (conditions) that will trigger the policy. You can combine multiple conditions to create complex rules for when the policy should be applied. If you combine multiple `Finding Type` values using `OR`, only the common fields across those types will be valid.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Selecting `Finding Type` determines which condition fields you can configure. Each `Finding Type` supports a specific set of condition fields. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table.","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Defines the field the condition filter should match. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.","anyOf":[{"type":"boolean"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionOperators":{"type":"string","enum":["ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","CONTAINS","CONTAINS_IN_LIST","EQ","GT","GTE","IN","JSON_WILDCARD","JSON_WILDCARD_NOT","LTE","LT","NCONTAINS","NEQ","NIN","NOT_CONTAINS_IN_LIST","RANGE","RELATIVE_TIMESTAMP","WILDCARD","WILDCARD_NOT","withinGracePeriod"],"title":"ConditionOperators","description":"Condition operator for this filter."},"CortexCondition":{"type":"object","title":"CortexCondition","description":"Condition or scope filter for the policy. ","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Field the condition filter matches."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"The value compared against. The type of this field will differ depending on the `SEARCH_FIELD` that was specified.","anyOf":[{"type":"boolean"},{"$ref":"#/components/schemas/ConditionValue"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionValue":{"properties":{"from":{"type":"number","format":"double","description":"The lower bound of a range query."},"to":{"type":"number","format":"double","description":"The upper bound of a range query."},"key":{"type":"string","description":"The key for key-value pair matching."},"value":{"type":"string","description":"The value for key-value pair matching."}},"type":"object","additionalProperties":false,"description":"A structured condition value used for range queries or key-value pair matching."},"PolicyScope":{"type":"object","title":"PolicyScope","description":"Defines the type of assets to be evaluated by the policy (the scope). You can combine multiple conditions to create complex rules for when the policy should be applied.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Cannot be used if `assetGroupIds` are set.\n\nFor the list of available scope fields, see [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables).","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Defines the field the matching criteria filter should match. To see which fields are allowed for each type, see the [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.","anyOf":[{"type":"boolean"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"AppsecPolicyTriggersandActions":{"title":"AppsecPolicyTriggersandActions","type":"object","description":"Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have `isEnabled` set to `true`.","required":["cicd","ciImage","imageRegistry","periodic","pr"],"properties":{"cicd":{"type":"object","description":"Configuration for the CI Code  trigger. If `true`, the policy is evaluated on CI/CD pipeline events.","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI/CD pipeline."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Code Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"ciImage":{"type":"object","description":"Configuration for the CI image trigger. If `true`, the policy is evaluated during CI image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI image."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI image in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Image Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"imageRegistry":{"type":"object","description":"Configuration for the image registry trigger. If `true`, the policy is evaluated during registry image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the Registry Image Scan trigger is enabled."},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"periodic":{"type":"object","minProperties":1,"maxProperties":3,"description":"Configuration for the periodic code scan (scheduled) trigger. If `true`, the policy is evaluated.","required":["actions","isEnabled"],"properties":{"actions":{"type":"object","minProperties":1,"maxProperties":2,"description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","default":true,"description":"Indicates whether the Periodic Scan trigger is enabled."},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"pr":{"type":"object","description":"Configuration for the pull request (PR) trigger. If `true`, the policy is evaluated on Pull Request (PR) events","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered. ","required":["blockPr","reportIssue","reportPrComment"],"properties":{"blockPr":{"type":"boolean","description":"Indicates if triggering the policy should block the pull request."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."},"reportPrComment":{"type":"boolean","description":"Indicates if triggering the policy should create comments on the pull request."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the PR Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}}}}}}}
