Controls

Operations for managing compliance controls

Get compliance controls (v1)

post

Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.

Retrieve compliance control details with optional filtering, sorting and pagination.

The response is concatenated using AND condition (OR is not supported)
The maximum result set size is >100
Offset is the zero-based number of assessment profiles from the start of the result set

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Successfully retrieved controls

application/json

400

Bad request - invalid input parameters

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/get_controls

POST /public_api/v1/compliance/get_controls HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 98

{
  "request_data": {
    "filters": [
      {
        "field": "name",
        "operator": "contains",
        "value": "Access Enforcement"
      }
    ]
  }
}

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "controls": [
      {
        "id": "text",
        "name": "text",
        "description": "text",
        "category": "text",
        "subcategory": "text",
        "creation_time": 1,
        "modification_time": 1,
        "created_by": "text",
        "modified_by": "text",
        "is_custom": true
      }
    ]
  }
}

Get compliance control by ID (v1)

post

Get details of the compliance control specified by its ID.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Successfully retrieved control

application/json

400

Bad request - invalid input parameters

application/json

404

Resource not found

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/get_control

POST /public_api/v1/compliance/get_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "request_data": {
    "id": "ede175cb30ef4dd4a0e3031b1ee77868"
  }
}

{
  "control": {
    "CATEGORY": "text",
    "CATEGORY_DESCRIPTION": "text",
    "SUBCATEGORY": "text",
    "SUBCATEGORY_DESCRIPTION": "text",
    "CONTROL_ID": "text",
    "STANDARDS": [
      "text"
    ],
    "CONTROL_NAME": "text",
    "SEVERITY": "text",
    "SUPPORTED": true,
    "INSERTION_TIME": 1,
    "MODIFICATION_TIME": 1,
    "MODIFIED_BY": null,
    "CREATED_BY": "text",
    "DESCRIPTION": "text",
    "MITIGATION": null,
    "ADDITIONAL_DATA": [
      {}
    ],
    "COMPLIANCE_RULES": [
      {}
    ],
    "RULES": 1,
    "REVISION": "text",
    "IMPACT": null,
    "AUTOMATION_STATUS": "text",
    "AUDIT_PROCEDURE": null,
    "ENABLED": true,
    "IS_CUSTOM": true,
    "STATUS": "text"
  }
}

Add new control (v1)

post

Create a custom compliance control.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Control added successfully

application/json

successbooleanOptional

Whether the compliance control creation was successful

400

Bad request - invalid input parameters

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/add_control

POST /public_api/v1/compliance/add_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 103

{
  "request_data": {
    "control_name": "control name",
    "category": "Network Configuration",
    "subcategory": "4.2"
  }
}

{
  "success": true
}

Edit existing control (v1)

post

Edit an existing compliance custom compliance control.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Control updated successfully

application/json

successbooleanOptional

Whether the custom compliance control was edited successfully

400

Bad request - invalid input parameters

application/json

404

Resource not found

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/edit_control

POST /public_api/v1/compliance/edit_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 90

{
  "request_data": {
    "id": "48e2f6a9fcc049579e9c6b8eda0bd123",
    "control_name": "Great new name"
  }
}

{
  "success": true
}

Delete control (v1)

post

Delete a compliance control specified by its ID.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Control deleted successfully

application/json

successbooleanOptional

Whether the compliance control was successfully deleted

400

Bad request - invalid input parameters

application/json

404

Resource not found

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/delete_control

POST /public_api/v1/compliance/delete_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "request_data": {
    "id": "f9f744717b284e9383f9c1210ad3143d"
  }
}

{
  "success": true
}

Get control by revision (v1)

post

Get details of the compliance control specified by its revision ID, including inactive controls.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Successfully retrieved control

application/json

400

Bad request - invalid input parameters

application/json

404

Resource not found

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/get_control_by_revision

POST /public_api/v1/compliance/get_control_by_revision HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "request_data": {
    "control_revision": "4983640851729713422"
  }
}

{
  "reply": {
    "control": {
      "id": "text",
      "name": "text",
      "description": "text",
      "category": "text",
      "subcategory": "text",
      "creation_time": 1,
      "modification_time": 1,
      "created_by": "text",
      "modified_by": "text",
      "is_custom": true
    }
  }
}

List controls (v2)

get

Returns controls for a standard with pagination. Optionally filter by category_id. Requires platform_compliance_view permission.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Query parameters

standard_idstring · uuidRequired

UUID of the standard to list controls for

category_idstring · uuidOptional

Filter controls by category or subcategory ID

offsetintegerOptional

Pagination offset (0-based)

Default: 0

limitinteger · min: 1 · max: 200Optional

Maximum number of results to return (PAPI). Default 50, max 200.

