> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/api-keys.md). # API Keys APIs for managing API Keys ## Get existing API Keys > Get a list of API Keys filtered by expiration date, role, or ID.\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management. ```json {"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"API Keys","description":"APIs for managing API Keys"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/api_keys/get_api_keys":{"post":{"summary":"Get existing API Keys","tags":["API Keys"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"The payload of a successful response.","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer","description":"Unique identifier of the API key."},"creation_time":{"type":"integer","description":"Timestamp when the API key was created, in epoch milliseconds (UTC)."},"created_by":{"type":"string","description":"Email address of the user who created the API key."},"user_name":{"type":"string","description":"User name of the creator of API Keys."},"roles":{"type":"array","description":"List of RBAC roles assigned to this API key. Only roles that exist in the tenant's role registry are included.","items":{"type":"string"}},"security_level":{"description":"Security level of the API key.","enum":["standard","advanced"]},"comment":{"type":"string","description":"Comment describing the purpose of the API key.","nullable":true},"expiration":{"type":"integer","description":"Expiration timestamp of the API key in epoch milliseconds (UTC). A `null` value indicates the key does not expire. "}}}},"FILTER_COUNT":{"type":"integer","description":"Total number of API keys matching the applied filters (before pagination)."},"TOTAL_COUNT":{"type":"integer","description":"Total number of API keys in the tenant (no filters applied).\nNote: The `TOTAL_COUNT` value contains all API Keys, including ones that have expired."}}}}}}}}},"operationId":"post-public_api-v1-api_keys-get_api_keys","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["filters"],"description":"Parameters for filtering, sorting, and paginating API key results.","properties":{"filters":{"type":"array","description":"An array of filter fields. You can combine multiple filters with `AND` logic.\n\nThe `filters` field is required (can be an empty list `[]` to return all keys). \n\n","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"enum":["expiration","roles","id"],"description":"Identifies the API Key field the filter is matching. Filters are based on the following keywords:\r\n- `expiration`: Time the API Key expires in epoch milliseconds.\r\n- `roles`: The role assigned to the API Key at creation.\r\n- `id`: API Key ID."},"operator":{"enum":["gte","lte","contains","in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\r\n\r\n- `gte` / `lte` operator is used with `expiration` field (Integer in timestamp epoch milliseconds).\r\n\r\n- `contains` operator is used with `roles` field (Array of strings).\r\n\r\n- `in` operator is used with `id` field (Array of integers)."},"value":{"oneOf":[{"type":"array","description":"Array of API key IDs (for `id` field with `in` operator)","items":{"type":"integer"}},{"type":"array","description":"Array of role names (for `roles` field with `contains` operator)","items":{"type":"string"}},{"type":"integer","description":"Epoch timestamp in milliseconds (for `expiration` field)"}],"description":"Value that this filter must match. The contents of this field will differ depending on the API Key field that you specified for this filter:\r\n- `expiration`: Integer representing the number of milliseconds after the Unix epoch, UTC timezone.\r\n- `roles`: Array of strings representing the roles in the Cortex environment.\r\n- `id`: Array of integers representing the API Key IDs."}}}},"sort":{"type":"object","description":"Sort order for results. If omitted, results are sorted by `expiration` descending (default).","required":["field","keyword"],"properties":{"field":{"enum":["roles","expiration"],"description":"Identifies the API Key field to sort by."},"keyword":{"description":"Sort direction.","enum":["asc","desc"]}}},"search_from":{"type":"integer","description":"Starting offset index for pagination. Specifies the index of the first record to return. ","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending offset index for pagination. Specifies the index of the last record to return. ","minimum":1}}}}}}}},"description":"Get a list of API Keys filtered by expiration date, role, or ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-timestamp","description":"timestamp in milliseconds"},{"schema":{"type":"string"},"in":"header","name":"x-xdr-nonce","description":"64 byte random string"},{"schema":{"type":"string"},"in":"header","name":"x-child-tenant-id","description":"child tenant ID"}]}}}} ``` ## Generate an API Key > Generate a new API Key and define the roles assigned to it and whether the security level is standard or advanced.\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management. ```json {"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"API Keys","description":"APIs for managing API Keys"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/api_keys/generate":{"post":{"summary":"Generate an API Key","tags":["API Keys"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"id":{"type":"integer","description":"API key ID"},"key":{"type":"string","description":"API authorization key"}}}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}},"operationId":"post-public_api-v1-api_keys-generate","description":"Generate a new API Key and define the roles assigned to it and whether the security level is standard or advanced.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-timestamp","description":"timestamp in milliseconds"},{"schema":{"type":"string"},"in":"header","name":"x-xdr-nonce","description":"64 byte random string"},{"schema":{"type":"string"},"in":"header","name":"x-child-tenant-id","description":"child tenant ID"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["roles","security_level"],"properties":{"roles":{"type":"array","description":"A list of roles to be assigned to the API Key.","items":{"type":"string"}},"security_level":{"description":"The security level of the API Key. API Keys with advanced security are hashed with a nonce and timestamp, which is useful for proprietary scripts and are intended to prevent replay attacks. Standard security API Keys can be used as-is and are suitable for curl.","enum":["standard","advanced"]},"expiration":{"type":"integer","description":"Integer in timestamp epoch milliseconds. Default value is one week from the time of the API call. Maximum expiration date is six months from the time of the API call."},"comment":{"type":"string","description":"Comment describing the purpose of the API key."}}}}}}}}}}}} ``` ## Delete API Keys > Delete API Keys by ID.\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management. ```json {"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"API Keys","description":"APIs for managing API Keys"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/api_keys/delete":{"post":{"summary":"Delete API Keys","tags":["API Keys"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"update_count":{"type":"integer","description":"The number of API Keys deleted."}}}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}},"operationId":"post-public_api-v1-api_keys-delete","description":"Delete API Keys by ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-timestamp","description":"timestamp in milliseconds"},{"schema":{"type":"string"},"in":"header","name":"x-xdr-nonce","description":"64 byte random string"},{"schema":{"type":"string"},"in":"header","name":"x-child-tenant-id","description":"child tenant ID"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"enum":["id"],"description":"Identifies the API Key field the filter is matching. Filters are based on the following keyword:\r\n- `id`: The API Key ID.\r\n"},"operator":{"enum":["in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keyword is:\r\n`in`\r\n- `id`: Integer representing the API Key ID.\r\n"},"value":{"type":"array","description":"Array of API Key IDs.","items":{"type":"integer"}}}}}}}}}}}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/api-keys.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.