> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/endpoint-management.md).

# Endpoint Management

APIs for managing endpoints

## Get Distribution version

> Get a list of all the agent versions to use for creating a distribution list.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_versions":{"post":{"tags":["Endpoint Management"],"summary":"Get Distribution version","description":"Get a list of all the agent versions to use for creating a distribution list.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"postGetVersions","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"windows":{"type":"array","description":"List of Windows agent versions.","items":{"type":"string"}},"linux":{"type":"array","description":"List of Linux agent versions.","items":{"type":"string"}},"macos":{"type":"array","description":"List of Mac agent versions.","items":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all Endpoints

> Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_endpoints":{"post":{"tags":["Endpoint Management"],"summary":"Get all Endpoints","description":"Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetEndpoints","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"agent_id":{"type":"string"},"agent_status":{"type":"string"},"operational_status":{"type":"string"},"host_name":{"type":"string"},"agent_type":{"type":"string"},"ip":{"type":"array","items":{"type":"string"}},"last_seen":{"type":"integer"},"tags":{"type":"object","properties":{"server_tags":{"type":"array","items":{"type":"object"}},"endpoint_tags":{"type":"array","items":{"type":"object"}}}},"users":{"type":"array","items":{"type":"string"}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Policy

> Get the policy name for a specific endpoint.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_policy":{"post":{"tags":["Endpoint Management"],"summary":"Get Policy","description":"Get the policy name for a specific endpoint.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetPolicy","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID."}},"required":["endpoint_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"policy_name":{"type":"string","description":"Name of the policy allocated with the endpoint."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Delete Endpoints

> Delete the selected endpoints. You can delete up to 1000 endpoints.\
> \
> Note: Endpoints are deleted from Cortex UI, however they still exist in the database.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 1000.\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/delete":{"post":{"tags":["Endpoint Management"],"summary":"Delete Endpoints","description":"Delete the selected endpoints. You can delete up to 1000 endpoints.\n\nNote: Endpoints are deleted from Cortex UI, however they still exist in the database.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 1000.\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postDelete","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs."},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings"},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}},"required":["field","operator","value"]}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Create distributions

> Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the \*\*Get Distribution Status\*\* API.
> \\
>
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/create":{"post":{"operationId":"postCreate","summary":"Create distributions","description":"Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the **Get Distribution Status** API.\r\n\r\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","package_type","agent_version","deployment_platform","default_namespace","run_on_master_node","run_on_all_nodes"],"properties":{"name":{"type":"string","description":"The name of the installation package."},"platform":{"type":"string","description":"The installation platform.","enum":["windows","linux","macos","android","serverless"]},"package_type":{"type":"string","description":"A string representing the type of package to create. Each JSON object must contain *one* of the following keywords:\n- `standalone`: Installation for a new agent. When using this, you must include the `platform` field with one of the following values: `windows`, `linux`, `macos`, `android`, `kubernetes`, `helm`.\n- `upgrade`: Upgrade of an agent from ESM. When using this, you must include the `agent_version` field with  one of the following values: `windows_version`, `linux_version`, or `macos_version`.\n- `serverless`: Create a serverless distribution. When using this, you must include the `yaml_preferences` field with the following properties: `runtime` (Node.js or python), `deployment_type` (embedded or layers), `cloud_provider` (aws), and `restrictions_profile` (Serverless restrictions profile ID).\n- `caas_embedded`: Container-embedded XDR agent installation using the CaaS Generic Installer (Linux dockerfile-based deployment)."},"agent_version":{"type":"string","description":"Use `agent_version` when creating a standalone installer. The value should be the agent version number.\n"},"windows_version":{"type":"string","description":"Use `windows_version` when creating an upgrade package. The value is the relevant version number."},"linux_version":{"type":"string","description":"Use `linux_version` when creating an upgrade package. The value is the relevant version number."},"macos_version":{"type":"string","description":"Use `macos_version` when creating an upgrade package. The value is the relevant version number."},"deployment_platform":{"type":"string","description":"When the `package_type` is `kubernetes` or `helm`, use the `deployment_platform` to indicate the type of platform. Valid values include:\n- `standard`\n- `openshift`\n- `gcos`\n- `bottlerocket`\n- `gke_autopilot`"},"default_namespace":{"type":"string","description":"The default namespace"},"node_selector":{"type":"object","description":"The node selector in the following format:\n`\"node_selector\": {\"key\": \"val\"}'","additionalProperties":{}},"proxy":{"type":"array","items":{"type":"string"}},"cluster_name":{"type":"string","description":"Cluster name"},"run_on_master_node":{"type":"boolean","description":"Whether or not to run on the master node."},"run_on_all_nodes":{"type":"boolean","description":"Whether or not to run on all nodes."},"description":{"type":"string","description":"A description for the distribution package."},"endpoint_tags":{"type":"array","description":"List of endpoint tags to associate with the distribution package. Tags must already exist in the system.","items":{"type":"string"}},"yaml_preferences":{"type":"object","description":"Configuration for serverless distributions.","properties":{"runtime":{"type":"string","enum":["Node.js","python"],"description":"The runtime environment for the serverless function."},"deployment_type":{"type":"string","enum":["embedded","layers"],"description":"The deploy method used for the serverless agent."},"cloud_provider":{"type":"string","enum":["aws"],"description":"The cloud service provider hosting the serverless function. Currently only AWS is supported."},"restrictions_profile":{"type":"string","description":"The serverless restrictions profile ID."}}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"distribution_id":{"type":"string","description":"Installation package ID."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distributions

> Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \
> \- Retrieve existing agent installations or filter by specific criteria\
> \- Paginate through large result sets\
> \- Sort results by any field in ascending or descending order\
> \- Get total count and filtered count of agent installations<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_distributions":{"post":{"summary":"Get Distributions","description":"Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n\n- Retrieve existing agent installations or filter by specific criteria\n- Paginate through large result sets\n- Sort results by any field in ascending or descending order\n- Get total count and filtered count of agent installations\n","operationId":"get_distributions","tags":["Endpoint Management"],"requestBody":{"required":true,"description":"Request body containing pagination, sorting, and filtering criteria for agent distributions","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/GetDataRequest"}}}}}},"responses":{"200":{"description":"Successful response containing the list of distributions matching the criteria","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicGetDataResponse"}}}},"400":{"description":"Bad Request - Invalid request parameters or malformed JSON","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}},"500":{"description":"Internal Server Error - An unexpected error occurred on the server","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}]}}},"components":{"schemas":{"GetDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","additionalProperties":false,"properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"maximum":100,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (`search_to` - `search_from`). The maximum allowed value is <=100. Requests exceeding this limit will return a 400 error."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","description":"Array of filter conditions to apply. Multiple filters are combined with either `AND` or `OR` logic.","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","description":"Sorting criteria for query results.","additionalProperties":false,"required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","description":"Filter condition to apply to the query","additionalProperties":false,"required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n"},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` ","oneOf":[{"type":"string","nullable":true},{"type":"integer","nullable":true}]}}},"PublicGetDataResponse":{"type":"object","description":"Response object containing the list of distributions and metadata","required":["reply"],"properties":{"reply":{"type":"object","description":"Container object for the response data","properties":{"data":{"type":"array","description":"Array of distribution objects matching the filter criteria","items":{"$ref":"#/components/schemas/Distribution"}},"filter_count":{"type":"integer","description":"Number of distributions returned in the current response after applying filters."},"total_count":{"type":"integer","description":"Total number of distributions available in the system without filters."}}}}},"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## Get Violations

> Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 100.\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/device_control/get_violations":{"post":{"tags":["Endpoint Management"],"summary":"Get Violations","description":"Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetViolations","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"You can send a request to retrieve either *all* or *filtered* results.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"An empty object returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list","type","timestamp","ip_list","vendor","vendor_id","product","product_id","serial","hostname","violation_id_list","username"],"description":"String that identifies the violation field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `type`: Type of violation.\n- `timestamp`: Timestamp of the violation.\n- `ip_list`: List of IP addresses.\n- `vendor`: Name of vendor.\n- `vendor_id`: Vendor ID.\n- `product`: Name of product.\n- `product_id`: Product ID.\n- `serial`: Serial number.\n- `hostname`: Hostname.\n- `violation_id_list`: List of violation IDs.\n- `username`: Username."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords are:\n`in`\n— Permitted for all fields except `timestamp`.\n`gte` / `lte`\n— Permitted only for `timestamp`."},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the violation field that you specified for this filter:\n- `timestamp`: Integer, in UTC timezone epoch milliseconds\n- `violation_id_list`: List of integers\n- `ip_list`: Must contain an IP string\n- `type`: Must be either `cd-rom`, `disk drive`, `floppy disk`, `portable device`\n- All other fields need to be list of strings.","oneOf":[{"type":"array","items":{"oneOf":[{"type":"integer"},{"type":"string"}]}},{"type":"integer"},{"type":"string"}]}},"required":["field","operator","value"]}},"search_from":{"type":"integer","description":"Integer representing the starting offset within the query result set from which you want violations returned.\nViolations are returned as a zero-based list. Any violation indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"An integer representing the end of offset within the result set after which you do not want violations returned.\nViolations in the violation list that are indexed higher than this value are not returned in the final results set. Defaults to zero, which returns all alerts to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["endpoint_id_list","type","timestamp","ip_list","vendor","vendor_id","product","product_id","serial","hostname","violation_id_list","username"],"description":"The field you want to sort by."},"value":{"type":"string","enum":["asc","desc"],"description":"Can be either `asc` (ascending) or `desc` (descending).","default":"desc"}},"required":["field","value"]}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging."},"result_count":{"type":"integer","description":"Number of alerts actually returned as a result."},"violations":{"type":"array","items":{"$ref":"#/components/schemas/violation"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"violation":{"type":"object","title":"violation","properties":{"hostname":{"type":"string"},"username":{"type":"string"},"ip":{"type":"string"},"timestamp":{"type":"integer"},"violation_id":{"type":"integer"},"type":{"type":"string"},"vendor_id":{"type":"string"},"vendor":{"type":"string"},"product_id":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"},"endpoint_id":{"type":"string"}}},"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distribution status

> Check the status of the installation package.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_status":{"post":{"tags":["Endpoint Management"],"summary":"Get Distribution status","description":"Check the status of the installation package.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetStatus","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"distribution_id":{"type":"string","description":"The installation package ID."}},"required":["distribution_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"status":{"type":"string","description":"The status of the installation package."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distribution URL

> Get the distribution URL for downloading the installation package.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_dist_url":{"post":{"tags":["Endpoint Management"],"summary":"Get Distribution URL","description":"Get the distribution URL for downloading the installation package.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetDistUrl","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"distribution_id":{"type":"string","description":"Installation package ID."},"package_type":{"type":"string","description":"A string representing the type of installation package. Select *one* of the following valid keywords and values:\n- `upgrade`\nPackage type should match the distribution type or platform:\n- `sh`: x86_64 Linux SH installer\n- `rpm`: x86_64 Linux RPM installer\n- `deb`: x86_64 Linux DEB installer\n- `aarch64_sh`: aarch64 Linux SH installer\n- `aarch64_rpm`: aarch64 Linux RPM installer\n- `aarch64_deb`: aarch64 Linux DEB installer\n- `pkg`: Mac\n- `x86`: Windows\n- `x64`: Windows\n- `arm`: Windows ARM64"}},"required":["distribution_id","package_type"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"distribution_url":{"type":"string","description":"URL for downloading the installation package."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Set an Endpoint Alias

