> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/applets.md).

# Applets

Configure, (de)activate, and inspect the **applets** that run on a broker. The same five generic endpoints (`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert) are reused for every applet, with the request and response body shape determined by the `applet_name` path parameter.

See the [Broker Applet Configuration Schemas](/cortex-cloud-api/broker-vm-tenant-side/broker-papi-tables.md#broker-applet-configuration-schemas) table.

Operations that exist only for one applet are also surfaced in this tag for navigation convenience (`downloadWefCert` for `wec`, `networkMapperScanNow` for `network_mapper`).

## Get an applet's configuration and status

> Return the current configuration and runtime state of a single\
> applet on a single broker. The response shape is determined by\
> \`applet\_name\` — see the \`oneOf\` under \`200.content.schema\`.\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`400 Bad Request\` — \`applet\_name\` is not one of the supported applets.\
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — broker is disconnected.<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}},"AppletNamePath":{"name":"applet_name","in":"path","required":true,"description":"PAPI applet identifier. The set is closed; an unknown value\nyields `400`. Each applet's request and GET-response shapes are\ndefined by the matching `<Applet>Config` and\n`<Applet>GetConfigResponse` schemas under `components/schemas/`.\n","schema":{"$ref":"#/components/schemas/AppletName"}}},"schemas":{"AppletName":{"type":"string","description":"Closed set of supported PAPI applet identifiers. Each applet has\nits own request and response schema, keyed by this value.\n","enum":["syslog","kafka","db","ftp","file","csv","wec","netflow","network_mapper","local_agent_settings"]},"SyslogGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","syslog_data_sources"],"description":"GET-config response for the `syslog` applet. Cert payloads\n(`server_cert`, `private_key`, `ca_cert`) are write-only and are\nintentionally omitted; `min_tls_ver` is echoed for `secure_TCP`\nentries so a GET → unmodified PUT round-trip preserves the\nstored TLS floor.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["syslog"]},"syslog_data_sources":{"type":"array","description":"May be empty if the applet has been activated with no rows yet.","items":{"type":"object","additionalProperties":false,"required":["protocol","port","network_settings"],"properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string"},"network_settings":{"type":"array","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"nullable":true}}}}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}},"KafkaGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","kafka_connection"],"description":"GET-config response for the `kafka` applet. `password` and\n`private_key` are write-only and are omitted from the response.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["kafka"]},"kafka_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string"},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true},"ca_cert":{"type":"string","nullable":true},"username":{"type":"string","nullable":true},"topics_collection":{"type":"array","items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}},"DbCollectorGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","database_connection"],"description":"GET-config response for the `db` applet. `password` is write-only\nand is omitted from the response.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["db"]},"mssql_supported_authentication_methods":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Capability hint. Populated by brokers that support the MSSQL\nauthentication-method dropdown (>= 32.0.0); `null` on\ndown-level brokers.\n"},"database_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["connection","host","port","username"],"properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"]},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"authentication_method":{"type":"string","enum":["SQL Server","Kerberos","Kerberos / NTLM"],"default":"SQL Server","description":"MSSQL-only. See request schema for cross-field rules."},"database_query":{"type":"array","items":{"$ref":"#/components/schemas/DbQueryConf"}}}}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}},"FtpGetConfigResponse":{"description":"GET-config response for the `ftp` applet. The `password` and `private_key` on each connection are omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","ftp_connection"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["ftp"]},"ftp_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"ftp_settings":{"type":"array","items":{"$ref":"#/components/schemas/FtpSettings"}}}}}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"FileGetConfigResponse":{"description":"GET-config response for the `file` applet. The `password` on each shared-folder connection is omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","shared_folder_connection"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["file"]},"shared_folder_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["folder_path","recursive","username","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"file_settings":{"type":"array","items":{"$ref":"#/components/schemas/FileSettings"}}}}}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CsvGetConfigResponse":{"description":"GET-config response for the `csv` applet. The `password` field on each mounter is omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","csv_parameters"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["csv"]},"csv_parameters":{"type":"object","additionalProperties":false,"properties":{"mounter_folders":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["folder_path","username"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean","default":false},"username":{"type":"string"}}}},"monitored_csv_files":{"type":"array","items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}},"WecGetConfigResponse":{"description":"GET-config response for the `wec` applet. The `subscription_manager_url` is `null` until WEC certificate material has been generated on the broker.