Default: 50

Responses

200

Paginated list of controls

application/json

PAPI pagination envelope

total_countintegerRequired

Total number of items matching the query

Example: 42

resultsobject[]Required

Array of result items for the current page

next_offsetinteger · nullableOptional

Offset for the next page, or null if no more results

Example: 50

400

Bad request - invalid input parameters

application/json

get/public_api/v2/compliance/controls

GET /public_api/v2/compliance/controls?standard_id=123e4567-e89b-12d3-a456-426614174000 HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Accept: */*

{
  "total_count": 62,
  "results": [
    {
      "id": "33d822519cde41aaa7526510efe5d018",
      "standard_id": "28f76be2dfc64733b00427998ed890cb",
      "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
      "name": "Multi-factor authentication - 01",
      "index": "18",
      "description": "Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or communicate their organisation's sensitive data.",
      "mitigation": null,
      "impact": null,
      "automation_status": "automated",
      "audit_procedure": null,
      "severity": "low",
      "is_custom": false,
      "revision": 5444407627480884000,
      "created_by": "Palo Alto Networks",
      "modified_by": null,
      "insert_ts": 1772846817000,
      "modify_ts": 1772846817000,
      "rule_ids": [
        "rule-mfa-001"
      ]
    },
    {
      "id": "ba8ddc45f3aa4a759510642c58a195a3",
      "standard_id": "28f76be2dfc64733b00427998ed890cb",
      "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
      "name": "Multi-factor authentication - 02",
      "index": "19",
      "description": "Multi-factor authentication is used to authenticate users to third-party online services that process, store or communicate their organisation's sensitive data.",
      "mitigation": null,
      "impact": null,
      "automation_status": "automated",
      "audit_procedure": null,
      "severity": "low",
      "is_custom": false,
      "revision": 4962131855986176000,
      "created_by": "Palo Alto Networks",
      "modified_by": null,
      "insert_ts": 1772846817000,
      "modify_ts": 1772846817000,
      "rule_ids": []
    },
    {
      "id": "c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "standard_id": "28f76be2dfc64733b00427998ed890cb",
      "category_id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e",
      "name": "Ensure CloudTrail is enabled in all regions",
      "index": "3.1",
      "description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.",
      "mitigation": "Enable CloudTrail in all regions via the AWS Management Console or CLI.",
      "impact": "Minimal performance impact; storage costs for log files apply.",
      "automation_status": "automated",
      "audit_procedure": "Check that a trail exists with multi-region enabled and is logging.",
      "severity": "critical",
      "is_custom": false,
      "revision": 7823456190283746000,
      "created_by": "Palo Alto Networks",
      "modified_by": null,
      "insert_ts": 1772846817000,
      "modify_ts": 1772846817000,
      "rule_ids": [
        "rule-cloudtrail-001",
        "rule-cloudtrail-002"
      ]
    }
  ],
  "next_offset": 50
}

Create a single control (v2)

post

Creates a single control within a standard. The standard_id must be provided in the request body. The control can optionally specify a category_id for placement within the hierarchy (use a subcategory ID if placing under a subcategory).

When rule_ids is provided, the given rules are associated with the newly created control.

Requires platform_compliance_edit permission.