> Set or modify an Alias field for your endpoints.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/update_agent_name":{"post":{"tags":["Endpoint Management"],"summary":"Set an Endpoint Alias","description":"Set or modify an Alias field for your endpoints.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postUpdateAgentName","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list","endpoint_status","dist_name","ip_list","group_name","platform","alias","isolate","hostname","cloud_provider","cloud_region","cloud_provider_account_id","cloud_instance_id","cloud_id"],"description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Hostname.\n- `cloud_provider`: Cloud provider (for example, AWS, GCP, Azure).\n- `cloud_region`: Cloud region where the endpoint is deployed.\n- `cloud_provider_account_id`: Cloud provider account ID.\n- `cloud_instance_id`: Cloud instance ID of the endpoint.\n- `cloud_id`: Cloud ID of the endpoint."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings.\n- `endpoint_status`: Permitted values are `connected` or `disconnected`\n- `ip_list`: List of strings, for example 192.168.5.12.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings."},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `dist_name`, `hostname`, `alias`, `group_name`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected` or `disconnected`\n- `ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings.","oneOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]}},"required":["field","operator","value"]}},"alias":{"type":"string","description":"The alias name you want to set or modify.\n\nNote: If you send an empty field, the current alias name is deleted."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=The alias name was set or modified successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Create Tag

> Create a new agent tag in the \`endpoint\_tags\` family.\
> \
> The tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, \`\*\`). If a tag with the same name already exists, the request fails with a 409 error.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/create":{"post":{"tags":["Endpoint Management"],"summary":"Create Tag","description":"Create a new agent tag in the `endpoint_tags` family.\n\nThe tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, `*`). If a tag with the same name already exists, the request fails with a 409 error.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postCreateTag","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"tag":{"type":"string","maxLength":64,"description":"The name of the tag to create. Maximum 64 characters. Wildcard characters (for example, `*`) are not allowed."}},"required":["tag"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"string","description":"Confirmation message, for example: \"Successfully created a new tag - my-tag\"."}}}},"400":{"description":"Bad Request. The tag is missing, not a string, exceeds 64 characters, or contains invalid characters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"409":{"description":"Conflict. A tag with the same name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Assign Tags

> Assign one or more tags to one or more endpoints.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/assign":{"post":{"tags":["Endpoint Management"],"summary":"Assign Tags","description":"Assign one or more tags to one or more endpoints.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postAssign","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id","endpoint_id_list","last_seen","first_seen","dist_name","ip_list","platform","alias","hostname","isolate","username","scan_status","group_name","endpoint_status","operational_status","public_ip_list","cloud_provider","cloud_region","cloud_provider_account_id","cloud_instance_id","cloud_id"],"description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `last_seen`: When an endpoint was last seen.\n- `first_seen`: When an endpoint was first seen.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `hostname`: Hostname.\n- `isolate`: If the endpoint was isolated.\n- `username`: Name of user.\n- `scan_status`: Status of the scan.\n- `group_name`: Group name the agent belongs to.\n- `endpoint_status`: Status of the endpoint ID.\n- `operational_status`: Operational status.\n- `public_ip_list`: List of public IP addresses.\n- `cloud_provider`: Cloud provider (for example, AWS, GCP, Azure).\n- `cloud_region`: Cloud region where the endpoint is deployed.\n- `cloud_provider_account_id`: Cloud provider account ID.\n- `cloud_instance_id`: Cloud instance ID of the endpoint.\n- `cloud_id`: Cloud ID of the endpoint."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `operational_status`: List of strings.\n- `endpoint_status`: Permitted values are `connected`, `lost`, `disconnected`, `uninstalled`.\n- `ip_list`, `public_ip_list`: List of strings, for example \"192.168.5.12\".\n- `platform`: Permitted values are `windows`, `linux`, `macos`, `android`, `ios`.\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n- `operational_status`: Permitted values are `protected`, `partially_protected`, `unprotected`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings."},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `operational_status`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected`, `disconnected`, `lost`, or `uninstalled`.\n- `operational_status`: Must contain only the following valid values: `protected`, `partially_protected`, `unprotected`.\n- `ip_list`, `public_ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, `android`, or `ios`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.\n- `scan_status`: Must contain only the following valid values: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings.","oneOf":[{"type":"array","items":{"type":"string"}},{"type":"string"},{"type":"integer"}]}},"required":["field","operator","value"]}},"tag":{"type":"string","description":"The tag you want to assign."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=The tag name was assigned successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"x  Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Remove Tags

> Remove one or more tags from one or more endpoints.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/remove":{"post":{"tags":["Endpoint Management"],"summary":"Remove Tags","description":"Remove one or more tags from one or more endpoints.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postRemove","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the following API request fields.","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list","endpoint_status","dist_name","ip_list","group_name","platform","alias","isolate","hostname","cloud_provider","cloud_region","cloud_provider_account_id","cloud_instance_id","cloud_id"],"description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Hostname.\n- `cloud_provider`: Cloud provider (for example, AWS, GCP, Azure).\n- `cloud_region`: Cloud region where the endpoint is deployed.\n- `cloud_provider_account_id`: Cloud provider account ID.\n- `cloud_instance_id`: Cloud instance ID of the endpoint.\n- `cloud_id`: Cloud ID of the endpoint."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings.\n- `endpoint_status`: Permitted values are `connected` or `disconnected`.\n- `ip_list`: List of strings, for example 192.168.5.12.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings."},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `distribution_name`, `hostname`, `alias`, `group_name`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected` or `disconnected`\n- `ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings.","oneOf":[{"type":"array","items":{"type":"string"}},{"type":"string"},{"type":"integer"}]}},"required":["field","operator","value"]}},"tag":{"type":"string","description":"The tag you want to remove."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=tag name removed successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Endpoint