\n","type":"object","additionalProperties":false,"required":["device_id","applet","min_tls_ver","collected_events"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["wec"]},"subscription_manager_url":{"type":"string","nullable":true,"description":"URL Windows hosts use to subscribe to the broker's WEC\ncollector. Computed from the broker FQDN and CA certificate\nthumbprint. `null` until WEC certificate material has been\ngenerated on the broker.\n"},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Response form is always the string `\"1.0\"` or `\"1.2\"`."},"collected_events":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["source"],"properties":{"source":{"type":"string"},"min_event_level":{"type":"string","default":"Information"},"event_ids_group":{"type":"string","default":"All"},"event_ids":{"type":"array","nullable":true,"items":{"type":"string"}}}}}}},"NetflowGetConfigResponse":{"description":"GET-config response for the `netflow` applet.\n","type":"object","additionalProperties":false,"required":["device_id","applet","netflow_data_sources"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["netflow"]},"netflow_data_sources":{"type":"array","items":{"$ref":"#/components/schemas/NetflowDataSource"}}}},"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}},"NetworkMapperGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","network_mapper_parameters"],"description":"GET-config response for the `network_mapper` applet. The scheduler\n`method` is rendered in the user-friendly form\n(`Run daily` / `Run weekly` / `Run monthly`).\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["network_mapper"]},"network_mapper_parameters":{"type":"object","additionalProperties":false,"required":["scan_method","scan_requests_per_second","scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"]},"scan_requests_per_second":{"type":"integer"},"scanning_scheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"properties":{"method":{"type":"string","enum":["Run daily","Run weekly","Run monthly"]},"time":{"type":"string"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}},"scanned_ranges":{"type":"array","items":{"type":"string"}},"ports":{"type":"string","nullable":true}}}}},"LocalAgentSettingsGetConfigResponse":{"description":"GET-config response for the `local_agent_settings` applet.\n","type":"object","additionalProperties":false,"required":["device_id","applet","proxy","caching"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["local_agent_settings"]},"proxy":{"type":"object","additionalProperties":false,"required":["enabled","port"],"properties":{"enabled":{"type":"boolean"},"port":{"type":"string"},"listening_interface":{"type":"string","default":"all"}}},"caching":{"type":"boolean","default":false}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/{applet_name}/":{"get":{"tags":["applets"],"operationId":"getApplet","summary":"Get an applet's configuration and status","description":"Return the current configuration and runtime state of a single\napplet on a single broker. The response shape is determined by\n`applet_name` — see the `oneOf` under `200.content.schema`.\n\n**Required permission:** `broker_action`.\n\n- `400 Bad Request` — `applet_name` is not one of the supported applets.\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — broker is disconnected.\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"},{"$ref":"#/components/parameters/AppletNamePath"}],"responses":{"200":{"description":"Applet configuration + status. The schema variant is\nselected by the `applet` discriminator field, which always\nequals the path's `applet_name`.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/SyslogGetConfigResponse"},{"$ref":"#/components/schemas/KafkaGetConfigResponse"},{"$ref":"#/components/schemas/DbCollectorGetConfigResponse"},{"$ref":"#/components/schemas/FtpGetConfigResponse"},{"$ref":"#/components/schemas/FileGetConfigResponse"},{"$ref":"#/components/schemas/CsvGetConfigResponse"},{"$ref":"#/components/schemas/WecGetConfigResponse"},{"$ref":"#/components/schemas/NetflowGetConfigResponse"},{"$ref":"#/components/schemas/NetworkMapperGetConfigResponse"},{"$ref":"#/components/schemas/LocalAgentSettingsGetConfigResponse"}],"discriminator":{"propertyName":"applet","mapping":{"syslog":"#/components/schemas/SyslogGetConfigResponse","kafka":"#/components/schemas/KafkaGetConfigResponse","db":"#/components/schemas/DbCollectorGetConfigResponse","ftp":"#/components/schemas/FtpGetConfigResponse","file":"#/components/schemas/FileGetConfigResponse","csv":"#/components/schemas/CsvGetConfigResponse","wec":"#/components/schemas/WecGetConfigResponse","netflow":"#/components/schemas/NetflowGetConfigResponse","network_mapper":"#/components/schemas/NetworkMapperGetConfigResponse","local_agent_settings":"#/components/schemas/LocalAgentSettingsGetConfigResponse"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Edit an applet's configuration

> Replace the configuration of an \*\*already-active\*\* applet on a\
> broker. The request body shape is determined by \`applet\_name\`\
> — see the \`oneOf\` under \`requestBody.content.schema\`.\
> \
> The endpoint is \*\*destructive\*\*: the new configuration replaces\
> the prior one in full. Use \[\`getApplet\`]\(#operation/getApplet)\
> first to fetch the current shape, mutate it locally, then\
> submit. Sensitive fields such as passwords / SSH keys / private\
> keys are returned masked or omitted by \`getApplet\`, so partial\
> edits work as long as you either re-supply the secret or leave\
> the masked sentinel verbatim.\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`400 Bad Request\` — \`applet\_name\` is not one of the supported\
> &#x20; applets, or the body fails Pydantic validation for the\
> &#x20; targeted applet's schema.\
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — broker is disconnected, or applet is not\
