> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/controls.md).

# Controls

Operations for managing compliance controls

## Get compliance controls (v1)

> Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.\
> \
> Retrieve compliance control details with optional filtering, sorting and pagination.\
> \- The response is concatenated using AND condition (OR is not supported)\
> \- The maximum result set size is >100\
> \- Offset is the zero-based number of assessment profiles from the start of the result set\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"Filter":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","enum":["name","category","subcategory","is_custom","creation_time","created_by","modified_by","modification_time","id","description"],"description":"Identifies the compliance control field the filter should match. Filters are based on the following keywords:\n- `name`: Compliance control name\n- `category` : Compliance control category\n- `subcategory`: Compliance control subcategory\n- `description`: Compliance control description\n- `created_by`: Creator of the compliance control\n- `modified_by`: Modifier of the compliance control\n- `id`: Compliance control ID\n- `creation_time`: Compliance control's creation time\n- `modification_time`: Compliance control's modification time\n- `is_custom`: Whether the compliance control is custom"},"operator":{"enum":["eq","neq","contains","not_contains","gte","lte","range","relative_timestamp","in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`: \n- `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`: String\n\n`gte`, `lte`, `range`, `relative_timestamp`: \n- `creation_time`, `modification_time`: Integer in timestamp epoch milliseconds\n\n`in`:\n- `is_custom`: valid values are `yes` or `no`"},"value":{"oneOf":[{"type":"string","description":"When the `field` value is one of the following, the `value` is type string: `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`"},{"type":"integer","description":"When the `field` value is one of the following, the `value` is type integer: `creation_time`, `modification_time`"},{"enum":["yes","no"],"description":"When the `field` value is one of the following, the `value` is type enum: `is_custom`"}],"description":"Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter."}}},"Control":{"type":"object","properties":{"id":{"type":"string","description":"Compliance control ID"},"name":{"type":"string","description":"Compliance control name"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"},"creation_time":{"type":"integer","format":"int64","description":"Creation timestamp"},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","description":"User who last modified the control"},"is_custom":{"type":"boolean","description":"Whether this is a custom control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v1/compliance/get_controls":{"post":{"summary":"Get compliance controls (v1)","description":"Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.\n\nRetrieve compliance control details with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControls","tags":["Controls"],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","items":{"$ref":"#/components/schemas/Filter"}},"sort":{"type":"object","properties":{"field":{"type":"string","enum":["name","category","subcategory","creation_time","created_by","modified_by","modification_time","id"],"default":"creation_time","description":"Sort according to this field"},"keyword":{"type":"string","enum":["asc","desc"],"default":"asc","description":"Sort in ascending (`asc`) or descending (`desc`) order"}}},"search_from":{"type":"integer","minimum":0,"default":0,"description":"Integer representing the starting offset within the query result set from which you want compliance controls returned.\nCompliance controls are returned as a zero-based list. Any compliance control indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Integer representing the end offset within the result set after which you do not want compliance controls returned.\nCompliance controls in the compliance control list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all compliance controls to the end of the list."}}}}}}}},"responses":{"200":{"description":"Successfully retrieved controls","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Total number of controls"},"result_count":{"type":"integer","description":"Number of controls matching filters + paging"},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Get compliance control by ID (v1)