> Gets a list of filtered endpoints.\
> \- The response is concatenated using AND condition (OR is not supported).\
> \- The maximum result set size is 100.\
> \- Offset is the zero-based number of endpoints from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_endpoint":{"post":{"tags":["Endpoint Management"],"summary":"Get Endpoint","description":"Gets a list of filtered endpoints.\n- The response is concatenated using AND condition (OR is not supported).\n- The maximum result set size is 100.\n- Offset is the zero-based number of endpoints from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"post-public_api-v1-endpoints-get_endpoint","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"You can send a request to retrieve either all or filtered results.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\n\nAn empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list","endpoint_status","dist_name","first_seen","last_seen","ip_list","group_name","platform","alias","isolate","hostname","public_ip_list","cloud_provider","cloud_region","cloud_provider_account_id","cloud_instance_id","cloud_id"],"description":"Identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `first_seen`: When the agent was first seen.\n- `last_seen`: When the agent was last seen.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Host name.\n- `public_ip_list`: Public IP addresses that correlate to the last IPv4 address from which the XDR agent connected (know as `Last Origin IP`).\n- `cloud_provider`: Cloud provider (for example, AWS, GCP, Azure).\n- `cloud_region`: Cloud region where the endpoint is deployed.\n- `cloud_provider_account_id`: Cloud provider account ID.\n- `cloud_instance_id`: Cloud instance ID of the endpoint.\n- `cloud_id`: Cloud ID of the endpoint."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `public_ip_list`: List of strings.\n- `endpoint_status`: Permitted values are: `connected`, `disconnected`, `lost`, or `uninstalled`\n- `ip_list`: List of strings. For example: \"192.168.5.12\".\n- `platform`: Permitted values are: `windows`, `linux`, `macos`, `android`.\n- `isolate`: Permitted values are: `isolated` or `unisolated`.\n- `scan_status`: Permitted values are: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings."},"value":{"description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `public_ip_list`: List of strings.\n- `endpoint_status`: String. Permitted values are: `connected`, `disconnected`, `lost`, or `uninstalled`\n- `ip_list`: List of strings.\n- `platform`: String. Permitted values are: `windows`, `linux`, `macos`, `android`.\n- `isolate`: String. Permitted values are: `isolated` or `unisolated`.\n- `scan_status`: String. Permitted values are: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n- `first_seen` and `last_seen`: Integer. Timestamp epoch milliseconds.\n- `cloud_provider`, `cloud_region`, `cloud_provider_account_id`, `cloud_instance_id`, `cloud_id`: List of strings.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}},"required":["field","operator","value"]}},"search_from":{"type":"integer","description":"Represents the start offset within the query result set from which you want endpoints returned.\n\nEndpoints are returned as a zero-based list. Any endpoint indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"Represents the end offset within the result set after which you do not want endpoints returned.\n\nEndpoint in the endpoint list that is indexed higher than this value is not returned in the final results set. Defaults to 100, which returns all endpoints to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["endpoint_id","first_seen","last_seen"],"description":"Identifies the field you want to sort by. Case-sensitive.","default":"first_seen"},"keyword":{"type":"string","enum":["ASC","DESC"],"description":"Whether you want to sort in ascending (`ASC`) or descending (`DESC`) order. Case-sensitive.","default":"DESC"}},"required":["field","keyword"]}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging."},"result_count":{"type":"integer","description":"Number of endpoints actually returned as result."},"endpoints":{"type":"array","description":"A list of endpoints.","items":{"type":"object","properties":{"endpoint_id":{"type":"string"},"endpoint_name":{"type":"string"},"endpointTags":{"type":"string"},"endpoint_type":{"type":"string"},"endpoint_status":{"type":"string"},"operational_status_details":{"type":"array","items":{"type":"object","properties":{"title":{"type":"string"},"reason":{"type":"string"}}}},"os_type":{"type":"string"},"os_version":{"type":"string"},"ip":{"type":"array","items":{"type":"string"}},"ipv6":{"type":"array","items":{"type":"object"}},"public_ip":{"type":"string"},"users":{"type":"array","items":{"type":"string"}},"domain":{"type":"string"},"alias":{"type":"string"},"first_seen":{"type":"integer"},"last_seen":{"type":"integer"},"content_version":{"type":"string"},"installation_package":{"type":"string"},"active_directory":{"type":"string","nullable":true},"install_date":{"type":"integer"},"endpoint_version":{"type":"string"},"is_isolated":{"type":"string"},"isolated_date":{"type":"string","nullable":true},"group_name":{"type":"array","items":{"type":"string"}},"operational_status":{"type":"string"},"operational_status_description":{"type":"string"},"scan_status":{"type":"string"},"content_release_timestamp":{"type":"integer"},"last_content_update_time":{"type":"integer"},"content_status":{"type":"string"},"operating_system":{"type":"string"},"mac_address":{"type":"array","items":{"type":"string"}},"assigned_prevention_policy":{"type":"string"},"assigned_extensions_policy":{"type":"string"},"cloud_provider":{"type":"string","description":"Cloud provider of the endpoint (for example, AWS, GCP, Azure). Returns an empty string if the endpoint is not a cloud agent."},"cloud_region":{"type":"string","description":"Cloud region where the endpoint is deployed. Returns an empty string if the endpoint is not a cloud agent."},"cloud_provider_account_id":{"type":"string","description":"Cloud provider account ID associated with the endpoint. Returns an empty string if the endpoint is not a cloud agent."},"cloud_instance_id":{"type":"string","description":"Cloud instance ID of the endpoint. Returns an empty string if the endpoint is not a cloud agent."},"cloud_id":{"type":"string","description":"Cloud ID of the endpoint. Returns an empty string if the endpoint is not a cloud agent."}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Initiate Forensics Triage