> &#x20; currently active (use \`activate\` instead).<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}},"AppletNamePath":{"name":"applet_name","in":"path","required":true,"description":"PAPI applet identifier. The set is closed; an unknown value\nyields `400`. Each applet's request and GET-response shapes are\ndefined by the matching `<Applet>Config` and\n`<Applet>GetConfigResponse` schemas under `components/schemas/`.\n","schema":{"$ref":"#/components/schemas/AppletName"}}},"schemas":{"AppletName":{"type":"string","description":"Closed set of supported PAPI applet identifiers. Each applet has\nits own request and response schema, keyed by this value.\n","enum":["syslog","kafka","db","ftp","file","csv","wec","netflow","network_mapper","local_agent_settings"]},"SyslogConfig":{"type":"object","additionalProperties":false,"required":["syslog_data_sources"],"description":"Request body for the `syslog` applet. Every\n`(protocol, port)` pair must be unique across\n`syslog_data_sources`.\n","properties":{"syslog_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SyslogDataSource"}}}},"SyslogDataSource":{"type":"object","additionalProperties":false,"required":["protocol","port"],"description":"A syslog data source — a (protocol, port) binding with one or\nmore `network_settings`. Cert material is required iff\n`protocol = \"secure_TCP\"`.\n","properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$","description":"Numeric string in `[1, 65535]`."},"network_settings":{"type":"array","minItems":1,"description":"At least one entry. Within a single data source, every\n`source_network` value must be unique.\n","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"server_cert":{"type":"string","description":"PEM-encoded server certificate (required for `secure_TCP`)."},"private_key":{"type":"string","format":"password","description":"PEM-encoded private key (required for `secure_TCP`)."},"ca_cert":{"type":"string","description":"PEM-encoded CA bundle (optional for `secure_TCP`)."},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Minimum TLS version (only meaningful for `secure_TCP`)."}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}},"KafkaConfig":{"description":"Request body for the `kafka` applet — wraps a non-empty list of Kafka server connections.\n","type":"object","additionalProperties":false,"required":["kafka_connection"],"properties":{"kafka_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaConnection"}}}},"KafkaConnection":{"description":"A single Kafka server connection within the `kafka` applet config. `ssl` requires `broker_cert` and `private_key`; `sasl` requires `username` and `password`.\n","type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string","description":"Comma-separated `host:port` Kafka bootstrap servers."},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true,"description":"Base64-encoded broker certificate (PEM). Required for `ssl`."},"private_key":{"type":"string","format":"password","nullable":true,"description":"Base64-encoded private key (PEM). Required for `ssl`."},"ca_cert":{"type":"string","nullable":true,"description":"Base64-encoded CA certificate (PEM). Optional."},"username":{"type":"string","nullable":true,"description":"SASL username (required for `sasl`)."},"password":{"type":"string","format":"password","nullable":true,"description":"SASL password (required for `sasl`)."},"topics_collection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}},"DbCollectorConfig":{"description":"Request body for the `db` applet — wraps a non-empty list of database server entries (`database_connection`).\n","type":"object","additionalProperties":false,"required":["database_connection"],"properties":{"database_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbServerEntry"}}}},"DbServerEntry":{"type":"object","additionalProperties":false,"required":["connection","host","port","username","password","database_query"],"description":"A single database connection. `database` is required for every\ndriver except `Oracle`, which uses `service_name` instead.\n","properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"],"description":"Database driver."},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true,"description":"Required (and `database` must be unset) when `connection=Oracle`."},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"password":{"type":"string","format":"password"},"authentication_method":{"type":"string","enum":["SQL Server","Kerberos","Kerberos / NTLM"],"default":"SQL Server","description":"MSSQL-only. Any non-default value requires `connection=MSSQL`.\n`Kerberos` requires `username` in UPN form (`user@REALM`);\n`Kerberos / NTLM` accepts UPN or `DOMAIN\\user`.\n"},"database_query":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbQueryConf"}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}},"FtpConfig":{"description":"Request body for the `ftp` applet — wraps a non-empty list of FTP / SFTP / FTPS server connections.\n","type":"object","additionalProperties":false,"required":["ftp_connection"],"properties":{"ftp_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpConnection"}}}},"FtpConnection":{"description":"A single FTP / SFTP / FTPS server connection within the `ftp` applet config. SFTP servers may authenticate with either `password` or `private_key`.\n","type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"password":{"type":"string","format":"password","nullable":true,"description":"Required for `FTP` / `FTPS` and for `SFTP` when no\n`private_key` is provided.\n"},"private_key":{"type":"string","format":"password","nullable":true,"description":"PEM-encoded SSH private key (mutually exclusive with\n`password` for `SFTP`).\n"},"ftp_settings":{"oneOf":[{"$ref":"#/components/schemas/FtpSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpSettings"}}],"description":"Per-server scan settings. The wire accepts a single object\nor a one-element list — the backend normalizes either to a\nsingle-element list.\n"}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"FileConfig":{"description":"Request body for the `file` (generic shared-folder Log Collector) applet — wraps a non-empty list of shared-folder connections.\n","type":"object","additionalProperties":false,"required":["shared_folder_connection"],"properties":{"shared_folder_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SharedFolderConnection"}}}},"SharedFolderConnection":{"description":"A single shared-folder (CIFS/NFS) connection within the `file` applet config.\n","type":"object","additionalProperties":false,"required":["folder_path","recursive","username","password","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"password":{"type":"string","format":"password"},"file_settings":{"oneOf":[{"$ref":"#/components/schemas/FileSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FileSettings"}}]}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CsvConfig":{"description":"Request body for the `csv` applet — wraps `csv_parameters` (mounter folders + monitored CSV files).