> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/controls.md).

# Controls

Operations for managing compliance controls

## Get compliance controls (v1)

> Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.\
> \
> Retrieve compliance control details with optional filtering, sorting and pagination.\
> \- The response is concatenated using AND condition (OR is not supported)\
> \- The maximum result set size is >100\
> \- Offset is the zero-based number of assessment profiles from the start of the result set\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"Filter":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","enum":["name","category","subcategory","is_custom","creation_time","created_by","modified_by","modification_time","id","description"],"description":"Identifies the compliance control field the filter should match. Filters are based on the following keywords:\n- `name`: Compliance control name\n- `category` : Compliance control category\n- `subcategory`: Compliance control subcategory\n- `description`: Compliance control description\n- `created_by`: Creator of the compliance control\n- `modified_by`: Modifier of the compliance control\n- `id`: Compliance control ID\n- `creation_time`: Compliance control's creation time\n- `modification_time`: Compliance control's modification time\n- `is_custom`: Whether the compliance control is custom"},"operator":{"enum":["eq","neq","contains","not_contains","gte","lte","range","relative_timestamp","in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`: \n- `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`: String\n\n`gte`, `lte`, `range`, `relative_timestamp`: \n- `creation_time`, `modification_time`: Integer in timestamp epoch milliseconds\n\n`in`:\n- `is_custom`: valid values are `yes` or `no`"},"value":{"oneOf":[{"type":"string","description":"When the `field` value is one of the following, the `value` is type string: `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`"},{"type":"integer","description":"When the `field` value is one of the following, the `value` is type integer: `creation_time`, `modification_time`"},{"enum":["yes","no"],"description":"When the `field` value is one of the following, the `value` is type enum: `is_custom`"}],"description":"Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter."}}},"Control":{"type":"object","properties":{"id":{"type":"string","description":"Compliance control ID"},"name":{"type":"string","description":"Compliance control name"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"},"creation_time":{"type":"integer","format":"int64","description":"Creation timestamp"},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","description":"User who last modified the control"},"is_custom":{"type":"boolean","description":"Whether this is a custom control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v1/compliance/get_controls":{"post":{"summary":"Get compliance controls (v1)","description":"Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.\n\nRetrieve compliance control details with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControls","tags":["Controls"],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","items":{"$ref":"#/components/schemas/Filter"}},"sort":{"type":"object","properties":{"field":{"type":"string","enum":["name","category","subcategory","creation_time","created_by","modified_by","modification_time","id"],"default":"creation_time","description":"Sort according to this field"},"keyword":{"type":"string","enum":["asc","desc"],"default":"asc","description":"Sort in ascending (`asc`) or descending (`desc`) order"}}},"search_from":{"type":"integer","minimum":0,"default":0,"description":"Integer representing the starting offset within the query result set from which you want compliance controls returned.\nCompliance controls are returned as a zero-based list. Any compliance control indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Integer representing the end offset within the result set after which you do not want compliance controls returned.\nCompliance controls in the compliance control list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all compliance controls to the end of the list."}}}}}}}},"responses":{"200":{"description":"Successfully retrieved controls","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Total number of controls"},"result_count":{"type":"integer","description":"Number of controls matching filters + paging"},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Get compliance control by ID (v1)

> Get details of the compliance control specified by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/get_control":{"post":{"summary":"Get compliance control by ID (v1)","description":"Get details of the compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"}}}}}}}},"responses":{"200":{"description":"Successfully retrieved control","content":{"application/json":{"schema":{"type":"object","properties":{"control":{"type":"object","properties":{"CATEGORY":{"type":"string"},"CATEGORY_DESCRIPTION":{"type":"string"},"SUBCATEGORY":{"type":"string"},"SUBCATEGORY_DESCRIPTION":{"type":"string"},"CONTROL_ID":{"type":"string"},"STANDARDS":{"type":"array","items":{"type":"string"}},"CONTROL_NAME":{"type":"string"},"SEVERITY":{"type":"string"},"SUPPORTED":{"type":"boolean"},"INSERTION_TIME":{"type":"integer"},"MODIFICATION_TIME":{"type":"integer"},"MODIFIED_BY":{"type":"null"},"CREATED_BY":{"type":"string"},"DESCRIPTION":{"type":"string"},"MITIGATION":{"type":"null"},"ADDITIONAL_DATA":{"type":"array","items":{"type":"object","properties":{}}},"COMPLIANCE_RULES":{"type":"array","items":{"type":"object","properties":{}}},"RULES":{"type":"integer"},"REVISION":{"type":"string"},"IMPACT":{"type":"null"},"AUTOMATION_STATUS":{"type":"string"},"AUDIT_PROCEDURE":{"type":"null"},"ENABLED":{"type":"boolean"},"IS_CUSTOM":{"type":"boolean"},"STATUS":{"type":"string"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Add new control (v1)