> Initiate forensics triage for the specified agents.\
> \- Maximum of 10 concurrent triage actions at a time.\
> \- Specified agents must have Forensics License enabled.\
> \- Specified agents must be the same OS, Windows or macOS, but not a mixture of both.\
> \- Specified configuration must have type "Online = True".\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/triage_endpoint":{"post":{"tags":["Endpoint Management"],"summary":"Initiate Forensics Triage","description":"Initiate forensics triage for the specified agents.\n- Maximum of 10 concurrent triage actions at a time.\n- Specified agents must have Forensics License enabled.\n- Specified agents must be the same OS, Windows or macOS, but not a mixture of both.\n- Specified configuration must have type \"Online = True\".\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"post-public_api-v1-triage_endpoint","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"agent_ids":{"type":"array","description":"List of agents to run forensics triage on. ","items":{"type":"string"}},"collector_uuid":{"type":"string","description":"UUID of the triage configuration. If none is specified, the default configuration is used for this action."}},"required":["agent_ids"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"group_action_id":{"type":"integer","description":"Unique ID for triage action."},"successful_agent_ids":{"type":"array","description":"List of agent IDs that successfully received the triage action.","items":{"type":"string"}},"unsuccessful_agent_ids":{"type":"array","description":"List of agent IDs that did not successfully receive the triage action.","items":{"type":"object"}}}}}}}}},"400":{"description":"Bad Request"},"401":{"description":"Unauthorized"},"402":{"description":"Payment Required"},"403":{"description":"Forbidden"},"500":{"description":"Internal Server Error"}}}}}}
```

## Delete Tags Permanently

> Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.\
> \
> \*\*Required role:\*\* Admin\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/delete_permanently":{"post":{"tags":["Endpoint Management"],"summary":"Delete Tags Permanently","operationId":"postDeletePermanently","description":"Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.\n\n**Required role:** Admin\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["tags"],"properties":{"tags":{"type":"array","description":"List of tag names to permanently delete from the system.","maxItems":10,"items":{"type":"string"}},"reason":{"type":"string","description":"Reason for deleting the tags.","minLength":20,"maxLength":200}}}}}}}},"responses":{"200":{"description":"Successful response — tags were permanently deleted from the system.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"message":{"type":"string","description":"Success message confirming the tags were deleted."}}}}}}}},"400":{"description":"Bad Request. The request failed validation or the specified tags could not be deleted.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string","description":"Error message describing why the tags could not be deleted."},"err_extra":{"type":"string","description":"Additional error context."}}}}}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. Missing required license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Upgrade Agents

> Creates an upgrade action for the specified endpoints to upgrade their agents to the target versions.\
> \
> You can specify target versions per operating system and optionally define a timeframe window for the upgrade.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/upgrade":{"post":{"tags":["Endpoint Management"],"summary":"Upgrade Agents","description":"Creates an upgrade action for the specified endpoints to upgrade their agents to the target versions.\n\nYou can specify target versions per operating system and optionally define a timeframe window for the upgrade.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postUpgradeAgents","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Upgrade request containing endpoint IDs, target versions per OS, and an optional upgrade timeframe window.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["endpoint_ids","target_versions"],"properties":{"endpoint_ids":{"type":"array","description":"List of endpoint IDs to upgrade.","minItems":1,"items":{"type":"string"}},"target_versions":{"type":"object","description":"Dictionary mapping OS types to target agent versions. Valid keys: `windows`, `linux`, `macos`.","additionalProperties":{"type":"string"}},"upgrade_timeframe_window":{"type":"object","description":"Optional timeframe window to schedule the upgrade.","properties":{"upgrade_timeframe_days":{"type":"array","description":"Days of the week for the upgrade timeframe (for example, `Monday`, `Wednesday`).","items":{"type":"string"}},"upgrade_timeframe_start_time":{"type":"string","description":"Start time in 24-hour `HH:MM` format.","pattern":"^([01]\\d|2[0-3]):([0-5]\\d)$"},"upgrade_timeframe_end_time":{"type":"string","description":"End time in 24-hour `HH:MM` format.","pattern":"^([01]\\d|2[0-3]):([0-5]\\d)$"}}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the upgrade action result.","properties":{"summary":{"type":"string","description":"A summary message of the operation result."},"details":{"type":"array","description":"Detailed eligibility or error messages per OS type.","items":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get endpoint security profiles

> Returns a list of endpoint security profiles of the requested type.\
> Optionally filters by a list of profile IDs.\
> \
> \*\*Required permission:\*\* \`profiles\_view\`\
> \
> \
> \*\*Notes\*\*: \
> \- File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.\
> \- \`is\_in\_user\_scope\` and \`at\_risk\` are removed from every profile object before the response is returned.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_profiles":{"post":{"summary":"Get endpoint security profiles","tags":["Endpoint Management","Profiles"],"responses":{"200":{"description":"OK. Profiles retrieved successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetProfilesResponse"}}}},"400":{"description":"Bad request. Possible causes:\n- `type` field is missing (`TypeIsMandatory`)\n- `type` value is not `prevention` or `extension` (`TypeNotSupported`)\n- `profile_ids` is provided but is not a list (`ProfileIDsMustBeAList`)\n- Any internal error during profile retrieval (`GeneralError`)\n","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"401":{"description":"Unauthorized – missing or invalid API-key headers","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"403":{"description":"Forbidden. Possible causes:\n\n- The API Key does not have the `profiles_view` permission\n- The feature flag `ALPHAFEATURES_PUBLIC_API_GET_POLICIES` is disabled\n- The tenant is a secondary HA replica","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"500":{"description":"Internal Server Error"}},"operationId":"getProfiles","description":"Returns a list of endpoint security profiles of the requested type.\nOptionally filters by a list of profile IDs.\n\n**Required permission:** `profiles_view`\n\n\n**Notes**: \n- File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.\n- `is_in_user_scope` and `at_risk` are removed from every profile object before the response is returned.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetProfilesRequestData"}}}}}}}}},"components":{"schemas":{"GetProfilesResponse":{"title":"GetProfilesResponse","type":"object","description":"Successful response envelope","properties":{"reply":{"type":"array","description":"List of matching profile objects.","items":{"$ref":"#/components/schemas/ProfileObject"}}}},"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}},"GetProfilesRequestData":{"title":"GetProfilesRequestData","type":"object","description":"Parameters for the `get_profiles` call","required":["type"],"properties":{"type":{"type":"string","enum":["prevention","extension"],"description":"The category of profiles to retrieve.\n- `prevention` – standard endpoint prevention profiles managed by\n  `ProfilesService` (malware, exploit, restrictions, agent-settings,\n  exceptions, etc.)\n- `extension` – device-control and host-firewall profiles managed by\n  `DeviceControlProfilesService`\n"},"profile_ids":{"type":"array","description":"Optional list of profile IDs to filter by.\nWhen omitted or `null`, all profiles of the requested type are returned.\nWhen provided, only profiles whose `id` is in this list are returned.\nMust be a JSON array; passing a non-array value yields HTTP 400.\n","items":{"type":"integer","format":"int64","nullable":true}}}}}}}
```

