> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/policies.md).

# Policies

APIs for managing Cloud Workload Policies

## Get CWP Policies (v2)

> Fetches a list of all CWP policy instances. You can filter the results by policy type (e.g., COMPLIANCE, MALWARE, SECRET, TRUSTED\_IMAGES). By default, all policy types are returned. Use the disableVerbose flag to optimize performance by skipping asset group data updates.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v2/cwp/policies":{"get":{"tags":["Policies"],"operationId":"getv2CwpPolicies","summary":"Get CWP Policies (v2)","description":"Fetches a list of all CWP policy instances. You can filter the results by policy type (e.g., COMPLIANCE, MALWARE, SECRET, TRUSTED_IMAGES). By default, all policy types are returned. Use the disableVerbose flag to optimize performance by skipping asset group data updates.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"in":"query","name":"types","schema":{"type":"array","items":{"$ref":"#/components/schemas/PolicyType"}},"description":"The policies type"},{"in":"query","name":"disableVerbose","schema":{"type":"boolean","default":false,"nullable":true},"description":"Flag to bypass calling platform for asset groups data when fetching policies. Note that this means asset groups will not be updated upon fetching policies."},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"Success","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/GetPoliciesResponseV2"}}}},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}}}}},"components":{"schemas":{"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"GetPoliciesResponseV2":{"description":"The response you get when calling the `get policies V2` path","type":"array","items":{"$ref":"#/components/schemas/PolicyGetResponseDataV2"}},"PolicyGetResponseDataV2":{"type":"object","description":"The schema of a returned policy","required":["id","revision","createdAt","modifiedAt","type","createdBy","disabled","name","description","evaluationModes","evaluationStage","policyRules","condition","exception","assetScope","assetGroupsIDs","assetGroups","action","severity","remediationGuidance","usingSystemAssetGroups","gracePeriod"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"policyRules":{"type":"array","description":"Array of policy_rule objects related to the policy","items":{"$ref":"#/components/schemas/PolicyRuleGetResponseData"}},"condition":{"type":"string","format":"byte"},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"remediationGuidance":{"type":"string"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"usingSystemAssetGroups":{"type":"boolean"},"unifiedPolicyId":{"type":"string"},"gracePeriod":{"type":"string","description":"Grace period duration string in days"}}},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyRuleGetResponseData":{"type":"object","description":"The schema of policy_rule object","required":["id","rule_id","policy_id","severity","action","policy_revision","rule_name","remediation_guidance","user_remediation_guidance"],"properties":{"id":{"type":"string"},"rule_id":{"type":"string"},"policy_id":{"type":"string"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"action":{"$ref":"#/components/schemas/PolicyAction"},"policy_revision":{"type":"integer"},"rule_name":{"type":"string"},"remediation_guidance":{"type":"string"},"user_remediation_guidance":{"type":"string","description":"Additional remediation guidance that can be added to the rule’s predefined guidance."}}},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Add CWP Policies (v2)

> Creates new CWP policy. This version supports advanced configuration including policyRules, gracePeriod, and usingSystemAssetGroups.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v2/cwp/policies":{"post":{"tags":["Policies"],"operationId":"addv2CwpPolicies","summary":"Add CWP Policies (v2)","description":"Creates new CWP policy. This version supports advanced configuration including policyRules, gracePeriod, and usingSystemAssetGroups.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"description":"Policy to add.","required":true,"content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PolicyPostRequestDataV2"}}}},"responses":{"201":{"description":"Success","content":{"application/json; charset=UTF-8":{"schema":{"type":"object","properties":{"id":{"type":"string"}}}}}},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"403":{"description":"Forbidden error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}}}}},"components":{"schemas":{"PolicyPostRequestDataV2":{"type":"object","description":"The schema of a created policy","required":["type","disabled","name","description","evaluationModes","evaluationStage","policyRules","condition","exception","assetScope","assetGroupsIDs","assetGroups","action","severity","remediationGuidance","createdBy","usingSystemAssetGroups","gracePeriod"],"properties":{"type":{"$ref":"#/components/schemas/PolicyType"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"policyRules":{"type":"array","description":"Array of policy_rule objects related to the policy","items":{"$ref":"#/components/schemas/PolicyRulePostRequestData"}},"condition":{"type":"string","format":"byte"},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"remediationGuidance":{"type":"string"},"createdBy":{"type":"string"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"usingSystemAssetGroups":{"type":"boolean"},"unifiedPolicyId":{"type":"string"},"gracePeriod":{"type":"string","description":"Grace period duration string in days"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyRulePostRequestData":{"type":"object","description":"The schema of policy_rule object","required":["rule_id","severity","action","user_remediation_guidance"],"properties":{"rule_id":{"type":"string"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"action":{"$ref":"#/components/schemas/PolicyAction"},"user_remediation_guidance":{"type":"string"}}},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Get a CWP Policy by ID (v2)