> Create a custom compliance control.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/add_control":{"post":{"summary":"Add new control (v1)","description":"Create a custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"addControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["control_name","category"],"properties":{"control_name":{"type":"string","description":"Name of the compliance control"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"}}}}}}}},"responses":{"200":{"description":"Control added successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the compliance control creation was successful"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Edit existing control (v1)

> Edit an existing compliance custom compliance control.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/edit_control":{"post":{"summary":"Edit existing control (v1)","description":"Edit an existing compliance custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"editControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"},"control_name":{"type":"string","description":"Name of the compliance control"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"}}}}}}}},"responses":{"200":{"description":"Control updated successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the custom compliance control was edited successfully"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Delete control (v1)

> Delete a compliance control specified by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/delete_control":{"post":{"summary":"Delete control (v1)","description":"Delete a compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"deleteControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"}}}}}}}},"responses":{"200":{"description":"Control deleted successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the compliance control was successfully deleted"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Get control by revision (v1)

> Get details of the compliance control specified by its revision ID, including inactive controls.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"Control":{"type":"object","properties":{"id":{"type":"string","description":"Compliance control ID"},"name":{"type":"string","description":"Compliance control name"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"},"creation_time":{"type":"integer","format":"int64","description":"Creation timestamp"},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","description":"User who last modified the control"},"is_custom":{"type":"boolean","description":"Whether this is a custom control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v1/compliance/get_control_by_revision":{"post":{"summary":"Get control by revision (v1)","description":"Get details of the compliance control specified by its revision ID, including inactive controls.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControlByRevision","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["control_revision"],"properties":{"control_revision":{"type":"string","description":"Control revision ID"}}}}}}}},"responses":{"200":{"description":"Successfully retrieved control","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"control":{"$ref":"#/components/schemas/Control"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## List controls (v2)