Returns 400 if the parent standard is official (is_custom: false). Out-of-the-box standards and their children are immutable from this API.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

PAPI request body for creating a single control. Matches PapiCreateControlRequest Pydantic model.

standard_idstring · uuidRequired

UUID of the parent standard

namestring · min: 1 · max: 256Required

Control name

indexstringOptional

Control index/number within the standard (e.g., "1.1", "4.2")

Default: ""

descriptionstring · max: 2048Optional

Control description

Default: ""

category_idstring · uuidRequired

UUID of the parent category or subcategory (required)

mitigationstring · nullableOptional

Mitigation guidance

impactstring · nullableOptional

Impact description

automation_statusstring · nullableOptional

Automation status (e.g., "automated", "manual")

audit_procedurestring · nullableOptional

Audit procedure

rule_idsstring[] · nullableOptional

Optional list of rule IDs to associate with this control

Responses

201

Control created

application/json

PAPI response model for a compliance control. Matches PapiControlResponse Pydantic model (snake_case v2 naming).

idstringRequired

Control unique identifier

Example: deee0446ef984486b1a9ce37e379dd83

standard_idstringRequired

UUID of the parent standard this control belongs to

Example: 394fc8fc210645f6af8bb4267321482a

category_idstring · nullableOptional

UUID of the category or subcategory this control belongs to (null if uncategorized)

Example: 660e8400-e29b-41d4-a716-446655440001

namestringRequired

Control name

Example: Ensure MFA is enabled

indexstringRequired

Control index/number within the standard

Example: 1.1

descriptionstringRequired

Control description

Example: Multi-factor authentication must be enabled for all users

mitigationstring · nullableOptional

Mitigation guidance

impactstring · nullableOptional

Impact description

automation_statusstring · nullableOptional

Automation status

Example: automated

audit_procedurestring · nullableOptional

Audit procedure

severitystring · nullableOptional

Control severity level

Example: high

is_custombooleanRequired

Whether this is a custom (user-created) control

Example: true

revisioninteger · int64Required

Content-addressable revision hash (signed 64-bit integer)

Example: 8514820482740168000

created_bystringRequired

User who created the control

Example: Palo Alto Networks

modified_bystring · nullableOptional

User who last modified the control

insert_tsinteger · int64Required

Creation timestamp (epoch milliseconds)

Example: 1746966658000

modify_tsinteger · int64 · nullableOptional

Last modification timestamp (epoch milliseconds)

Example: 1746966658000

rule_idsstring[]Optional

List of rule IDs associated with this control

Example: ["rule-aws-iam-mfa-root-001","rule-aws-iam-mfa-root-002"]

400

Bad request. In addition to standard validation errors, returns 400 when the parent standard is official (is_custom: false) — see official_standard example.

application/json

404

Resource not found

application/json

post/public_api/v2/compliance/controls

POST /public_api/v2/compliance/controls HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 693

{
  "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb",
  "name": "Ensure MFA is enabled for the root account",
  "index": "1.5",
  "description": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device.",
  "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "automation_status": "automated",
  "mitigation": "Enable MFA for the root account using a hardware or virtual MFA device.",
  "rule_ids": [
    "rule-aws-iam-mfa-root-001",
    "rule-aws-iam-mfa-root-002"
  ]
}

{
  "id": "deee0446ef984486b1a9ce37e379dd83",
  "standard_id": "28f76be2dfc64733b00427998ed890cb",
  "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "name": "Ensure MFA is enabled for the root account",
  "index": "1.5",
  "description": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password.",
  "mitigation": "Enable MFA for the root account using a hardware or virtual MFA device.",
  "impact": null,
  "automation_status": "automated",
  "audit_procedure": null,
  "severity": "critical",
  "is_custom": true,
  "revision": 8514820482740168000,
  "created_by": "Palo Alto Networks",
  "modified_by": null,
  "insert_ts": 1750247438000,
  "modify_ts": 1750247438000,
  "rule_ids": [
    "rule-aws-iam-mfa-root-001",
    "rule-aws-iam-mfa-root-002"
  ]
}

Get a single control (v2)

get

Returns a single control by ID. Requires platform_compliance_view permission.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Path parameters

control_idstring · uuidRequired

UUID of the control

Responses

200

Control details

application/json

PAPI response model for a compliance control. Matches PapiControlResponse Pydantic model (snake_case v2 naming).

idstringRequired

Control unique identifier

Example: deee0446ef984486b1a9ce37e379dd83

standard_idstringRequired

UUID of the parent standard this control belongs to

Example: 394fc8fc210645f6af8bb4267321482a

category_idstring · nullableOptional

UUID of the category or subcategory this control belongs to (null if uncategorized)