```

## Get an AppSec policy

> Retrieves detailed information for a specific Application Security policy using its unique policy ID.\
> \
> \> \*\*Required license:\*\*\
> \>\
> \> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.<br>

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing policies"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/policies/{policyId}":{"get":{"operationId":"GetPolicy","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Policy"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"in":"path","name":"policyId","description":"Unique identifier for the policy","required":true,"schema":{"type":"string"}}],"tags":["Policies"],"summary":"Get an AppSec policy","description":"Retrieves detailed information for a specific Application Security policy using its unique policy ID.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.\n"}}},"components":{"schemas":{"Policy":{"type":"object","additionalProperties":false,"required":["conditions","id","name","triggers","relatedDetectionRules","createdBy","isCustom","status","version"],"properties":{"dateCreated":{"type":"string","description":"The date and time when the policy was created"},"suggestionHash":{"type":"string","description":"Unique identifier for the suggested policy"},"conditions":{"$ref":"#/components/schemas/CortexCondition"},"description":{"type":"string","description":"Description of the policy"},"id":{"type":"string","description":"Unique identifier for the policy"},"name":{"type":"string","description":"Name of the policy"},"scope":{"$ref":"#/components/schemas/CortexCondition"},"triggers":{"$ref":"#/components/schemas/AppsecPolicyTriggersandActions"},"dateDeleted":{"type":"string","description":"The date and time when the policy was deleted"},"deletedBy":{"type":"string","description":"The user or system that deleted the policy"},"relatedDetectionRules":{"type":"array","description":"List of related detection rules","items":{"type":"string"}},"assetGroupIds":{"type":"array","description":"List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.","items":{"type":"number","format":"double"}},"suggestionId":{"type":"string","description":"Unique identifier for the suggested policy"},"createdBy":{"type":"string","description":"The user or system that created the policy"},"dateModified":{"type":"string","description":"The date and time when the policy was last modified"},"isClonable":{"type":"boolean","description":"Indicates if the policy is cloneable"},"isCustom":{"type":"boolean","description":"Indicates if the policy is a custom policy or a system-provided policy"},"isEditable":{"type":"boolean","description":"Indicates if the policy is editable"},"lastTriggered":{"type":"string","description":"The date and time when the policy was last triggered"},"modifiedBy":{"type":"string","description":"The user or system that last modified the policy"},"overrideIssueSeverity":{"description":"Set the severity of the issue and override the system severity. If not used, system severity is kept.","enum":["Critical","High","Medium","Low"]},"policyType":{"type":"string","description":"Indicates the policy type. Auto-assigned by the API based on the `Finding Type` in conditions. **Possible values**:\n- `code_image_scanners`: for VULNERABILITY, IAC_MISCONFIGURATION, SECRETS, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE\n- `cicd_configuration_scanners`: for CICD_RISKS\n- `drift_detection_scanners`: for DRIFT"},"scopeFields":{"type":"object","description":"Defines all valid scope fields grouped by category for code, CI/CD, drift, and common contexts.","required":["applicationsScopeFields","cicdOnlyScopeFields","codeOnlyScopeFields","commonScopeFields","defaultScopeFields","driftOnlyScopeFields"],"properties":{"applicationsScopeFields":{"description":"Fields that apply applications scopes.","type":"array","items":{"enum":["application_business_criticality","application_business_owner"]}},"cicdOnlyScopeFields":{"type":"array","description":"Fields that only apply to CI/CD related scope keys.","items":{"enum":["cicd_instance_id","cicd_instance_name","cicd_pipeline_id","cicd_pipeline_name","collaborator_email","collaborator_inactive_days","collaborator_mfa_enabled","collaborator_name","repository_organization","repository_organization_name"]}},"codeOnlyScopeFields":{"type":"array","description":"Fields that only apply to code repository scope keys.","items":{"enum":["has_access_sensitive_data","has_deployed_assets","has_internet_exposed","has_leverage_privileged_capabilities"]}},"commonScopeFields":{"type":"array","description":"Fields that apply to both code and CI/CD scopes.","items":{"enum":["business_application_names","category","is_public_repository","repository_id","repository_name","repository_provider","xdm__asset__tags"]}},"defaultScopeFields":{"type":"array","description":"Fields that comes as default in the finding.","items":{"enum":["xdm__asset__id","xdm__asset__name"]}},"driftOnlyScopeFields":{"type":"array","description":"Fields that only apply to IAC drift scope keys.","items":{"enum":["cloud_account","cloud_region"]}}}},"status":{"$ref":"#/components/schemas/PolicyStatus"},"version":{"type":"number","format":"double","description":"The version of the policy - goes up by one every policy update"}}},"CortexCondition":{"type":"object","title":"CortexCondition","description":"Condition or scope filter for the policy. ","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Field the condition filter matches."