> Returns controls for a standard with pagination. Optionally filter by \`category\_id\`.\
> Requires \`platform\_compliance\_view\` permission.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"parameters":{"OffsetParam":{"name":"offset","in":"query","required":false,"description":"Pagination offset (0-based)","schema":{"type":"integer","minimum":0,"default":0}},"LimitParam":{"name":"limit","in":"query","required":false,"description":"Maximum number of results to return (PAPI). Default 50, max 200.","schema":{"type":"integer","minimum":1,"maximum":200,"default":50}}},"schemas":{"PapiPaginatedResponse":{"type":"object","description":"PAPI pagination envelope","required":["total_count","results"],"properties":{"total_count":{"type":"integer","description":"Total number of items matching the query"},"results":{"type":"array","items":{"type":"object"},"description":"Array of result items for the current page"},"next_offset":{"type":"integer","nullable":true,"description":"Offset for the next page, or null if no more results"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls":{"get":{"operationId":"papiListControls","summary":"List controls (v2)","description":"Returns controls for a standard with pagination. Optionally filter by `category_id`.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"parameters":[{"name":"standard_id","in":"query","required":true,"description":"UUID of the standard to list controls for","schema":{"type":"string","format":"uuid"}},{"name":"category_id","in":"query","required":false,"description":"Filter controls by category or subcategory ID","schema":{"type":"string","format":"uuid"}},{"$ref":"#/components/parameters/OffsetParam"},{"$ref":"#/components/parameters/LimitParam"}],"responses":{"200":{"description":"Paginated list of controls","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiPaginatedResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"}}}}}}
```

## Create a single control (v2)

> Creates a single control within a standard. The \`standard\_id\` must be provided in the\
> request body. The control can optionally specify a \`category\_id\` for placement within\
> the hierarchy (use a subcategory ID if placing under a subcategory).\
> \
> When \`rule\_ids\` is provided, the given rules are associated with the newly created control.\
> \
> Requires \`platform\_compliance\_edit\` permission.\
> \
> Returns \*\*400\*\* if the parent standard is official (\`is\_custom: false\`).\
> Out-of-the-box standards and their children are immutable from this API.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"PapiControlCreate":{"type":"object","description":"PAPI request body for creating a single control.\nMatches `PapiCreateControlRequest` Pydantic model.\n","required":["standard_id","name","category_id"],"properties":{"standard_id":{"type":"string","format":"uuid","description":"UUID of the parent standard"},"name":{"type":"string","minLength":1,"maxLength":256,"description":"Control name"},"index":{"type":"string","default":"","description":"Control index/number within the standard (e.g., \"1.1\", \"4.2\")"},"description":{"type":"string","maxLength":2048,"default":"","description":"Control description"},"category_id":{"type":"string","format":"uuid","description":"UUID of the parent category or subcategory (required)"},"mitigation":{"type":"string","nullable":true,"description":"Mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Impact description"},"automation_status":{"type":"string","nullable":true,"description":"Automation status (e.g., \"automated\", \"manual\")"},"audit_procedure":{"type":"string","nullable":true,"description":"Audit procedure"},"rule_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional list of rule IDs to associate with this control"}}},"PapiControlResponse":{"type":"object","description":"PAPI response model for a compliance control.\nMatches `PapiControlResponse` Pydantic model (snake_case v2 naming).\n","required":["id","standard_id","name","index","description","is_custom","revision","created_by","insert_ts"],"properties":{"id":{"type":"string","description":"Control unique identifier"},"standard_id":{"type":"string","description":"UUID of the parent standard this control belongs to"},"category_id":{"type":"string","nullable":true,"description":"UUID of the category or subcategory this control belongs to (null if uncategorized)"},"name":{"type":"string","description":"Control name"},"index":{"type":"string","description":"Control index/number within the standard"},"description":{"type":"string","description":"Control description"},"mitigation":{"type":"string","nullable":true,"description":"Mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Impact description"},"automation_status":{"type":"string","nullable":true,"description":"Automation status"},"audit_procedure":{"type":"string","nullable":true,"description":"Audit procedure"},"severity":{"type":"string","nullable":true,"description":"Control severity level"},"is_custom":{"type":"boolean","description":"Whether this is a custom (user-created) control"},"revision":{"type":"integer","format":"int64","description":"Content-addressable revision hash (signed 64-bit integer)"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","nullable":true,"description":"User who last modified the control"},"insert_ts":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"modify_ts":{"type":"integer","format":"int64","nullable":true,"description":"Last modification timestamp (epoch milliseconds)"},"rule_ids":{"type":"array","items":{"type":"string"},"description":"List of rule IDs associated with this control"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message describing what went wrong"},"err_extra":{"type":"object","description":"Additional error details"}},"required":["err_code","err_msg"]}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls":{"post":{"operationId":"papiCreateControl","summary":"Create a single control (v2)","description":"Creates a single control within a standard. The `standard_id` must be provided in the\nrequest body. The control can optionally specify a `category_id` for placement within\nthe hierarchy (use a subcategory ID if placing under a subcategory).\n\nWhen `rule_ids` is provided, the given rules are associated with the newly created control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiControlCreate"}}},"description":"Payload for create a single control"},"responses":{"201":{"description":"Control created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiControlResponse"}}}},"400":{"description":"Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}}
```