\n","type":"object","additionalProperties":false,"required":["csv_parameters"],"properties":{"csv_parameters":{"$ref":"#/components/schemas/CsvParameters"}}},"CsvParameters":{"description":"Inner container for the `csv` applet — joins mounter folders with the monitored CSV files that scan them.\n","type":"object","additionalProperties":false,"required":["mounter_folders","monitored_csv_files"],"properties":{"mounter_folders":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MounterFolder"}},"monitored_csv_files":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}},"MounterFolder":{"type":"object","additionalProperties":false,"required":["folder_path"],"description":"A CIFS / NFS mount target. For CIFS / SMB shares both `username`\nand `password` are required (the masked sentinel `******` is\naccepted to round-trip a GET → modified PUT without re-supplying\nthe password). NFS shares may omit both.\n","properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"],"default":"no"},"username":{"type":"string","default":""},"password":{"type":"string","format":"password","default":""}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}},"WecConfig":{"description":"Request body for the `wec` (Windows Event Collector) applet — wraps the TLS floor and the non-empty list of collected event subscriptions.\n","type":"object","additionalProperties":false,"required":["collected_events"],"properties":{"min_tls_ver":{"oneOf":[{"type":"boolean"},{"type":"string","enum":["1.0","1.2"]}],"default":true,"description":"TLS floor. Wire shape is **either** a boolean (`true` =\nTLS 1.2, `false` = TLS 1.0 — the internal representation) or\nthe spec string `\"1.0\"` / `\"1.2\"`. Both forms are accepted\non input; the GET response returns the string form.\n"},"collected_events":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/WecCollectedEvent"}}}},"WecCollectedEvent":{"description":"One Windows event subscription entry. `event_ids` is required when `event_ids_group` is `Included` or `Excluded`; must be absent when it's `All`.\n","type":"object","additionalProperties":false,"required":["source","min_event_level"],"properties":{"source":{"type":"string","description":"Windows event source name (e.g., `Security`, `Application`,\n`System`).\n"},"min_event_level":{"type":"string","enum":["Critical","Error","Warning","Information","Verbose"],"description":"Minimum event level to collect. `Informational` is accepted\nas an alias for `Information`.\n"},"event_ids_group":{"type":"string","enum":["All","Included","Excluded"],"default":"All"},"event_ids":{"type":"array","nullable":true,"description":"Required when `event_ids_group` is `Included` or `Excluded`;\nmust be omitted (or `null`) when `event_ids_group` is `All`.\nEntries are strings — individual event IDs (`\"4624\"`) or\nranges (`\"4778-4803\"`).\n","items":{"type":"string"}}}},"NetflowConfig":{"type":"object","additionalProperties":false,"required":["netflow_data_sources"],"description":"`UDP_port` values must be unique across `netflow_data_sources`.\n","properties":{"netflow_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/NetflowDataSource"}}}},"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}},"NetworkMapperConfig":{"description":"Request body for the `network_mapper` applet — wraps the single scanner configuration block.\n","type":"object","additionalProperties":false,"required":["network_mapper_parameters"],"properties":{"network_mapper_parameters":{"$ref":"#/components/schemas/NetworkMapperParameters"}}},"NetworkMapperParameters":{"description":"Single-scanner configuration for the `network_mapper` applet. `TCP_SYN` requires `ports`; `ICMP` rejects `ports`.\n","type":"object","additionalProperties":false,"required":["scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"],"default":"ICMP"},"scan_requests_per_second":{"oneOf":[{"type":"integer","minimum":1,"maximum":1000000},{"type":"string","pattern":"^[1-9][0-9]*$"}],"default":1000},"scanning_scheduler":{"$ref":"#/components/schemas/NetworkMapperScanningScheduler"},"scanned_ranges":{"type":"array","description":"List of IP-range names defined in the platform's IP Ranges.\nNames are resolved server-side. Must be unique within the list.\n","items":{"type":"string","minLength":1}},"ports":{"type":"string","nullable":true,"pattern":"^\\d{1,5}(-\\d{1,5})?(,\\d{1,5}(-\\d{1,5})?)*$","description":"Comma-separated ports / port-ranges (e.g., `\"22,80-81,8000\"`).\n**Required** when `scan_method=TCP_SYN`; **must not** be set\nwhen `scan_method=ICMP`.\n"}}},"NetworkMapperScanningScheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"description":"Scanning scheduler — three discriminated cases driven by\n`method`. `daily` permits only `time`; `weekly` requires\n`day_of_week`; `monthly` requires both `day_of_week` and `week`.\n","properties":{"method":{"type":"string","enum":["daily","weekly","monthly"]},"time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}},"LocalAgentSettingsConfig":{"type":"object","additionalProperties":false,"description":"At least one of `proxy.enabled` or `caching` must be `true`,\notherwise the activation request is rejected.\n","properties":{"proxy":{"$ref":"#/components/schemas/LocalAgentProxy"},"caching":{"type":"boolean","default":false}}},"LocalAgentProxy":{"type":"object","additionalProperties":false,"required":["enabled"],"description":"Local-agent proxy sub-configuration. When `enabled=true`, `port`\nis required. When `enabled=false`, `port` and `listening_interface`\nmust be omitted (or left as defaults).\n","properties":{"enabled":{"type":"boolean"},"port":{"type":"string","default":"","description":"Numeric string in `[1, 65535]`. Empty when proxy disabled."},"listening_interface":{"type":"string","default":"all","description":"`\"all\"`, a valid IPv4/IPv6 address, or an interface name\n(letters, digits, `.`, `:`, `_`, `-`; up to 64 chars).\n"}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/{applet_name}/config/":{"post":{"tags":["applets"],"operationId":"editApplet","summary":"Edit an applet's configuration","description":"Replace the configuration of an **already-active** applet on a\nbroker. The request body shape is determined by `applet_name`\n— see the `oneOf` under `requestBody.content.schema`.