Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Applets

Configure, (de)activate, and inspect the applets that run on a broker. The same five generic endpoints (get / config / activate / deactivate / scan_now-or-cert) are reused for every applet, with the request and response body shape determined by the applet_name path parameter.

See the Broker Applet Configuration Schemas table.

Operations that exist only for one applet are also surfaced in this tag for navigation convenience (downloadWefCert for wec, networkMapperScanNow for network_mapper).

Get an applet's configuration and status

get

Return the current configuration and runtime state of a single applet on a single broker. The response shape is determined by applet_name — see the oneOf under 200.content.schema.

Required permission: broker_action.

  • 400 Bad Request — applet_name is not one of the supported applets.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — broker is disconnected.

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
applet_namestring · enumRequired

Closed set of supported PAPI applet identifiers. Each applet has its own request and response schema, keyed by this value.

Possible values:
Responses
200

Applet configuration + status. The schema variant is selected by the applet discriminator field, which always equals the path's applet_name.

application/json
or
or
or
or
or
or
or
or
or
get/public_api/v1/brokers/{device_id}/applets/{applet_name}/
GET /public_api/v1/brokers/{device_id}/applets/{applet_name}/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*

{
  "device_id": "text",
  "applet": "syslog",
  "syslog_data_sources": [
    {
      "protocol": "udp",
      "port": "text",
      "network_settings": [
        {
          "source_network": "Any",
          "format": "auto",
          "vendor": "auto",
          "product": "auto"
        }
      ],
      "min_tls_ver": "1.0"
    }
  ]
}

Edit an applet's configuration

post

Replace the configuration of an already-active applet on a broker. The request body shape is determined by applet_name — see the oneOf under requestBody.content.schema.

The endpoint is destructive: the new configuration replaces the prior one in full. Use getApplet first to fetch the current shape, mutate it locally, then submit. Sensitive fields such as passwords / SSH keys / private keys are returned masked or omitted by getApplet, so partial edits work as long as you either re-supply the secret or leave the masked sentinel verbatim.

Required permission: broker_action.

  • 400 Bad Request — applet_name is not one of the supported applets, or the body fails Pydantic validation for the targeted applet's schema.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — broker is disconnected, or applet is not currently active (use activate instead).

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
applet_namestring · enumRequired

Closed set of supported PAPI applet identifiers. Each applet has its own request and response schema, keyed by this value.

Possible values:
Body
or
or
or
or
or
or
or
or
or
Responses
200

Edit accepted. The configuration is applied asynchronously — the body is an acknowledgement { "status": "activating" }, not the applied config. Poll getApplet (or getBrokers) to observe the config once it has been applied.

application/json

Async acknowledgement payload, e.g. { "status": "activating" }.

Other propertiesanyOptional
post/public_api/v1/brokers/{device_id}/applets/{applet_name}/config/
POST /public_api/v1/brokers/{device_id}/applets/{applet_name}/config/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 235

{
  "syslog_data_sources": [
    {
      "protocol": "udp",
      "port": "514",
      "network_settings": [
        {
          "source_network": "Any",
          "format": "auto",
          "vendor": "auto",
          "product": "auto"
        }
      ],
      "server_cert": "text",
      "private_key": "password",
      "ca_cert": "text",
      "min_tls_ver": "1.0"
    }
  ]
}
{
  "status": "activating"
}

Activate an applet with a configuration

post

Activate an applet on a broker, supplying its configuration in the same body shape that editApplet accepts. If the applet is already active, the call is rejected with 409 (use editApplet instead).

Required permission: broker_action.

  • 400 Bad Request — invalid applet_name or schema validation failure.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — broker is disconnected, or applet is already active.

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
applet_namestring · enumRequired

Closed set of supported PAPI applet identifiers. Each applet has its own request and response schema, keyed by this value.

Possible values:
Body
or
or
or
or
or
or
or
or
or
Responses
200

Applet activation accepted.

application/json

Handler-specific acknowledgement payload.