## Get Legacy Exceptions Modules

> Get a list of supported legacy exception modules available in the tenant. Each module entry includes its \`module\_id\`, supported \`platforms\`, and the \`conditions\_definition\` schema that must be used when creating or editing a legacy exception rule for that module.\
> \
> \*\*Note\*\*: No request body required. Send an empty body.\ <br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/get_modules":{"post":{"summary":"Get Legacy Exceptions Modules","operationId":"get_legacy_exceptions_modules","tags":["Endpoint Management"],"description":"Get a list of supported legacy exception modules available in the tenant. Each module entry includes its `module_id`, supported `platforms`, and the `conditions_definition` schema that must be used when creating or editing a legacy exception rule for that module.\n\n**Note**: No request body required. Send an empty body.\n\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"description":"No request body required. Send an empty body.","required":false,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"module_id":{"type":"integer","description":"Unique numeric identifier for the module. Use as the `module` field in add/edit requests."},"pretty_name":{"type":"string","description":"Full display name including profile type category"},"title":{"type":"string","description":"Short title of the module."},"label":{"type":"string","description":"Label describing what the exception allow-lists (for example, \"Files / Folders in Allow List\")."},"profile_type":{"type":"string","description":"Category of the protection profile this module belongs to."},"platforms":{"type":"array","description":"List of platforms this module supports. Only use these platforms in add/edit requests for this module.","items":{"type":"string"}},"conditions_definition":{"type":"object","description":"Schema definition for the `conditions` object required when creating or editing a legacy exception rule for this module. Each key is a condition field name, and its value describes the expected schema and a human-readable description.","properties":{"remoteIpsWhitelist":{"type":"object","properties":{"schema":{"type":"object","properties":{"type":{"type":"string"},"items":{"type":"object","properties":{"type":{"type":"string"}}},"minItems":{"type":"integer"}}},"description":{"type":"string","description":"Human-readable description of the condition field."}}}}}}}}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Fetch Legacy Exception Rules

> Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \- Retrieve all rules or filter by specific criteria\
> \- Sort results by any field in ascending or descending order\
> \- Paginate through large result sets\
> \- Get total count and filtered count of rules<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/fetch":{"post":{"summary":"Fetch Legacy Exception Rules","operationId":"get_legacy_exceptions","tags":["Endpoint Management"],"description":"Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n- Retrieve all rules or filter by specific criteria\n- Sort results by any field in ascending or descending order\n- Paginate through large result sets\n- Get total count and filtered count of rules\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetLegacyExceptionDataRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPublicLegacyExceptionResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP error code."},"err_msg":{"type":"string","description":"High-level error message"},"err_extra":{"type":"string","description":"Detailed error information describing the specific validation failures."}}}}}}}}}}}},"components":{"schemas":{"GetLegacyExceptionDataRequest":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from).","minimum":1,"default":100},"sort":{"type":"object","description":"Defines sorting criteria for query results.","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Field name to sort by. "},"keyword":{"description":"Determines the sort order.","type":"string","enum":["asc","desc"]}}},"filters":{"type":"array","description":"List of filter conditions. Multiple filters are combined with AND logic.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. For example, `id`, `rule_name`, `platform`, `status`, `created_by`, and `user_email`."},"operator":{"type":"string","description":"The comparison operator. Currently, **all** the fields only support `eq`condition."},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `ENABLED` or `DISABLED`\n* If the `field` is `platform`, the `value` can be a string such as `Windows`, `macOS`, or `Linux`                \n","nullable":true}}}}}}},"description":""},"GetPublicLegacyExceptionResponse":{"type":"object","description":"A legacy exception record as returned by the fetch API.","title":"Get Legacy Exception Response","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the legacy exception rule."},"rule_name":{"type":"string","description":"Name of the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception rule."},"conditions":{"type":"string","description":"Human-readable string representation of the exception conditions. This is a display string only."},"module":{"type":"integer","description":"Numeric ID of the protection module this exception applies to."},"module_name":{"type":"string","description":"Name of the protection module."},"description":{"type":"string","description":"Optional description of the exception rule."},"generating_alert_id":{"type":"string","description":"ID of the alert that generated this exception, if applicable.","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key that created the legacy exception rule. **Note**: API-created exception rules show as \"Public API - <key_id>\"."},"modification_time":{"type":"integer","description":"Unix timestamp in milliseconds of the last modification."},"user_email":{"type":"string","description":"Email of the user who created the exception. **Note**: API-created exceptions show `n/a`."},"status":{"type":"string","description":"Indicates the current status of the rule."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception is scoped to. Empty array `[]` indicates a GLOBAL scope exception.","items":{"type":"integer"}},"associated_targets":{"type":"array","description":"Describes the endpoint targeting scope of the exception.","items":{"type":"string"}},"is_in_user_scope":{"type":"boolean","description":"Whether the exception is within the current user's RBAC scope."}}}},"FILTER_COUNT":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"TOTAL_COUNT":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}}}}}
```

## Add Legacy Exception Rule

> Create a new legacy exception rule.\
> \
> \*\*Prerequisites:\*\*\
> \- Use \[Get Legacy Exceptions Modules]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-get\\_modules>) API to discover available \`module\` IDs, supported \`platforms\`, and the required \`conditions\` structure.\
> \- Use \[Get endpoint security profiles]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public\\_api-v1-endpoints-get\\_profiles>) to discover existing profile IDs to pass as \`profile\_ids\`.\
> \- New profiles can be created via \[Add Prevention Profile]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public\\_api-v1-profiles-prevention-add>).

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/add":{"post":{"summary":"Add Legacy Exception Rule","operationId":"add_legacy_exception","tags":["Endpoint Management"],"description":"Create a new legacy exception rule.\n\n**Prerequisites:**\n- Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) API to discover available `module` IDs, supported `platforms`, and the required `conditions` structure.\n- Use [Get endpoint security profiles](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) to discover existing profile IDs to pass as `profile_ids`.\n- New profiles can be created via [Add Prevention Profile](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-profiles-prevention-add).","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/AddLegacyExceptionDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string","description":"The ID of the newly created legacy exception rule."}}}}}}}}}},"components":{"schemas":{"AddLegacyExceptionDataRequest":{"type":"object","description":"Request body for creating a legacy exception rule.","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule.","minLength":1,"maxLength":128},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint.","minimum":1},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get endpoint security profiles](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule.","nullable":true},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}
```

## Edit Legacy Exception Rule

> Update an existing legacy exception rule.\
> \
> \*\*Prerequisites:\*\*\
> \
> To get the required fields:\
> \- Use \[Fetch Legacy Exception Rules]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-fetch>) to retrieve existing exception details.\
> \- The \`id\` field in the fetch API response corresponds to \`exception\_id\` in this request.\
> \- The \`rule\_name\` field in the fetch API response corresponds to \`name\` in this request.\
> \- The \`scope\` field is not returned by the fetch API. Use \`"PROFILE"\` if \`profile\_ids\` is non-empty in the fetch response; use \`"GLOBAL"\` if \`profile\_ids\` is \`\[]\`.<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/edit":{"post":{"summary":"Edit Legacy Exception Rule","operationId":"edit_legacy_exception","tags":["Endpoint Management"],"description":"Update an existing legacy exception rule.\n\n**Prerequisites:**\n\nTo get the required fields:\n- Use [Fetch Legacy Exception Rules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-fetch) to retrieve existing exception details.\n- The `id` field in the fetch API response corresponds to `exception_id` in this request.\n- The `rule_name` field in the fetch API response corresponds to `name` in this request.\n- The `scope` field is not returned by the fetch API. Use `\"PROFILE\"` if `profile_ids` is non-empty in the fetch response; use `\"GLOBAL\"` if `profile_ids` is `[]`.\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/EditLegacyExceptionDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string","description":"The ID of the edited legacy exception rule."}}}}}}}}}},"components":{"schemas":{"EditLegacyExceptionDataRequest":{"type":"object","description":"Request body for editing or updating an existing legacy exception rule.","required":["exception_id","update_data"],"properties":{"exception_id":{"type":"string","description":"The ID of the legacy exception to edit. Corresponds to the `id` field returned by the fetch API."},"update_data":{"type":"object","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get endpoint security profiles](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule."},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}}}
```

## Delete Legacy Exception Rules

> Deletes one or more legacy exception rules by their IDs.\
> \
> Use \[Fetch Legacy Exception Rules]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-fetch>) endpoint to retrieve the \`id\` values of the exceptions you want to delete.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/delete":{"post":{"summary":"Delete Legacy Exception Rules","operationId":"delete_legacy_exceptions","tags":["Endpoint Management"],"description":"Deletes one or more legacy exception rules by their IDs.\n\nUse [Fetch Legacy Exception Rules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-fetch) endpoint to retrieve the `id` values of the exceptions you want to delete.","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["exception_ids"],"properties":{"exception_ids":{"type":"array","description":"List of legacy exception IDs to delete. Corresponds to the `id` field returned by the fetch API.","minItems":1,"items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"integer","description":"The number of successfully deleted legacy exception rules."}}}}}}}}}}}
```