\n\nThe endpoint is **destructive**: the new configuration replaces\nthe prior one in full. Use [`getApplet`](#operation/getApplet)\nfirst to fetch the current shape, mutate it locally, then\nsubmit. Sensitive fields such as passwords / SSH keys / private\nkeys are returned masked or omitted by `getApplet`, so partial\nedits work as long as you either re-supply the secret or leave\nthe masked sentinel verbatim.\n\n**Required permission:** `broker_action`.\n\n- `400 Bad Request` — `applet_name` is not one of the supported\n  applets, or the body fails Pydantic validation for the\n  targeted applet's schema.\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — broker is disconnected, or applet is not\n  currently active (use `activate` instead).\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"},{"$ref":"#/components/parameters/AppletNamePath"}],"requestBody":{"required":true,"description":"New configuration; shape determined by `applet_name`.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/SyslogConfig"},{"$ref":"#/components/schemas/KafkaConfig"},{"$ref":"#/components/schemas/DbCollectorConfig"},{"$ref":"#/components/schemas/FtpConfig"},{"$ref":"#/components/schemas/FileConfig"},{"$ref":"#/components/schemas/CsvConfig"},{"$ref":"#/components/schemas/WecConfig"},{"$ref":"#/components/schemas/NetflowConfig"},{"$ref":"#/components/schemas/NetworkMapperConfig"},{"$ref":"#/components/schemas/LocalAgentSettingsConfig"}]}}}},"responses":{"200":{"description":"Edit accepted. The configuration is applied **asynchronously** —\nthe body is an acknowledgement `{ \"status\": \"activating\" }`, not\nthe applied config. Poll [`getApplet`](#operation/getApplet) (or\n[`getBrokers`](#operation/getBrokers)) to observe the config once\nit has been applied.\n","content":{"application/json":{"schema":{"type":"object","description":"Async acknowledgement payload, e.g.\n`{ \"status\": \"activating\" }`.\n","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Activate an applet with a configuration

> Activate an applet on a broker, supplying its configuration in\
> the same body shape that \[\`editApplet\`]\(#operation/editApplet)\
> accepts. If the applet is already active, the call is rejected\
> with \`409\` (use \`editApplet\` instead).\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`400 Bad Request\` — invalid \`applet\_name\` or schema validation failure.\
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — broker is disconnected, or applet is already active.<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}},"AppletNamePath":{"name":"applet_name","in":"path","required":true,"description":"PAPI applet identifier. The set is closed; an unknown value\nyields `400`. Each applet's request and GET-response shapes are\ndefined by the matching `<Applet>Config` and\n`<Applet>GetConfigResponse` schemas under `components/schemas/`.\n","schema":{"$ref":"#/components/schemas/AppletName"}}},"schemas":{"AppletName":{"type":"string","description":"Closed set of supported PAPI applet identifiers. Each applet has\nits own request and response schema, keyed by this value.\n","enum":["syslog","kafka","db","ftp","file","csv","wec","netflow","network_mapper","local_agent_settings"]},"SyslogConfig":{"type":"object","additionalProperties":false,"required":["syslog_data_sources"],"description":"Request body for the `syslog` applet. Every\n`(protocol, port)` pair must be unique across\n`syslog_data_sources`.\n","properties":{"syslog_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SyslogDataSource"}}}},"SyslogDataSource":{"type":"object","additionalProperties":false,"required":["protocol","port"],"description":"A syslog data source — a (protocol, port) binding with one or\nmore `network_settings`. Cert material is required iff\n`protocol = \"secure_TCP\"`.\n","properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$","description":"Numeric string in `[1, 65535]`."},"network_settings":{"type":"array","minItems":1,"description":"At least one entry. Within a single data source, every\n`source_network` value must be unique.\n","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"server_cert":{"type":"string","description":"PEM-encoded server certificate (required for `secure_TCP`)."},"private_key":{"type":"string","format":"password","description":"PEM-encoded private key (required for `secure_TCP`)."},"ca_cert":{"type":"string","description":"PEM-encoded CA bundle (optional for `secure_TCP`)."},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Minimum TLS version (only meaningful for `secure_TCP`)."}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}},"KafkaConfig":{"description":"Request body for the `kafka` applet — wraps a non-empty list of Kafka server connections.\n","type":"object","additionalProperties":false,"required":["kafka_connection"],"properties":{"kafka_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaConnection"}}}},"KafkaConnection":{"description":"A single Kafka server connection within the `kafka` applet config. `ssl` requires `broker_cert` and `private_key`; `sasl` requires `username` and `password`.\n","type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string","description":"Comma-separated `host:port` Kafka bootstrap servers."},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true,"description":"Base64-encoded broker certificate (PEM). Required for `ssl`."},"private_key":{"type":"string","format":"password","nullable":true,"description":"Base64-encoded private key (PEM). Required for `ssl`."},"ca_cert":{"type":"string","nullable":true,"description":"Base64-encoded CA certificate (PEM). Optional."},"username":{"type":"string","nullable":true,"description":"SASL username (required for `sasl`)."},"password":{"type":"string","format":"password","nullable":true,"description":"SASL password (required for `sasl`)."},"topics_collection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}},"DbCollectorConfig":{"description":"Request body for the `db` applet — wraps a non-empty list of database server entries (`database_connection`).\n","type":"object","additionalProperties":false,"required":["database_connection"],"properties":{"database_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbServerEntry"}}}},"DbServerEntry":{"type":"object","additionalProperties":false,"required":["connection","host","port","username","password","database_query"],"description":"A single database connection. `database` is required for every\ndriver except `Oracle`, which uses `service_name` instead.\n","properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"],"description":"Database driver."