Example: 660e8400-e29b-41d4-a716-446655440001

namestringRequired

Control name

Example: Ensure MFA is enabled

indexstringRequired

Control index/number within the standard

Example: 1.1

descriptionstringRequired

Control description

Example: Multi-factor authentication must be enabled for all users

mitigationstring · nullableOptional

Mitigation guidance

impactstring · nullableOptional

Impact description

automation_statusstring · nullableOptional

Automation status

Example: automated

audit_procedurestring · nullableOptional

Audit procedure

severitystring · nullableOptional

Control severity level

Example: high

is_custombooleanRequired

Whether this is a custom (user-created) control

Example: true

revisioninteger · int64Required

Content-addressable revision hash (signed 64-bit integer)

Example: 8514820482740168000

created_bystringRequired

User who created the control

Example: Palo Alto Networks

modified_bystring · nullableOptional

User who last modified the control

insert_tsinteger · int64Required

Creation timestamp (epoch milliseconds)

Example: 1746966658000

modify_tsinteger · int64 · nullableOptional

Last modification timestamp (epoch milliseconds)

Example: 1746966658000

rule_idsstring[]Optional

List of rule IDs associated with this control

Example: ["rule-aws-iam-mfa-root-001","rule-aws-iam-mfa-root-002"]

404

Resource not found

application/json

get/public_api/v2/compliance/controls/{control_id}

GET /public_api/v2/compliance/controls/{control_id} HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Accept: */*

{
  "id": "82cc8e75e0084c45b49a94e11670f2e0",
  "standard_id": "28f76be2dfc64733b00427998ed890cb",
  "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "name": "Patch applications - 01",
  "index": "1",
  "description": "An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.",
  "mitigation": null,
  "impact": null,
  "automation_status": "automated",
  "audit_procedure": null,
  "severity": "informational",
  "is_custom": false,
  "revision": 5063558221326806000,
  "created_by": "Palo Alto Networks",
  "modified_by": null,
  "insert_ts": 1772846817000,
  "modify_ts": 1772846817000,
  "rule_ids": [
    "rule-patch-apps-001"
  ]
}

Update a single control (v2)

post

Updates a single control by ID. All fields are optional; only included fields are updated. When rule_ids is provided, replaces the full set of rule associations for this control. Omit rule_ids to leave existing associations unchanged.

Any standard_id in the payload is silently stripped server-side (re-parenting to a different standard is rejected by the single-standard-ownership invariant). The is_custom field is server-derived from the parent standard and cannot be overridden.

Requires platform_compliance_edit permission.

Returns 400 if the parent standard is official (is_custom: false). Out-of-the-box standards and their children are immutable from this API.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Path parameters

control_idstring · uuidRequired

UUID of the control

Body

PAPI request body for updating a single control. Matches PapiUpdateControlRequest Pydantic model. All fields are optional; only included fields are updated.

namestring · min: 1 · max: 256Optional

Updated control name

descriptionstring · max: 2048Optional

Updated description

category_idstring · uuid · nullableOptional

Updated category or subcategory ID

mitigationstring · nullableOptional

Updated mitigation guidance

impactstring · nullableOptional

Updated impact description

automation_statusstring · nullableOptional

Updated automation status

audit_procedurestring · nullableOptional

Updated audit procedure

severitystring · nullableOptional

Updated severity level

rule_idsstring[] · nullableOptional

Optional list of rule IDs to associate with this control (replaces existing associations)

Responses

200

Control updated

application/json

PAPI response model for a compliance control. Matches PapiControlResponse Pydantic model (snake_case v2 naming).

idstringRequired

Control unique identifier

Example: deee0446ef984486b1a9ce37e379dd83

standard_idstringRequired

UUID of the parent standard this control belongs to

Example: 394fc8fc210645f6af8bb4267321482a

category_idstring · nullableOptional

UUID of the category or subcategory this control belongs to (null if uncategorized)

Example: 660e8400-e29b-41d4-a716-446655440001

namestringRequired

Control name

Example: Ensure MFA is enabled

indexstringRequired

Control index/number within the standard

Example: 1.1

descriptionstringRequired

Control description

Example: Multi-factor authentication must be enabled for all users

mitigationstring · nullableOptional

Mitigation guidance

impactstring · nullableOptional

Impact description

automation_statusstring · nullableOptional

Automation status

Example: automated

audit_procedurestring · nullableOptional

Audit procedure

severitystring · nullableOptional

Control severity level

Example: high

is_custombooleanRequired

Whether this is a custom (user-created) control

Example: true

revisioninteger · int64Required

Content-addressable revision hash (signed 64-bit integer)