> Fetches the detailed configuration of a single CWP policy identified by its unique ID. This includes associated rules, evaluation stages, and asset scope. Use disableVerbose to exclude platform-specific asset group metadata.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v2/cwp/policies/{id}":{"get":{"tags":["Policies"],"operationId":"getv2CwpPoliciesbyId","summary":"Get a CWP Policy by ID (v2)","description":"Fetches the detailed configuration of a single CWP policy identified by its unique ID. This includes associated rules, evaluation stages, and asset scope. Use disableVerbose to exclude platform-specific asset group metadata.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"in":"query","name":"disableVerbose","schema":{"type":"boolean","default":false,"nullable":true},"description":"Flag to bypass calling platform for asset groups data when fetching policies. Note that this means asset groups will not be updated upon fetching policies."},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"Success","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PolicyGetResponseDataV2"}}}},"404":{"description":"Policy ID not found","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}}}}},"components":{"schemas":{"PolicyGetResponseDataV2":{"type":"object","description":"The schema of a returned policy","required":["id","revision","createdAt","modifiedAt","type","createdBy","disabled","name","description","evaluationModes","evaluationStage","policyRules","condition","exception","assetScope","assetGroupsIDs","assetGroups","action","severity","remediationGuidance","usingSystemAssetGroups","gracePeriod"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"policyRules":{"type":"array","description":"Array of policy_rule objects related to the policy","items":{"$ref":"#/components/schemas/PolicyRuleGetResponseData"}},"condition":{"type":"string","format":"byte"},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"remediationGuidance":{"type":"string"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"usingSystemAssetGroups":{"type":"boolean"},"unifiedPolicyId":{"type":"string"},"gracePeriod":{"type":"string","description":"Grace period duration string in days"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyRuleGetResponseData":{"type":"object","description":"The schema of policy_rule object","required":["id","rule_id","policy_id","severity","action","policy_revision","rule_name","remediation_guidance","user_remediation_guidance"],"properties":{"id":{"type":"string"},"rule_id":{"type":"string"},"policy_id":{"type":"string"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"action":{"$ref":"#/components/schemas/PolicyAction"},"policy_revision":{"type":"integer"},"rule_name":{"type":"string"},"remediation_guidance":{"type":"string"},"user_remediation_guidance":{"type":"string","description":"Additional remediation guidance that can be added to the rule’s predefined guidance."}}},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Update a CWP Policy by ID (v2)

> Updates the configuration of an existing CWP policy. The policy ID is mandatory. \
>  Note: The policy revision will be automatically incremented upon a successful update. Fields not provided in the request body will be reset to their default values.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v2/cwp/policies/{id}":{"put":{"tags":["Policies"],"operationId":"updatev2CwpPolicies","summary":"Update a CWP Policy by ID (v2)","description":"Updates the configuration of an existing CWP policy. The policy ID is mandatory. \n Note: The policy revision will be automatically incremented upon a successful update. Fields not provided in the request body will be reset to their default values.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"in":"path","name":"id","required":true,"schema":{"type":"string"},"description":"The policy ID to delete"},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"description":"Policy object to update. Policy ID is mandatory. Revision will be auto-incremented. All other data fields in the request will be updated. If a data field is not present, it is considered as filled with the default value and will be updated with the default.","required":true,"content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PolicyPutRequestDataV2"}}}},"responses":{"204":{"description":"Success"},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"403":{"description":"Forbidden error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"404":{"description":"Policy ID not found","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}}}}},"components":{"schemas":{"PolicyPutRequestDataV2":{"type":"object","description":"The schema of a created policy","required":["id","type","disabled","name","description","evaluationModes","evaluationStage","policyRules","condition","exception","assetScope","assetGroupsIDs","assetGroups","action","severity","remediationGuidance","usingSystemAssetGroups","gracePeriod"],"properties":{"id":{"type":"string"},"type":{"$ref":"#/components/schemas/PolicyType"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"policyRules":{"type":"array","description":"Array of policy_rule objects related to the policy","items":{"$ref":"#/components/schemas/PolicyRulePostRequestData"}},"condition":{"type":"string","format":"byte"},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"remediationGuidance":{"type":"string"},"createdBy":{"type":"string"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"usingSystemAssetGroups":{"type":"boolean"},"unifiedPolicyId":{"type":"string"},"gracePeriod":{"type":"string","description":"Grace period duration string in days"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyRulePostRequestData":{"type":"object","description":"The schema of policy_rule object","required":["rule_id","severity","action","user_remediation_guidance"],"properties":{"rule_id":{"type":"string"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"action":{"$ref":"#/components/schemas/PolicyAction"},"user_remediation_guidance":{"type":"string"}}},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Get CWP Policies (v1)

> Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. They enable you to apply detection logic to specific asset groups at the desired SDLC stage, and define what action needs to be taken if the conditions are met.\
> \
> Get all CWP policies of the given type. Default behavior is all.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/cwp/policies":{"get":{"summary":"Get CWP Policies (v1)","operationId":"getCwpPolicies","description":"Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. They enable you to apply detection logic to specific asset groups at the desired SDLC stage, and define what action needs to be taken if the conditions are met.\n\nGet all CWP policies of the given type. Default behavior is all.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"types","in":"query","description":"The policy type","schema":{"type":"array","items":{"$ref":"#/components/schemas/PolicyType"}}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPoliciesResponse"}}}},"400":{"description":"Client error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}},"tags":["Policies"]}}},"components":{"schemas":{"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"GetPoliciesResponse":{"type":"array","description":"The response you get when calling the `get policies` path","items":{"$ref":"#/components/schemas/PolicyData"}},"PolicyData":{"type":"object","description":"The schema of a policy","required":["type","name","description","evaluationStage","rulesIds","condition","assetGroupsIDs","action","severity","missingInformationAction"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"rulesIds":{"type":"array","description":"The UUIDs of the rules that define the condition\nThe `rulesIds` field is only required for non-compliance policies.","items":{"type":"string"}},"condition":{"type":"string","format":"byte","description":"The `condition` field is only required for non-compliance policies."},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"remediationGuidance":{"type":"string"}}},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Add CWP Policies (v1)

> Add CWP policy instances.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/cwp/policies":{"post":{"summary":"Add CWP Policies (v1)","operationId":"postCwpPolicies","description":"Add CWP policy instances.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"description":"Policy to add.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyData"}}}},"responses":{"201":{"description":"Success","content":{"application/json; charset=UTF-8":{"schema":{"type":"object","properties":{"id":{"type":"string"}}}}}},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}},"tags":["Policies"]}}},"components":{"schemas":{"PolicyData":{"type":"object","description":"The schema of a policy","required":["type","name","description","evaluationStage","rulesIds","condition","assetGroupsIDs","action","severity","missingInformationAction"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"rulesIds":{"type":"array","description":"The UUIDs of the rules that define the condition\nThe `rulesIds` field is only required for non-compliance policies.","items":{"type":"string"}},"condition":{"type":"string","format":"byte","description":"The `condition` field is only required for non-compliance policies."},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"remediationGuidance":{"type":"string"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Get a CWP Policy by ID (v1)

> Get a CWP policy by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/cwp/policies/{id}":{"get":{"summary":"Get a CWP Policy by ID (v1)","operationId":"getCwpPoliciesId","description":"Get a CWP policy by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyData"}}}},"404":{"description":"Policy ID not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}},"tags":["Policies"]}}},"components":{"schemas":{"PolicyData":{"type":"object","description":"The schema of a policy","required":["type","name","description","evaluationStage","rulesIds","condition","assetGroupsIDs","action","severity","missingInformationAction"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"rulesIds":{"type":"array","description":"The UUIDs of the rules that define the condition\nThe `rulesIds` field is only required for non-compliance policies.","items":{"type":"string"}},"condition":{"type":"string","format":"byte","description":"The `condition` field is only required for non-compliance policies."},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"remediationGuidance":{"type":"string"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Update a CWP Policy by ID (v1)