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"The value compared against. The type of this field will differ depending on the `SEARCH_FIELD` that was specified.","anyOf":[{"type":"boolean"},{"$ref":"#/components/schemas/ConditionValue"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionOperators":{"type":"string","enum":["ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","CONTAINS","CONTAINS_IN_LIST","EQ","GT","GTE","IN","JSON_WILDCARD","JSON_WILDCARD_NOT","LTE","LT","NCONTAINS","NEQ","NIN","NOT_CONTAINS_IN_LIST","RANGE","RELATIVE_TIMESTAMP","WILDCARD","WILDCARD_NOT","withinGracePeriod"],"title":"ConditionOperators","description":"Condition operator for this filter."},"ConditionValue":{"properties":{"from":{"type":"number","format":"double","description":"The lower bound of a range query."},"to":{"type":"number","format":"double","description":"The upper bound of a range query."},"key":{"type":"string","description":"The key for key-value pair matching."},"value":{"type":"string","description":"The value for key-value pair matching."}},"type":"object","additionalProperties":false,"description":"A structured condition value used for range queries or key-value pair matching."},"AppsecPolicyTriggersandActions":{"title":"AppsecPolicyTriggersandActions","type":"object","description":"Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have `isEnabled` set to `true`.","required":["cicd","ciImage","imageRegistry","periodic","pr"],"properties":{"cicd":{"type":"object","description":"Configuration for the CI Code  trigger. If `true`, the policy is evaluated on CI/CD pipeline events.","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI/CD pipeline."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Code Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"ciImage":{"type":"object","description":"Configuration for the CI image trigger. If `true`, the policy is evaluated during CI image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI image."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI image in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Image Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"imageRegistry":{"type":"object","description":"Configuration for the image registry trigger. If `true`, the policy is evaluated during registry image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the Registry Image Scan trigger is enabled."},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"periodic":{"type":"object","minProperties":1,"maxProperties":3,"description":"Configuration for the periodic code scan (scheduled) trigger. If `true`, the policy is evaluated.","required":["actions","isEnabled"],"properties":{"actions":{"type":"object","minProperties":1,"maxProperties":2,"description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","default":true,"description":"Indicates whether the Periodic Scan trigger is enabled."},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"pr":{"type":"object","description":"Configuration for the pull request (PR) trigger. If `true`, the policy is evaluated on Pull Request (PR) events","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered. ","required":["blockPr","reportIssue","reportPrComment"],"properties":{"blockPr":{"type":"boolean","description":"Indicates if triggering the policy should block the pull request."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."},"reportPrComment":{"type":"boolean","description":"Indicates if triggering the policy should create comments on the pull request."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the PR Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}}}},"PolicyStatus":{"description":"Current status of the policy.","enum":["disabled","enabled"],"type":"string","default":"enabled"}}}}
```

## Update an AppSec policy

> Updates an existing Application Security policy by policy ID. Use this endpoint to modify the policy’s \*\*Conditions\*\*, \*\*Scope\*\*, \*\*Triggers\*\* or \*\*Actions\*\*. \
> \
> \
> \> \*\*Note:\*\* To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\
> \
> \> \*\*Required license:\*\*\
> \>\