Example: 8514820482740168000

created_bystringRequired

User who created the control

Example: Palo Alto Networks

modified_bystring · nullableOptional

User who last modified the control

insert_tsinteger · int64Required

Creation timestamp (epoch milliseconds)

Example: 1746966658000

modify_tsinteger · int64 · nullableOptional

Last modification timestamp (epoch milliseconds)

Example: 1746966658000

rule_idsstring[]Optional

List of rule IDs associated with this control

Example: ["rule-aws-iam-mfa-root-001","rule-aws-iam-mfa-root-002"]

400

Bad request. In addition to standard validation errors, returns 400 when the parent standard is official (is_custom: false) — see official_standard example.

application/json

404

Resource not found

application/json

post/public_api/v2/compliance/controls/{control_id}

POST /public_api/v2/compliance/controls/{control_id} HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 225

{
  "name": "Patch applications - 01 (Revised)",
  "description": "An automated method of asset discovery is used at least weekly to support the detection of assets for subsequent vulnerability scanning activities.",
  "severity": "low"
}

{
  "id": "82cc8e75e0084c45b49a94e11670f2e0",
  "standard_id": "28f76be2dfc64733b00427998ed890cb",
  "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "name": "Patch applications - 01 (Revised)",
  "index": "1",
  "description": "An automated method of asset discovery is used at least weekly to support the detection of assets for subsequent vulnerability scanning activities.",
  "mitigation": null,
  "impact": null,
  "automation_status": "automated",
  "audit_procedure": null,
  "severity": "low",
  "is_custom": false,
  "revision": -2741422330345269000,
  "created_by": "Palo Alto Networks",
  "modified_by": "user@example.com",
  "insert_ts": 1772846817000,
  "modify_ts": 1750247500000,
  "rule_ids": [
    "rule-patch-apps-001"
  ]
}

Delete a single control (v2)

delete

Deletes a single control by ID. Requires platform_compliance_edit permission.

Returns 400 if the parent standard is official (is_custom: false). Out-of-the-box standards and their children are immutable from this API.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Path parameters

control_idstring · uuidRequired

UUID of the control

Responses

204

Control deleted

No content

400

Bad request. Returned when the parent standard is official (is_custom: false).

application/json

404

Resource not found

application/json

delete/public_api/v2/compliance/controls/{control_id}

DELETE /public_api/v2/compliance/controls/{control_id} HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Accept: */*

No content

Bulk create controls (v2)

post

Creates multiple controls in a single request. Each item in the request body array must include a standard_id field.

Returns a BulkControlResult with succeeded and failed arrays indicating the outcome for each control.

Requires platform_compliance_edit permission.

Returns 400 if the parent standard is official (is_custom: false). Out-of-the-box standards and their children are immutable from this API.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Bodyobject · PapiControlCreate[]

PAPI request body for creating a single control. Matches PapiCreateControlRequest Pydantic model.

standard_idstring · uuidRequired

UUID of the parent standard

namestring · min: 1 · max: 256Required

Control name

indexstringOptional

Control index/number within the standard (e.g., "1.1", "4.2")

Default: ""

descriptionstring · max: 2048Optional

Control description

Default: ""

category_idstring · uuidRequired

UUID of the parent category or subcategory (required)

mitigationstring · nullableOptional

Mitigation guidance

impactstring · nullableOptional

Impact description

automation_statusstring · nullableOptional

Automation status (e.g., "automated", "manual")

audit_procedurestring · nullableOptional

Audit procedure

rule_idsstring[] · nullableOptional

Optional list of rule IDs to associate with this control

Responses

200

Bulk create result

application/json

Aggregated result of a bulk control operation (create, update, or delete). Contains two arrays: succeeded lists controls that were processed successfully, and failed lists controls that encountered errors.