## Get a single control (v2)

> Returns a single control by ID.\
> Requires \`platform\_compliance\_view\` permission.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"PapiControlResponse":{"type":"object","description":"PAPI response model for a compliance control.\nMatches `PapiControlResponse` Pydantic model (snake_case v2 naming).\n","required":["id","standard_id","name","index","description","is_custom","revision","created_by","insert_ts"],"properties":{"id":{"type":"string","description":"Control unique identifier"},"standard_id":{"type":"string","description":"UUID of the parent standard this control belongs to"},"category_id":{"type":"string","nullable":true,"description":"UUID of the category or subcategory this control belongs to (null if uncategorized)"},"name":{"type":"string","description":"Control name"},"index":{"type":"string","description":"Control index/number within the standard"},"description":{"type":"string","description":"Control description"},"mitigation":{"type":"string","nullable":true,"description":"Mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Impact description"},"automation_status":{"type":"string","nullable":true,"description":"Automation status"},"audit_procedure":{"type":"string","nullable":true,"description":"Audit procedure"},"severity":{"type":"string","nullable":true,"description":"Control severity level"},"is_custom":{"type":"boolean","description":"Whether this is a custom (user-created) control"},"revision":{"type":"integer","format":"int64","description":"Content-addressable revision hash (signed 64-bit integer)"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","nullable":true,"description":"User who last modified the control"},"insert_ts":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"modify_ts":{"type":"integer","format":"int64","nullable":true,"description":"Last modification timestamp (epoch milliseconds)"},"rule_ids":{"type":"array","items":{"type":"string"},"description":"List of rule IDs associated with this control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls/{control_id}":{"get":{"operationId":"papiGetControl","summary":"Get a single control (v2)","description":"Returns a single control by ID.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"responses":{"200":{"description":"Control details","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiControlResponse"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}}
```

## Update a single control (v2)

> Updates a single control by ID. All fields are optional; only included fields are updated.\
> When \`rule\_ids\` is provided, replaces the full set of rule associations for this control.\
> Omit \`rule\_ids\` to leave existing associations unchanged.\
> \
> Any \`standard\_id\` in the payload is silently stripped server-side\
> (re-parenting to a different standard is rejected by the\
> single-standard-ownership invariant). The \`is\_custom\` field is\
> server-derived from the parent standard and cannot be overridden.\
> \
> Requires \`platform\_compliance\_edit\` permission.\
> \
> Returns \*\*400\*\* if the parent standard is official (\`is\_custom: false\`).\
> Out-of-the-box standards and their children are immutable from this API.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"PapiControlUpdate":{"type":"object","description":"PAPI request body for updating a single control.\nMatches `PapiUpdateControlRequest` Pydantic model.\nAll fields are optional; only included fields are updated.\n","properties":{"name":{"type":"string","minLength":1,"maxLength":256,"description":"Updated control name"},"description":{"type":"string","maxLength":2048,"description":"Updated description"},"category_id":{"type":"string","format":"uuid","nullable":true,"description":"Updated category or subcategory ID"},"mitigation":{"type":"string","nullable":true,"description":"Updated mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Updated impact description"},"automation_status":{"type":"string","nullable":true,"description":"Updated automation status"},"audit_procedure":{"type":"string","nullable":true,"description":"Updated audit procedure"},"severity":{"type":"string","nullable":true,"description":"Updated severity level"},"rule_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional list of rule IDs to associate with this control (replaces existing associations)"}}},"PapiControlResponse":{"type":"object","description":"PAPI response model for a compliance control.\nMatches `PapiControlResponse` Pydantic model (snake_case v2 naming).\n","required":["id","standard_id","name","index","description","is_custom","revision","created_by","insert_ts"],"properties":{"id":{"type":"string","description":"Control unique identifier"},"standard_id":{"type":"string","description":"UUID of the parent standard this control belongs to"},"category_id":{"type":"string","nullable":true,"description":"UUID of the category or subcategory this control belongs to (null if uncategorized)"},"name":{"type":"string","description":"Control name"},"index":{"type":"string","description":"Control index/number within the standard"},"description":{"type":"string","description":"Control description"},"mitigation":{"type":"string","nullable":true,"description":"Mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Impact description"},"automation_status":{"type":"string","nullable":true,"description":"Automation status"},"audit_procedure":{"type":"string","nullable":true,"description":"Audit procedure"},"severity":{"type":"string","nullable":true,"description":"Control severity level"},"is_custom":{"type":"boolean","description":"Whether this is a custom (user-created) control"},"revision":{"type":"integer","format":"int64","description":"Content-addressable revision hash (signed 64-bit integer)"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","nullable":true,"description":"User who last modified the control"},"insert_ts":{"type":"integer","format":"int64","description":"Creation timestamp (epoch milliseconds)"},"modify_ts":{"type":"integer","format":"int64","nullable":true,"description":"Last modification timestamp (epoch milliseconds)"},"rule_ids":{"type":"array","items":{"type":"string"},"description":"List of rule IDs associated with this control"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message describing what went wrong"},"err_extra":{"type":"object","description":"Additional error details"}},"required":["err_code","err_msg"]}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls/{control_id}":{"post":{"operationId":"papiUpdateControl","summary":"Update a single control (v2)","description":"Updates a single control by ID. All fields are optional; only included fields are updated.\nWhen `rule_ids` is provided, replaces the full set of rule associations for this control.\nOmit `rule_ids` to leave existing associations unchanged.\n\nAny `standard_id` in the payload is silently stripped server-side\n(re-parenting to a different standard is rejected by the\nsingle-standard-ownership invariant). The `is_custom` field is\nserver-derived from the parent standard and cannot be overridden.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiControlUpdate"}}},"description":"Payload for update a single control"},"responses":{"200":{"description":"Control updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiControlResponse"}}}},"400":{"description":"Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}}
```