},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true,"description":"Required (and `database` must be unset) when `connection=Oracle`."},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"password":{"type":"string","format":"password"},"authentication_method":{"type":"string","enum":["SQL Server","Kerberos","Kerberos / NTLM"],"default":"SQL Server","description":"MSSQL-only. Any non-default value requires `connection=MSSQL`.\n`Kerberos` requires `username` in UPN form (`user@REALM`);\n`Kerberos / NTLM` accepts UPN or `DOMAIN\\user`.\n"},"database_query":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbQueryConf"}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}},"FtpConfig":{"description":"Request body for the `ftp` applet — wraps a non-empty list of FTP / SFTP / FTPS server connections.\n","type":"object","additionalProperties":false,"required":["ftp_connection"],"properties":{"ftp_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpConnection"}}}},"FtpConnection":{"description":"A single FTP / SFTP / FTPS server connection within the `ftp` applet config. SFTP servers may authenticate with either `password` or `private_key`.\n","type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"password":{"type":"string","format":"password","nullable":true,"description":"Required for `FTP` / `FTPS` and for `SFTP` when no\n`private_key` is provided.\n"},"private_key":{"type":"string","format":"password","nullable":true,"description":"PEM-encoded SSH private key (mutually exclusive with\n`password` for `SFTP`).\n"},"ftp_settings":{"oneOf":[{"$ref":"#/components/schemas/FtpSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpSettings"}}],"description":"Per-server scan settings. The wire accepts a single object\nor a one-element list — the backend normalizes either to a\nsingle-element list.\n"}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"FileConfig":{"description":"Request body for the `file` (generic shared-folder Log Collector) applet — wraps a non-empty list of shared-folder connections.\n","type":"object","additionalProperties":false,"required":["shared_folder_connection"],"properties":{"shared_folder_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SharedFolderConnection"}}}},"SharedFolderConnection":{"description":"A single shared-folder (CIFS/NFS) connection within the `file` applet config.\n","type":"object","additionalProperties":false,"required":["folder_path","recursive","username","password","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"password":{"type":"string","format":"password"},"file_settings":{"oneOf":[{"$ref":"#/components/schemas/FileSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FileSettings"}}]}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CsvConfig":{"description":"Request body for the `csv` applet — wraps `csv_parameters` (mounter folders + monitored CSV files).\n","type":"object","additionalProperties":false,"required":["csv_parameters"],"properties":{"csv_parameters":{"$ref":"#/components/schemas/CsvParameters"}}},"CsvParameters":{"description":"Inner container for the `csv` applet — joins mounter folders with the monitored CSV files that scan them.\n","type":"object","additionalProperties":false,"required":["mounter_folders","monitored_csv_files"],"properties":{"mounter_folders":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MounterFolder"}},"monitored_csv_files":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}},"MounterFolder":{"type":"object","additionalProperties":false,"required":["folder_path"],"description":"A CIFS / NFS mount target. For CIFS / SMB shares both `username`\nand `password` are required (the masked sentinel `******` is\naccepted to round-trip a GET → modified PUT without re-supplying\nthe password). NFS shares may omit both.\n","properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"],"default":"no"},"username":{"type":"string","default":""},"password":{"type":"string","format":"password","default":""}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}},"WecConfig":{"description":"Request body for the `wec` (Windows Event Collector) applet — wraps the TLS floor and the non-empty list of collected event subscriptions.\n","type":"object","additionalProperties":false,"required":["collected_events"],"properties":{"min_tls_ver":{"oneOf":[{"type":"boolean"},{"type":"string","enum":["1.0","1.2"]}],"default":true,"description":"TLS floor. Wire shape is **either** a boolean (`true` =\nTLS 1.2, `false` = TLS 1.0 — the internal representation) or\nthe spec string `\"1.0\"` / `\"1.2\"`. Both forms are accepted\non input; the GET response returns the string form.\n"},"collected_events":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/WecCollectedEvent"}}}},"WecCollectedEvent":{"description":"One Windows event subscription entry. `event_ids` is required when `event_ids_group` is `Included` or `Excluded`; must be absent when it's `All`.\n","type":"object","additionalProperties":false,"required":["source","min_event_level"],"properties":{"source":{"type":"string","description":"Windows event source name (e.g., `Security`, `Application`,\n`System`).\n"},"min_event_level":{"type":"string","enum":["Critical","Error","Warning","Information","Verbose"],"description":"Minimum event level to collect. `Informational` is accepted\nas an alias for `Information`.\n"},"event_ids_group":{"type":"string","enum":["All","Included","Excluded"],"default":"All"},"event_ids":{"type":"array","nullable":true,"description":"Required when `event_ids_group` is `Included` or `Excluded`;\nmust be omitted (or `null`) when `event_ids_group` is `All`.\nEntries are strings — individual event IDs (`\"4624\"`) or\nranges (`\"4778-4803\"`).\n","items":{"type":"string"}}}},"NetflowConfig":{"type":"object","additionalProperties":false,"required":["netflow_data_sources"],"description":"`UDP_port` values must be unique across `netflow_data_sources`.\n","properties":{"netflow_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/NetflowDataSource"}}}},"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}},"NetworkMapperConfig":{"description":"Request body for the `network_mapper` applet — wraps the single scanner configuration block.\n","type":"object","additionalProperties":false,"required":["network_mapper_parameters"],"properties":{"network_mapper_parameters":{"$ref":"#/components/schemas/NetworkMapperParameters"}}},"NetworkMapperParameters":{"description":"Single-scanner configuration for the `network_mapper` applet. `TCP_SYN` requires `ports`; `ICMP` rejects `ports`.