Other propertiesanyOptional
post/public_api/v1/brokers/{device_id}/applets/{applet_name}/activate/
POST /public_api/v1/brokers/{device_id}/applets/{applet_name}/activate/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 235

{
  "syslog_data_sources": [
    {
      "protocol": "udp",
      "port": "514",
      "network_settings": [
        {
          "source_network": "Any",
          "format": "auto",
          "vendor": "auto",
          "product": "auto"
        }
      ],
      "server_cert": "text",
      "private_key": "password",
      "ca_cert": "text",
      "min_tls_ver": "1.0"
    }
  ]
}
{
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Deactivate an applet

post

Deactivate a currently-active applet on a broker. The optional request body carries save_config=true|false to control whether the broker retains the prior applet config (so a subsequent activate without a body restores it). Default is true.

Required permission: broker_action.

  • 400 Bad Request — invalid applet_name.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — broker is disconnected, or applet is not active.

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
applet_namestring · enumRequired

Closed set of supported PAPI applet identifiers. Each applet has its own request and response schema, keyed by this value.

Possible values:
Body

Optional body for deactivateApplet. The body itself is optional; when absent or save_config is omitted, the broker preserves the applet's prior configuration so a later activate without a body restores it.

save_configbooleanOptional

true (default) — preserve the applet's current configuration for later reactivation. false — drop the configuration; a subsequent activate requires a full body.

Default: true
Responses
200

Applet deactivation accepted.

application/json

Handler-specific acknowledgement payload.

Other propertiesanyOptional
post/public_api/v1/brokers/{device_id}/applets/{applet_name}/deactivate/
POST /public_api/v1/brokers/{device_id}/applets/{applet_name}/deactivate/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 20

{
  "save_config": true
}
{
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Download the WEC/WEF client certificate as a PFX archive

post

Issue and stream the WEF (Windows Event Forwarder) client certificate for a broker as a PFX archive, encrypted with the export password the caller supplies in the request body. The PFX is intended to be installed on the Windows hosts that will forward events to the broker's WEC subscription manager.

Required permission: broker_action.

  • 400 Bad Request — password is shorter than 5 characters.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — WEC applet is not active on the broker, or the stored certificate material was generated on a Broker VM version that does not support the export shape this endpoint uses.

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
Body

Body for downloadWefCert. The password (min 5 chars) is the PFX export password.

passwordstring · password · min: 5Required

Export password applied to the PFX archive returned to the caller. The password protects the embedded private key on the wire; the customer-facing minimum length is 5 characters.

Responses
200

PFX archive containing the WEF client certificate.

application/octet-stream
Responsestring · binary

Raw bytes of the PFX archive.

post/public_api/v1/brokers/{device_id}/applets/wec/wef_cert/
POST /public_api/v1/brokers/{device_id}/applets/wec/wef_cert/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "password": "<pfx-export-password>"
}
binary

Trigger an immediate Network Mapper scan

post

Bypass the configured scanning schedule and trigger an immediate scan from the broker's Network Mapper applet. The request has no body; the action is enqueued and acknowledged synchronously.

Required permission: broker_action.

  • 404 Not Found — broker is unknown.

  • 409 Conflict — broker is disconnected, or the network_mapper applet is not currently active.

Authorizations
AuthorizationstringRequired

The tenant API key value, sent as the literal Authorization header value (no Bearer prefix).

x-xdr-auth-idstringRequired

The tenant API key identifier corresponding to the value sent in Authorization.

Path parameters
device_idstring · min: 1Required

The broker device identifier as returned by getBrokers.

Example: 6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02
Responses
200

Action accepted; no response body content.

application/json
objectOptional

Empty object on success.

post/public_api/v1/brokers/{device_id}/applets/network_mapper/scan_now/
POST /public_api/v1/brokers/{device_id}/applets/network_mapper/scan_now/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*

{}
PreviousInstall images
NextRemote log bundle

Last updated

Was this helpful?