400

Bad request. In addition to standard validation errors, returns 400 when the parent standard is official (is_custom: false) — see official_standard example.

application/json

404

Resource not found

application/json

post/public_api/v2/compliance/controls/bulk

POST /public_api/v2/compliance/controls/bulk HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 982

[
  {
    "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb",
    "name": "Patch applications - 02",
    "index": "2",
    "description": "A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.",
    "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "automation_status": "automated"
  },
  {
    "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb",
    "name": "Patch applications - 03",
    "index": "3",
    "description": "A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in internet-facing services.",
    "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "automation_status": "automated"
  },
  {
    "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb",
    "name": "Restrict administrative privileges - 01",
    "index": "4",
    "description": "Requests for privileged access to systems, applications and data repositories are validated when first requested.",
    "category_id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e",
    "automation_status": "automated"
  }
]

{
  "succeeded": [
    {
      "id": "deee0446ef984486b1a9ce37e379dd83",
      "success": true,
      "error": null
    },
    {
      "id": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6",
      "success": true,
      "error": null
    },
    {
      "id": "a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4",
      "success": true,
      "error": null
    }
  ],
  "failed": []
}

Bulk update controls (v2)

post

Updates multiple controls in a single request. The request body is a JSON array of update objects, each containing a control_id and the fields to update.

Returns a BulkControlResult with succeeded and failed arrays indicating the outcome for each control.

Requires platform_compliance_edit permission.

Returns 400 if the parent standard is official (is_custom: false). Out-of-the-box standards and their children are immutable from this API.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Bodyobject · BulkUpdateControlItem[]

Single item in a bulk update controls request. Must include control_id to identify the control to update. All other fields are optional; only included fields are updated.

control_idstringRequired

UUID of the control to update

Example: 880e8400-e29b-41d4-a716-446655440001

namestring · min: 1 · max: 256Optional

Updated control name

descriptionstring · max: 2048Optional

Updated description

category_idstring · uuid · nullableOptional

Updated category or subcategory ID

mitigationstring · nullableOptional

Updated mitigation guidance

impactstring · nullableOptional

Updated impact description

automation_statusstring · nullableOptional

Updated automation status

audit_procedurestring · nullableOptional

Updated audit procedure

severitystring · nullableOptional

Updated severity level

rule_idsstring[] · nullableOptional

Optional list of rule IDs to associate with this control (replaces existing associations)

Responses

200

Bulk update result

application/json

400

Bad request. In addition to standard validation errors, returns 400 when the parent standard of any control in the batch is official (is_custom: false) — see official_standard example.

application/json

post/public_api/v2/compliance/controls/bulk-update

POST /public_api/v2/compliance/controls/bulk-update HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 316

[
  {
    "control_id": "82cc8e75-e008-4c45-b49a-94e11670f2e0",
    "name": "Patch applications - 01 (Revised)",
    "severity": "medium"
  },
  {
    "control_id": "33d82251-9cde-41aa-a752-6510efe5d018",
    "description": "Multi-factor authentication is required for all users accessing sensitive data and administrative interfaces.",
    "severity": "high"
  }
]

{
  "succeeded": [
    {
      "id": "82cc8e75e0084c45b49a94e11670f2e0",
      "success": true,
      "error": null
    },
    {
      "id": "33d822519cde41aaa7526510efe5d018",
      "success": true,
      "error": null
    }
  ],
  "failed": []
}

Bulk delete controls (v2)

post

Deletes multiple controls by ID in a single request. Uses POST to avoid unreliable DELETE-with-body pattern.

Requires platform_compliance_edit permission.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

PAPI request body for bulk deleting controls.

control_idsstring[]Required

Array of control IDs to delete

Responses

200

Bulk delete result

application/json

400

Bad request - invalid input parameters

application/json

post/public_api/v2/compliance/controls/delete

POST /public_api/v2/compliance/controls/delete HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 95

{
  "control_ids": [
    "82cc8e75-e008-4c45-b49a-94e11670f2e0",
    "33d82251-9cde-41aa-a752-6510efe5d018"
  ]
}

{
  "succeeded": [
    {
      "id": "82cc8e75e0084c45b49a94e11670f2e0",
      "success": true,
      "error": null
    },
    {
      "id": "33d822519cde41aaa7526510efe5d018",
      "success": true,
      "error": null
    }
  ],
  "failed": []
}

PreviousCompliance Assets

NextExport

Last updated 1 month ago

Was this helpful?