> Update a CWP policy by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/cwp/policies/{id}":{"put":{"summary":"Update a CWP Policy by ID (v1)","operationId":"putCwpPoliciesId","description":"Update a CWP policy by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"id","in":"path","description":"The policy ID to delete","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"description":"policy object to update. Policy ID is mandatory. Revision will be auto-incremented. All other data fields in the request will be updated. If a data field is not present, it is considered as filled with the default value and will be updated with the default.","required":true,"content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PolicyData"}}}},"responses":{"204":{"description":"Success"},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"404":{"description":"Policy ID not found","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}},"tags":["Policies"]}}},"components":{"schemas":{"PolicyData":{"type":"object","description":"The schema of a policy","required":["type","name","description","evaluationStage","rulesIds","condition","assetGroupsIDs","action","severity","missingInformationAction"],"properties":{"id":{"type":"string"},"revision":{"type":"integer"},"createdAt":{"type":"string","format":"date-time"},"modifiedAt":{"type":"string","format":"date-time"},"type":{"$ref":"#/components/schemas/PolicyType"},"createdBy":{"type":"string"},"disabled":{"type":"boolean"},"name":{"type":"string"},"description":{"type":"string"},"evaluationModes":{"type":"array","items":{"$ref":"#/components/schemas/EvaluationMode"}},"evaluationStage":{"$ref":"#/components/schemas/EvaluationStage"},"rulesIds":{"type":"array","description":"The UUIDs of the rules that define the condition\nThe `rulesIds` field is only required for non-compliance policies.","items":{"type":"string"}},"condition":{"type":"string","format":"byte","description":"The `condition` field is only required for non-compliance policies."},"exception":{"type":"string","format":"byte"},"assetScope":{"type":"string","format":"byte"},"assetGroupsIDs":{"type":"array","items":{"type":"integer"}},"assetGroups":{"type":"array","items":{"type":"string"}},"action":{"$ref":"#/components/schemas/PolicyAction"},"severity":{"$ref":"#/components/schemas/PolicySeverity"},"missingInformationAction":{"$ref":"#/components/schemas/PolicyAction"},"remediationGuidance":{"type":"string"}}},"PolicyType":{"type":"string","nullable":true,"enum":["COMPLIANCE","MALWARE","SECRET","TRUSTED_IMAGES"],"description":"One of the supported policy types"},"EvaluationMode":{"type":"string","nullable":true,"enum":["PERIODIC","CONTINUOUS",null],"description":"One of the supported evaluation modes"},"EvaluationStage":{"type":"string","nullable":true,"enum":["CI","RUNTIME","DEPLOY",null],"description":"One of the supported evaluation stages"},"PolicyAction":{"type":"string","nullable":true,"enum":["ISSUE","PREVENT",null],"description":"One of the supported policy actions"},"PolicySeverity":{"type":"string","nullable":true,"enum":["LOW","MEDIUM","HIGH","CRITICAL",null],"description":"One of the supported policy severities"},"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```

## Delete a CWP Policy by ID (v1)

> Delete a CWP policy by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Workload Protection APIs","version":"Cortex Cloud"},"tags":[{"name":"Policies","description":"APIs for managing Cloud Workload Policies"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/cwp/policies/{id}":{"delete":{"summary":"Delete a CWP Policy by ID (v1)","operationId":"deleteCwpPoliciesId","description":"Delete a CWP policy by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"closeIssues","in":"query","description":"If set, will trigger issue closing of issues opened by the deleted policy","schema":{"type":"boolean"}},{"name":"id","in":"path","description":"The policy ID to delete","required":true,"schema":{"type":"string"}},{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"204":{"description":"Success"},"400":{"description":"Client error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"404":{"description":"Policy ID not found","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}},"500":{"description":"Service had unexpected internal error","content":{"application/json; charset=UTF-8":{"schema":{"$ref":"#/components/schemas/PublicAPIErrorResponse"}}}}},"tags":["Policies"]}}},"components":{"schemas":{"PublicAPIErrorResponse":{"type":"object","required":["err_msg","metadata"],"properties":{"err_msg":{"type":"string","description":"The error message"},"metadata":{"$ref":"#/components/schemas/PublicAPIErrorMetadata"}}},"PublicAPIErrorMetadata":{"type":"object","description":"Details for the PublicAPIError","properties":{"code":{"$ref":"#/components/schemas/Code"}},"required":["code"]},"Code":{"type":"string","description":"A short, programmatically safe string indicating the error code reported","enum":["BAD_REQUEST","INTERNAL_ERROR","NOT_FOUND","FORBIDDEN"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.