> \> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing policies"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/policies/{policyId}":{"put":{"operationId":"UpdatePolicy","responses":{"204":{"description":"No content"},"422":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"The HTTP error category. Indicates the general type of error that occurred."},"message":{"type":"string","description":"A human-readable message with specific details about why the request failed. Use this message for debugging and troubleshooting."}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"in":"path","name":"policyId","description":"Unique identifier for the policy","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateRequest"}}}},"summary":"Update an AppSec policy","tags":["Policies"],"description":"Updates an existing Application Security policy by policy ID. Use this endpoint to modify the policy’s **Conditions**, **Scope**, **Triggers** or **Actions**. \n\n\n> **Note:** To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on."}}},"components":{"schemas":{"UpdateRequest":{"$ref":"#/components/schemas/Partial_BasePolicyRequest"},"Partial_BasePolicyRequest":{"type":"object","required":["conditions","scope"],"properties":{"name":{"type":"string","description":"A unique name for the AppSec policy."},"description":{"type":"string","description":"A brief description of the AppSec policy's purpose."},"conditions":{"$ref":"#/components/schemas/PolicyCondition"},"scope":{"$ref":"#/components/schemas/PolicyScope"},"triggers":{"$ref":"#/components/schemas/AppsecPolicyTriggersandActions"},"relatedDetectionRules":{"type":"array","description":"List of related detection rules.","items":{"type":"string"}},"enabled":{"type":"boolean","description":"Whether the policy is enabled."},"suggestionId":{"type":"string","description":"Unique identifier for the suggested policy."},"assetGroupIds":{"type":"array","description":"List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.","items":{"type":"number","format":"double"}},"userSbac":{"type":"array","description":"Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is modified. Controls which asset groups the policy applies to based on the modifier's access. When empty, the policy applies to all asset groups.","items":{"type":"number","format":"double"}}}},"PolicyCondition":{"type":"object","title":"PolicyCondition","description":"Defines the specific criteria (conditions) that will trigger the policy. You can combine multiple conditions to create complex rules for when the policy should be applied. If you combine multiple `Finding Type` values using `OR`, only the common fields across those types will be valid.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Selecting `Finding Type` determines which condition fields you can configure. Each `Finding Type` supports a specific set of condition fields. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table.","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Defines the field the condition filter should match. To see which fields are allowed for each type, see the [Supported Condition Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.","anyOf":[{"type":"boolean"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionOperators":{"type":"string","enum":["ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","CONTAINS","CONTAINS_IN_LIST","EQ","GT","GTE","IN","JSON_WILDCARD","JSON_WILDCARD_NOT","LTE","LT","NCONTAINS","NEQ","NIN","NOT_CONTAINS_IN_LIST","RANGE","RELATIVE_TIMESTAMP","WILDCARD","WILDCARD_NOT","withinGracePeriod"],"title":"ConditionOperators","description":"Condition operator for this filter."},"CortexCondition":{"type":"object","title":"CortexCondition","description":"Condition or scope filter for the policy. ","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Field the condition filter matches."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"The value compared against. The type of this field will differ depending on the `SEARCH_FIELD` that was specified.","anyOf":[{"type":"boolean"},{"$ref":"#/components/schemas/ConditionValue"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"ConditionValue":{"properties":{"from":{"type":"number","format":"double","description":"The lower bound of a range query."},"to":{"type":"number","format":"double","description":"The upper bound of a range query."},"key":{"type":"string","description":"The key for key-value pair matching."},"value":{"type":"string","description":"The value for key-value pair matching."}},"type":"object","additionalProperties":false,"description":"A structured condition value used for range queries or key-value pair matching."},"PolicyScope":{"type":"object","title":"PolicyScope","description":"Defines the type of assets to be evaluated by the policy (the scope). You can combine multiple conditions to create complex rules for when the policy should be applied.\n\n**Note:** \n* When used in `AND`, all conditions within this array must be met. \n* When used in `OR`, at least one condition within this array must be met.\n* Cannot be used if `assetGroupIds` are set.