Remote log bundle
Cloud-orchestrated three-step flow to obtain a log bundle from a remote broker: request generation, poll for completion, then download. For an on-appliance synchronous stream, use the /public_api/v1/logs endpoint of the direct Broker API spec.
Ask the broker to collect a log bundle and upload it to cloud storage. The operation is idempotent: if a previous bundle request for the same broker is still in flight, this call returns LogRequestAlreadyInProgress rather than enqueuing a second job.
Once enqueued, poll getLogBundleStatus until LogRequestSucceeded, then download via downloadLogBundle.
Required permission: broker_action.
The tenant API key value, sent as the literal Authorization
header value (no Bearer prefix).
The tenant API key identifier corresponding to the value sent in
Authorization.
The broker device identifier as returned by getBrokers.
6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02Request enqueued (or already in progress).
Payload returned by generateLogBundle. The code field discriminates between newly-enqueued (LogRequestSubmitted) and already-in-flight (LogRequestAlreadyInProgress).
LogRequestSubmitted — a new bundle request was enqueued.
LogRequestAlreadyInProgress — a prior request is still in
flight and was not duplicated.
Always true for this endpoint; reserved for parity with the legacy log-status payload.
Missing or invalid Authorization / x-xdr-auth-id credentials.
Authenticated caller lacks the broker_action permission, or the
targeted broker is a cluster member and the operation is rejected
at that level.
The targeted resource does not exist.
The action cannot proceed in the current state — most commonly, the broker is disconnected, or an applet is not in the required active/inactive state.
Unexpected server-side failure.
POST /public_api/v1/brokers/{device_id}/logs/generate/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"code": "LogRequestSubmitted",
"status": true
}Return the status of the most recent log-bundle request for the broker. The log_collection_time field is always present (ISO 8601 UTC string when the bundle has been collected, null otherwise) so clients can rely on a stable response shape regardless of state.
See the Broker Log Bundle Status Codes table.
Use code (not status) to distinguish states: status is true only for LogRequestSucceeded.
Required permission: broker_action.
The tenant API key value, sent as the literal Authorization
header value (no Bearer prefix).
The tenant API key identifier corresponding to the value sent in
Authorization.
The broker device identifier as returned by getBrokers.
6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02Current log-bundle request status.
Payload returned by getLogBundleStatus. The code field reflects the current state of the log bundle.
Status of the most recent log-bundle request. See the endpoint description for the meaning of each value.
true only when the bundle is ready for download
(LogRequestSucceeded); false for in-progress and all
failure states. Key off code rather than status to
distinguish in-progress from failure.
ISO 8601 UTC timestamp of when the broker finished
collecting the bundle. null when the bundle has not yet
completed (or the request failed before completion).
2026-05-17T10:21:08+00:00Missing or invalid Authorization / x-xdr-auth-id credentials.
Authenticated caller lacks the broker_action permission, or the
targeted broker is a cluster member and the operation is rejected
at that level.
Unexpected server-side failure.
GET /public_api/v1/brokers/{device_id}/logs/status/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"code": "LogRequestInProgress",
"status": false,
"log_collection_time": null
}Stream the most recent log bundle for the broker as a gzipped tar archive (<device_id>_<epoch_ms>.tar.gz). Call only after getLogBundleStatus returns LogRequestSucceeded; calling earlier yields 4xx.
Required permission: broker_action.
The tenant API key value, sent as the literal Authorization
header value (no Bearer prefix).
The tenant API key identifier corresponding to the value sent in
Authorization.
The broker device identifier as returned by getBrokers.
6f3a8c7e-1a9b-4c0d-9e21-7f5d3b1c8a02Gzipped tar archive of the log bundle.
Raw bytes of the gzipped tar archive.
Missing or invalid Authorization / x-xdr-auth-id credentials.
Authenticated caller lacks the broker_action permission, or the
targeted broker is a cluster member and the operation is rejected
at that level.
The targeted resource does not exist.
The action cannot proceed in the current state — most commonly, the broker is disconnected, or an applet is not in the required active/inactive state.
Unexpected server-side failure.
GET /public_api/v1/brokers/{device_id}/logs/download/ HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
binaryLast updated
Was this helpful?