## Delete a single control (v2)

> Deletes a single control by ID.\
> Requires \`platform\_compliance\_edit\` permission.\
> \
> Returns \*\*400\*\* if the parent standard is official (\`is\_custom: false\`).\
> Out-of-the-box standards and their children are immutable from this API.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message describing what went wrong"},"err_extra":{"type":"object","description":"Additional error details"}},"required":["err_code","err_msg"]}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls/{control_id}":{"delete":{"operationId":"papiDeleteControl","summary":"Delete a single control (v2)","description":"Deletes a single control by ID.\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"responses":{"204":{"description":"Control deleted"},"400":{"description":"Bad request. Returned when the parent standard is official\n(`is_custom: false`).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}}
```

## Bulk create controls (v2)

> Creates multiple controls in a single request. Each item in the request body array\
> must include a \`standard\_id\` field.\
> \
> Returns a \`BulkControlResult\` with \`succeeded\` and \`failed\` arrays indicating the\
> outcome for each control.\
> \
> Requires \`platform\_compliance\_edit\` permission.\
> \
> Returns \*\*400\*\* if the parent standard is official (\`is\_custom: false\`).\
> Out-of-the-box standards and their children are immutable from this API.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"PapiControlCreate":{"type":"object","description":"PAPI request body for creating a single control.\nMatches `PapiCreateControlRequest` Pydantic model.\n","required":["standard_id","name","category_id"],"properties":{"standard_id":{"type":"string","format":"uuid","description":"UUID of the parent standard"},"name":{"type":"string","minLength":1,"maxLength":256,"description":"Control name"},"index":{"type":"string","default":"","description":"Control index/number within the standard (e.g., \"1.1\", \"4.2\")"},"description":{"type":"string","maxLength":2048,"default":"","description":"Control description"},"category_id":{"type":"string","format":"uuid","description":"UUID of the parent category or subcategory (required)"},"mitigation":{"type":"string","nullable":true,"description":"Mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Impact description"},"automation_status":{"type":"string","nullable":true,"description":"Automation status (e.g., \"automated\", \"manual\")"},"audit_procedure":{"type":"string","nullable":true,"description":"Audit procedure"},"rule_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional list of rule IDs to associate with this control"}}},"BulkControlResult":{"type":"object","description":"Aggregated result of a bulk control operation (create, update, or delete).\nContains two arrays: `succeeded` lists controls that were processed successfully,\nand `failed` lists controls that encountered errors.\n","required":["succeeded","failed"],"properties":{"succeeded":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that were successfully processed"},"failed":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that failed processing (each includes an `error` message)"}}},"BulkControlResultItem":{"type":"object","description":"Result for a single item in a bulk control operation.","required":["id","success"],"properties":{"id":{"type":"string","description":"Control ID"},"success":{"type":"boolean","description":"Whether the operation succeeded for this control"},"error":{"type":"string","nullable":true,"description":"Error message if the operation failed for this control"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message describing what went wrong"},"err_extra":{"type":"object","description":"Additional error details"}},"required":["err_code","err_msg"]}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls/bulk":{"post":{"operationId":"papiBulkCreateControls","summary":"Bulk create controls (v2)","description":"Creates multiple controls in a single request. Each item in the request body array\nmust include a `standard_id` field.\n\nReturns a `BulkControlResult` with `succeeded` and `failed` arrays indicating the\noutcome for each control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/PapiControlCreate"},"minItems":1}}},"description":"Payload for bulk create controls"},"responses":{"200":{"description":"Bulk create result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkControlResult"}}}},"400":{"description":"Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}}
```