\n\nFor the list of available scope fields, see [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables).","additionalProperties":false,"required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Defines the field the matching criteria filter should match. To see which fields are allowed for each type, see the [Supported Scope Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/aspm-cicd-and-application-security/appsec-papi-tables) table."},"SEARCH_TYPE":{"$ref":"#/components/schemas/ConditionOperators"},"SEARCH_VALUE":{"description":"Value that the condition filter must match. The type of this field will differ depending on the `SEARCH_FIELD` that you specified.","anyOf":[{"type":"boolean"},{"type":"number","format":"double"},{"type":"string"}]},"AND":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/CortexCondition"}}}},"AppsecPolicyTriggersandActions":{"title":"AppsecPolicyTriggersandActions","type":"object","description":"Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have `isEnabled` set to `true`.","required":["cicd","ciImage","imageRegistry","periodic","pr"],"properties":{"cicd":{"type":"object","description":"Configuration for the CI Code  trigger. If `true`, the policy is evaluated on CI/CD pipeline events.","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI/CD pipeline."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Code Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"ciImage":{"type":"object","description":"Configuration for the CI image trigger. If `true`, the policy is evaluated during CI image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["blockCicd","reportCicd","reportIssue"],"properties":{"blockCicd":{"type":"boolean","description":"Indicates if triggering the policy should block the CI image."},"reportCicd":{"type":"boolean","description":"Indicates if triggering the policy should soft fail the CI image in the platform."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the CI Image Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"imageRegistry":{"type":"object","description":"Configuration for the image registry trigger. If `true`, the policy is evaluated during registry image scans.","required":["actions","isEnabled","overrideIssueSeverity"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the Registry Image Scan trigger is enabled."},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}},"periodic":{"type":"object","minProperties":1,"maxProperties":3,"description":"Configuration for the periodic code scan (scheduled) trigger. If `true`, the policy is evaluated.","required":["actions","isEnabled"],"properties":{"actions":{"type":"object","minProperties":1,"maxProperties":2,"description":"Actions to take when the policy detects its target risk and the policy is triggered.","required":["reportIssue"],"properties":{"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."}}},"isEnabled":{"type":"boolean","default":true,"description":"Indicates whether the Periodic Scan trigger is enabled."},"overrideIssueSeverity":{"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","enum":["Critical","High","Medium","Low"],"nullable":true}}},"pr":{"type":"object","description":"Configuration for the pull request (PR) trigger. If `true`, the policy is evaluated on Pull Request (PR) events","minProperties":1,"maxProperties":3,"required":["actions","isEnabled"],"properties":{"actions":{"type":"object","description":"Actions to take when the policy detects its target risk and the policy is triggered. ","required":["blockPr","reportIssue","reportPrComment"],"properties":{"blockPr":{"type":"boolean","description":"Indicates if triggering the policy should block the pull request."},"reportIssue":{"type":"boolean","description":"Indicates if triggering the policy should create an issue."},"reportPrComment":{"type":"boolean","description":"Indicates if triggering the policy should create comments on the pull request."}}},"isEnabled":{"type":"boolean","description":"Indicates whether the PR Scan trigger is enabled.","default":true},"overrideIssueSeverity":{"enum":["Critical","High","Medium","Low"],"description":"**Optional**. Set the severity of the issue (and override the system severity). If not used or set to `null`, system severity is kept.","nullable":true}}}}}}}}
```

## Delete an AppSec policy

> Deletes an Application Security policy by its policy ID.\
> \
> \> \*\*Required license:\*\*\
> \>\
> \> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing policies"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/policies/{policyId}":{"delete":{"operationId":"DeletePolicy","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"properties":{"message":{"type":"string"}},"required":["message"],"type":"object"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"in":"path","name":"policyId","description":"Unique identifier for the policy","required":true,"schema":{"type":"string"}}],"summary":"Delete an AppSec policy","tags":["Policies"],"description":"Deletes an Application Security policy by its policy ID.\n\n> **Required license:**\n>\n> Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on."}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.