> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-external-application-management/models.md).

# Models

## The ConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}}}}
```

## The WebhookConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}}}}}
```

## The SyslogConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}}}}
```

## The SplunkConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]}}}}
```

## The AwsSqsConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]}}}}
```

## The AwsS3ConnectionConfig object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]}}}}
```

## The ExternalApplication object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"ExternalApplication":{"type":"object","description":"Enumerates the various attributes of an external application object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}}}}
```

## The ExternalApplicationResponse object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"ExternalApplicationResponse":{"type":"object","description":"Enumerates the various attributes of an external application response object","properties":{"data":{"type":"object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","maxLength":256,"description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}}}}
```

## The ExternalApplicationRequest object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"ExternalApplicationRequest":{"type":"object","description":"Enumerates the parameters for an external application request object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","application_type","connection_config"],"properties":{"name":{"type":"string","description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}}}}
```

## The Metadata object

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud External Application Management API","version":"Cortex Cloud"},"components":{"schemas":{"Metadata":{"type":"object","description":"Metadata for the response","additionalProperties":true}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-external-application-management/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.