## Bulk update controls (v2)

> Updates multiple controls in a single request. The request body is a\
> JSON array of update objects, each containing a \`control\_id\` and the fields to update.\
> \
> Returns a \`BulkControlResult\` with \`succeeded\` and \`failed\` arrays indicating the\
> outcome for each control.\
> \
> Requires \`platform\_compliance\_edit\` permission.\
> \
> Returns \*\*400\*\* if the parent standard is official (\`is\_custom: false\`).\
> Out-of-the-box standards and their children are immutable from this API.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"BulkUpdateControlItem":{"type":"object","description":"Single item in a bulk update controls request. Must include `control_id` to identify\nthe control to update. All other fields are optional; only included fields are updated.\n","required":["control_id"],"properties":{"control_id":{"type":"string","description":"UUID of the control to update"},"name":{"type":"string","minLength":1,"maxLength":256,"description":"Updated control name"},"description":{"type":"string","maxLength":2048,"description":"Updated description"},"category_id":{"type":"string","format":"uuid","nullable":true,"description":"Updated category or subcategory ID"},"mitigation":{"type":"string","nullable":true,"description":"Updated mitigation guidance"},"impact":{"type":"string","nullable":true,"description":"Updated impact description"},"automation_status":{"type":"string","nullable":true,"description":"Updated automation status"},"audit_procedure":{"type":"string","nullable":true,"description":"Updated audit procedure"},"severity":{"type":"string","nullable":true,"description":"Updated severity level"},"rule_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional list of rule IDs to associate with this control (replaces existing associations)"}}},"BulkControlResult":{"type":"object","description":"Aggregated result of a bulk control operation (create, update, or delete).\nContains two arrays: `succeeded` lists controls that were processed successfully,\nand `failed` lists controls that encountered errors.\n","required":["succeeded","failed"],"properties":{"succeeded":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that were successfully processed"},"failed":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that failed processing (each includes an `error` message)"}}},"BulkControlResultItem":{"type":"object","description":"Result for a single item in a bulk control operation.","required":["id","success"],"properties":{"id":{"type":"string","description":"Control ID"},"success":{"type":"boolean","description":"Whether the operation succeeded for this control"},"error":{"type":"string","nullable":true,"description":"Error message if the operation failed for this control"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message describing what went wrong"},"err_extra":{"type":"object","description":"Additional error details"}},"required":["err_code","err_msg"]}}}}},"paths":{"/public_api/v2/compliance/controls/bulk-update":{"post":{"operationId":"papiBulkUpdateControls","summary":"Bulk update controls (v2)","description":"Updates multiple controls in a single request. The request body is a\nJSON array of update objects, each containing a `control_id` and the fields to update.\n\nReturns a `BulkControlResult` with `succeeded` and `failed` arrays indicating the\noutcome for each control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/BulkUpdateControlItem"},"minItems":1}}},"description":"Payload for bulk update controls"},"responses":{"200":{"description":"Bulk update result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkControlResult"}}}},"400":{"description":"Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard of any control in the batch is official\n(`is_custom: false`) — see `official_standard` example.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Bulk delete controls (v2)

> Deletes multiple controls by ID in a single request. Uses \`POST\` to avoid unreliable\
> \`DELETE\`-with-body pattern.\
> \
> Requires \`platform\_compliance\_edit\` permission.\
> \
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"PapiBulkDeleteControls":{"type":"object","description":"PAPI request body for bulk deleting controls.","required":["control_ids"],"properties":{"control_ids":{"type":"array","items":{"type":"string"},"description":"Array of control IDs to delete"}}},"BulkControlResult":{"type":"object","description":"Aggregated result of a bulk control operation (create, update, or delete).\nContains two arrays: `succeeded` lists controls that were processed successfully,\nand `failed` lists controls that encountered errors.\n","required":["succeeded","failed"],"properties":{"succeeded":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that were successfully processed"},"failed":{"type":"array","items":{"$ref":"#/components/schemas/BulkControlResultItem"},"description":"Controls that failed processing (each includes an `error` message)"}}},"BulkControlResultItem":{"type":"object","description":"Result for a single item in a bulk control operation.","required":["id","success"],"properties":{"id":{"type":"string","description":"Control ID"},"success":{"type":"boolean","description":"Whether the operation succeeded for this control"},"error":{"type":"string","nullable":true,"description":"Error message if the operation failed for this control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v2/compliance/controls/delete":{"post":{"operationId":"papiBulkDeleteControls","summary":"Bulk delete controls (v2)","description":"Deletes multiple controls by ID in a single request. Uses `POST` to avoid unreliable\n`DELETE`-with-body pattern.\n\nRequires `platform_compliance_edit` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiBulkDeleteControls"}}},"description":"Payload for bulk delete controls"},"responses":{"200":{"description":"Bulk delete result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkControlResult"}}}},"400":{"$ref":"#/components/responses/BadRequest"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/controls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.