\n","type":"object","additionalProperties":false,"required":["scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"],"default":"ICMP"},"scan_requests_per_second":{"oneOf":[{"type":"integer","minimum":1,"maximum":1000000},{"type":"string","pattern":"^[1-9][0-9]*$"}],"default":1000},"scanning_scheduler":{"$ref":"#/components/schemas/NetworkMapperScanningScheduler"},"scanned_ranges":{"type":"array","description":"List of IP-range names defined in the platform's IP Ranges.\nNames are resolved server-side. Must be unique within the list.\n","items":{"type":"string","minLength":1}},"ports":{"type":"string","nullable":true,"pattern":"^\\d{1,5}(-\\d{1,5})?(,\\d{1,5}(-\\d{1,5})?)*$","description":"Comma-separated ports / port-ranges (e.g., `\"22,80-81,8000\"`).\n**Required** when `scan_method=TCP_SYN`; **must not** be set\nwhen `scan_method=ICMP`.\n"}}},"NetworkMapperScanningScheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"description":"Scanning scheduler — three discriminated cases driven by\n`method`. `daily` permits only `time`; `weekly` requires\n`day_of_week`; `monthly` requires both `day_of_week` and `week`.\n","properties":{"method":{"type":"string","enum":["daily","weekly","monthly"]},"time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}},"LocalAgentSettingsConfig":{"type":"object","additionalProperties":false,"description":"At least one of `proxy.enabled` or `caching` must be `true`,\notherwise the activation request is rejected.\n","properties":{"proxy":{"$ref":"#/components/schemas/LocalAgentProxy"},"caching":{"type":"boolean","default":false}}},"LocalAgentProxy":{"type":"object","additionalProperties":false,"required":["enabled"],"description":"Local-agent proxy sub-configuration. When `enabled=true`, `port`\nis required. When `enabled=false`, `port` and `listening_interface`\nmust be omitted (or left as defaults).\n","properties":{"enabled":{"type":"boolean"},"port":{"type":"string","default":"","description":"Numeric string in `[1, 65535]`. Empty when proxy disabled."},"listening_interface":{"type":"string","default":"all","description":"`\"all\"`, a valid IPv4/IPv6 address, or an interface name\n(letters, digits, `.`, `:`, `_`, `-`; up to 64 chars).\n"}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/{applet_name}/activate/":{"post":{"tags":["applets"],"operationId":"activateApplet","summary":"Activate an applet with a configuration","description":"Activate an applet on a broker, supplying its configuration in\nthe same body shape that [`editApplet`](#operation/editApplet)\naccepts. If the applet is already active, the call is rejected\nwith `409` (use `editApplet` instead).\n\n**Required permission:** `broker_action`.\n\n- `400 Bad Request` — invalid `applet_name` or schema validation failure.\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — broker is disconnected, or applet is already active.\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"},{"$ref":"#/components/parameters/AppletNamePath"}],"requestBody":{"required":true,"description":"Full configuration for the targeted applet. The body shape is\ndetermined by the `applet_name` path parameter — see the\nper-applet `<Applet>Config` schema referenced in the `oneOf:`\nbelow.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/SyslogConfig"},{"$ref":"#/components/schemas/KafkaConfig"},{"$ref":"#/components/schemas/DbCollectorConfig"},{"$ref":"#/components/schemas/FtpConfig"},{"$ref":"#/components/schemas/FileConfig"},{"$ref":"#/components/schemas/CsvConfig"},{"$ref":"#/components/schemas/WecConfig"},{"$ref":"#/components/schemas/NetflowConfig"},{"$ref":"#/components/schemas/NetworkMapperConfig"},{"$ref":"#/components/schemas/LocalAgentSettingsConfig"}]}}}},"responses":{"200":{"description":"Applet activation accepted.","content":{"application/json":{"schema":{"type":"object","description":"Handler-specific acknowledgement payload.","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Deactivate an applet

> Deactivate a currently-active applet on a broker. The optional\
> request body carries \`save\_config=true|false\` to control whether\
> the broker retains the prior applet config (so a subsequent\
> \`activate\` without a body restores it). Default is \`true\`.\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`400 Bad Request\` — invalid \`applet\_name\`.\
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — broker is disconnected, or applet is not active.<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}},"AppletNamePath":{"name":"applet_name","in":"path","required":true,"description":"PAPI applet identifier. The set is closed; an unknown value\nyields `400`. Each applet's request and GET-response shapes are\ndefined by the matching `<Applet>Config` and\n`<Applet>GetConfigResponse` schemas under `components/schemas/`.\n","schema":{"$ref":"#/components/schemas/AppletName"}}},"schemas":{"AppletName":{"type":"string","description":"Closed set of supported PAPI applet identifiers. Each applet has\nits own request and response schema, keyed by this value.\n","enum":["syslog","kafka","db","ftp","file","csv","wec","netflow","network_mapper","local_agent_settings"]},"AppletDeactivateRequest":{"type":"object","additionalProperties":false,"description":"Optional body for [`deactivateApplet`](#operation/deactivateApplet).\nThe body itself is optional; when absent or `save_config` is\nomitted, the broker preserves the applet's prior configuration so\na later `activate` without a body restores it.\n","properties":{"save_config":{"type":"boolean","default":true,"description":"`true` (default) — preserve the applet's current configuration\nfor later reactivation. `false` — drop the configuration; a\nsubsequent `activate` requires a full body.\n"}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/{applet_name}/deactivate/":{"post":{"tags":["applets"],"operationId":"deactivateApplet","summary":"Deactivate an applet","description":"Deactivate a currently-active applet on a broker. The optional\nrequest body carries `save_config=true|false` to control whether\nthe broker retains the prior applet config (so a subsequent\n`activate` without a body restores it). Default is `true`.\n\n**Required permission:** `broker_action`.\n\n- `400 Bad Request` — invalid `applet_name`.\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — broker is disconnected, or applet is not active.\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"},{"$ref":"#/components/parameters/AppletNamePath"}],"requestBody":{"required":false,"description":"Optional. When absent, defaults to `save_config: true` —\npreserve the applet's prior configuration so a subsequent\n`activate` without a body restores it.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppletDeactivateRequest"}}}},"responses":{"200":{"description":"Applet deactivation accepted.","content":{"application/json":{"schema":{"type":"object","description":"Handler-specific acknowledgement payload.","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Download the WEC/WEF client certificate as a PFX archive