> Get details of the compliance control specified by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/get_control":{"post":{"summary":"Get compliance control by ID (v1)","description":"Get details of the compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"}}}}}}}},"responses":{"200":{"description":"Successfully retrieved control","content":{"application/json":{"schema":{"type":"object","properties":{"control":{"type":"object","properties":{"CATEGORY":{"type":"string"},"CATEGORY_DESCRIPTION":{"type":"string"},"SUBCATEGORY":{"type":"string"},"SUBCATEGORY_DESCRIPTION":{"type":"string"},"CONTROL_ID":{"type":"string"},"STANDARDS":{"type":"array","items":{"type":"string"}},"CONTROL_NAME":{"type":"string"},"SEVERITY":{"type":"string"},"SUPPORTED":{"type":"boolean"},"INSERTION_TIME":{"type":"integer"},"MODIFICATION_TIME":{"type":"integer"},"MODIFIED_BY":{"type":"null"},"CREATED_BY":{"type":"string"},"DESCRIPTION":{"type":"string"},"MITIGATION":{"type":"null"},"ADDITIONAL_DATA":{"type":"array","items":{"type":"object","properties":{}}},"COMPLIANCE_RULES":{"type":"array","items":{"type":"object","properties":{}}},"RULES":{"type":"integer"},"REVISION":{"type":"string"},"IMPACT":{"type":"null"},"AUTOMATION_STATUS":{"type":"string"},"AUDIT_PROCEDURE":{"type":"null"},"ENABLED":{"type":"boolean"},"IS_CUSTOM":{"type":"boolean"},"STATUS":{"type":"string"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Add new control (v1)

> Create a custom compliance control.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/add_control":{"post":{"summary":"Add new control (v1)","description":"Create a custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"addControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["control_name","category"],"properties":{"control_name":{"type":"string","description":"Name of the compliance control"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"}}}}}}}},"responses":{"200":{"description":"Control added successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the compliance control creation was successful"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Edit existing control (v1)

> Edit an existing compliance custom compliance control.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/edit_control":{"post":{"summary":"Edit existing control (v1)","description":"Edit an existing compliance custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"editControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"},"control_name":{"type":"string","description":"Name of the compliance control"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"}}}}}}}},"responses":{"200":{"description":"Control updated successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the custom compliance control was edited successfully"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Delete control (v1)

> Delete a compliance control specified by its ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}}},"paths":{"/public_api/v1/compliance/delete_control":{"post":{"summary":"Delete control (v1)","description":"Delete a compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"deleteControl","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Compliance control ID"}}}}}}}},"responses":{"200":{"description":"Control deleted successfully","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the compliance control was successfully deleted"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```

## Get control by revision (v1)

> Get details of the compliance control specified by its revision ID, including inactive controls.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.3","info":{"title":"Compliance Controls API","version":"Cortex Cloud"},"tags":[{"name":"Controls","description":"Operations for managing compliance controls"}],"servers":[{"url":"https://{tenant}.xdr.{region}.paloaltonetworks.com","description":"Cortex tenant","variables":{"tenant":{"default":"api","description":"Tenant-specific subdomain"},"region":{"default":"us","description":"Deployment region","enum":["us","eu","uk","sg","jp","ca","au","in","gov"]}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"x-xdr-auth-id","description":"API Key ID for authentication"}},"schemas":{"Control":{"type":"object","properties":{"id":{"type":"string","description":"Compliance control ID"},"name":{"type":"string","description":"Compliance control name"},"description":{"type":"string","description":"Description of the compliance control"},"category":{"type":"string","description":"Compliance control category"},"subcategory":{"type":"string","description":"Compliance control subcategory"},"creation_time":{"type":"integer","format":"int64","description":"Creation timestamp"},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp"},"created_by":{"type":"string","description":"User who created the control"},"modified_by":{"type":"string","description":"User who last modified the control"},"is_custom":{"type":"boolean","description":"Whether this is a custom control"}}},"Error":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"object","description":"Additional error details"}}}}}},"responses":{"BadRequest":{"description":"Bad request - invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"InternalServerError":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/public_api/v1/compliance/get_control_by_revision":{"post":{"summary":"Get control by revision (v1)","description":"Get details of the compliance control specified by its revision ID, including inactive controls.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"getControlByRevision","tags":["Controls"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["control_revision"],"properties":{"control_revision":{"type":"string","description":"Control revision ID"}}}}}}}},"responses":{"200":{"description":"Successfully retrieved control","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"control":{"$ref":"#/components/schemas/Control"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/controls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.