> Issue and stream the WEF (Windows Event Forwarder) client\
> certificate for a broker as a PFX archive, encrypted with the\
> export password the caller supplies in the request body. The PFX\
> is intended to be installed on the Windows hosts that will\
> forward events to the broker's WEC subscription manager.\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`400 Bad Request\` — \`password\` is shorter than 5 characters.\
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — WEC applet is not active on the broker, or the\
> &#x20; stored certificate material was generated on a Broker VM\
> &#x20; version that does not support the export shape this endpoint\
> &#x20; uses.<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}}},"schemas":{"DownloadWefCertRequest":{"description":"Body for `downloadWefCert`. The `password` (min 5 chars) is the PFX export password.\n","type":"object","additionalProperties":false,"required":["password"],"properties":{"password":{"type":"string","format":"password","minLength":5,"description":"Export password applied to the PFX archive returned to the\ncaller. The password protects the embedded private key on the\nwire; the customer-facing minimum length is 5 characters.\n"}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/wec/wef_cert/":{"post":{"tags":["applets"],"operationId":"downloadWefCert","summary":"Download the WEC/WEF client certificate as a PFX archive","description":"Issue and stream the WEF (Windows Event Forwarder) client\ncertificate for a broker as a PFX archive, encrypted with the\nexport password the caller supplies in the request body. The PFX\nis intended to be installed on the Windows hosts that will\nforward events to the broker's WEC subscription manager.\n\n**Required permission:** `broker_action`.\n\n- `400 Bad Request` — `password` is shorter than 5 characters.\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — WEC applet is not active on the broker, or the\n  stored certificate material was generated on a Broker VM\n  version that does not support the export shape this endpoint\n  uses.\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"}],"requestBody":{"required":true,"description":"Carries the export `password` (minimum 5 characters) that\nencrypts the PFX archive returned in the response stream.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DownloadWefCertRequest"}}}},"responses":{"200":{"description":"PFX archive containing the WEF client certificate.","headers":{"Content-Disposition":{"description":"Attachment filename, `<broker-name>-wef-cert.pfx`.","schema":{"type":"string"}}},"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary","description":"Raw bytes of the PFX archive."}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Trigger an immediate Network Mapper scan

> Bypass the configured scanning schedule and trigger an immediate\
> scan from the broker's Network Mapper applet. The request has no\
> body; the action is enqueued and acknowledged synchronously.\
> \
> \*\*Required permission:\*\* \`broker\_action\`.\
> \
> \- \`404 Not Found\` — broker is unknown.\
> \- \`409 Conflict\` — broker is disconnected, or the\
> &#x20; \`network\_mapper\` applet is not currently active.<br>

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"applets","description":"Configure, (de)activate, and inspect the **applets** that run on a\nbroker. The same five generic endpoints\n(`get` / `config` / `activate` / `deactivate` / `scan_now`-or-cert)\nare reused for every applet, with the request and response body\nshape determined by the `applet_name` path parameter.\n\nSee the [Broker Applet Configuration Schemas](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/broker-vm-tenant-side/broker-papi-tables#broker-applet-configuration-schemas) table.\n\nOperations that exist only for one applet are also surfaced in this\ntag for navigation convenience (`downloadWefCert` for `wec`,\n`networkMapperScanNow` for `network_mapper`).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"parameters":{"DeviceIdPath":{"name":"device_id","in":"path","required":true,"description":"The broker device identifier as returned by `getBrokers`.","schema":{"type":"string","minLength":1}}},"responses":{"EmptyOk":{"description":"Action accepted; no response body content.","content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"description":"Empty object on success."}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Conflict":{"description":"The action cannot proceed in the current state — most commonly,\nthe broker is disconnected, or an applet is not in the required\nactive/inactive state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}},"schemas":{"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}}},"paths":{"/public_api/v1/brokers/{device_id}/applets/network_mapper/scan_now/":{"post":{"tags":["applets"],"operationId":"networkMapperScanNow","summary":"Trigger an immediate Network Mapper scan","description":"Bypass the configured scanning schedule and trigger an immediate\nscan from the broker's Network Mapper applet. The request has no\nbody; the action is enqueued and acknowledged synchronously.\n\n**Required permission:** `broker_action`.\n\n- `404 Not Found` — broker is unknown.\n- `409 Conflict` — broker is disconnected, or the\n  `network_mapper` applet is not currently active.\n","parameters":[{"$ref":"#/components/parameters/DeviceIdPath"}],"responses":{"200":{"$ref":"#/components/responses/EmptyOk"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/applets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.