## Add Prevention Profile

> Create a new prevention profile with specified configuration.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/add":{"post":{"summary":"Add Prevention Profile","description":"Create a new prevention profile with specified configuration.","operationId":"add_prevention_profile","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["name","profile_type","platform","modules"],"properties":{"name":{"type":"string","minLength":1,"maxLength":600,"description":"Name of the profile."},"profile_type":{"type":"string","description":"Type of the prevention profile."},"platform":{"type":"string","description":"Platform (OS) for the profile."},"description":{"type":"string","nullable":true,"description":"Optional description of the profile."},"modules":{"type":"object","description":"Configuration modules for the profile.","additionalProperties":{"type":"object"}}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"integer","description":"The ID of the newly created profile."}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Add Signer CN to Allowlist

> Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/add_signer_cn_to_allowlist":{"post":{"summary":"Add Signer CN to Allowlist","description":"Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.","operationId":"add_signer_cn_to_allowlist","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_name","signers"],"properties":{"profile_name":{"type":"string","maxLength":600,"description":"The name of the Windows malware prevention profile. Cannot be 'Default'."},"signers":{"oneOf":[{"type":"string","maxLength":600},{"type":"array","items":{"type":"string","maxLength":600},"maxItems":1000}],"description":"A single signer CN string or a list of signer CN strings to add. Total signers cap is 1000."}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","nullable":true}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Edit Prevention Profile

> Update an existing prevention profile with new configuration. At least one field in update\_data (name, description, or modules) must be provided. \
> \
> Note: Default profiles cannot be edited.&#x20;

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/edit":{"post":{"summary":"Edit Prevention Profile","description":"Update an existing prevention profile with new configuration. At least one field in update_data (name, description, or modules) must be provided. \n\nNote: Default profiles cannot be edited. ","operationId":"edit_prevention_profile","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_id","update_data"],"properties":{"profile_id":{"type":"integer","description":"The ID of the profile to edit."},"update_data":{"type":"object","minProperties":1,"properties":{"name":{"type":"string","minLength":1,"maxLength":600,"nullable":true},"description":{"type":"string","nullable":true},"modules":{"type":"object","nullable":true,"additionalProperties":{"type":"object"},"description":"Updated configuration modules for the profile."}}}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"boolean","description":"True if the profile was successfully updated."}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Get Prevention Profile Modules

> Get a list of modules for a specific prevention profile type and platform.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/get_modules":{"post":{"summary":"Get Prevention Profile Modules","description":"Get a list of modules for a specific prevention profile type and platform.","operationId":"get_prevention_modules","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_type","platform"],"properties":{"profile_type":{"type":"string","description":"The type of prevention profile."},"platform":{"type":"string","description":"The platform (OS) for the profile."}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","description":"Module definition object."}}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Edit prevention policy rules

> Updates one or more prevention policy rules. Each item in \`edit\_requests\` specifies a rule by its 32-character hexadecimal UUID and includes the fields to modify. Only explicitly provided (non-null) fields are updated; all others remain unchanged.\
> \
> \*\*Constraints\*\*\
> \- The default (catch-all) rule (\`is\_any = true\`) cannot be modified for \`name\`, \`description\`, or \`target\_filter\`.\
> \- Profile IDs must exist, correspond to the correct profile type (exploit, malware, restrictions, agent\_settings, or exceptions), and match the OS platform of the target rule.\
> \- Updates are applied atomically. If the policy has been modified since it was last retrieved, the request fails with a \`409 Conflict\` error due to stale data.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/policies/prevention/edit":{"post":{"summary":"Edit prevention policy rules","description":"Updates one or more prevention policy rules. Each item in `edit_requests` specifies a rule by its 32-character hexadecimal UUID and includes the fields to modify. Only explicitly provided (non-null) fields are updated; all others remain unchanged.\n\n**Constraints**\n- The default (catch-all) rule (`is_any = true`) cannot be modified for `name`, `description`, or `target_filter`.\n- Profile IDs must exist, correspond to the correct profile type (exploit, malware, restrictions, agent_settings, or exceptions), and match the OS platform of the target rule.\n- Updates are applied atomically. If the policy has been modified since it was last retrieved, the request fails with a `409 Conflict` error due to stale data.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.","operationId":"editPreventionPolicy","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EditPreventionPolicyRequest"}}}},"responses":{"200":{"description":"All requested edits were applied successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuccessResponse"}}}},"400":{"description":"Bad request. Possible causes include:\n- Missing required parameters (for example, `edit_requests` or `id`).\n- Invalid field values (for example, incorrect type or empty string).\n- Invalid `target_filter` structure.\n- Unsupported filter field.\n- Invalid operator for the specified filter field.\n- Invalid value for the specified filter field.\n- Attempt to modify metadata or `target_filter` of the default (catch-all) rule.\n- Profile type does not match the expected type for the slot.\n- Profile OS does not match the rule's platform.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"A referenced rule ID or profile ID was not found.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"409":{"description":"Stale data conflict. The policy was modified by another actor since it was last read. Retry the operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. The policy update failed for an unexpected reason, or the saved policy failed internal validation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"EditPreventionPolicyRequest":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/EditPreventionPolicyRequestData"}}},"EditPreventionPolicyRequestData":{"type":"object","required":["edit_requests"],"properties":{"edit_requests":{"type":"array","minItems":1,"description":"List of policy rule edits to apply. All edits are validated before any change is persisted.\n","items":{"$ref":"#/components/schemas/PreventionPolicyEditParameters"}}}},"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/cortex-cloud-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}},"SuccessResponse":{"type":"object","properties":{"reply":{"type":"boolean","description":"Always `true` on success."}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-aligned error code."},"err_msg":{"type":"string","description":"Human-readable error message."},"err_extra":{"type":"object","description":"Additional context about the error (field names, IDs, invalid values, etc.). Shape varies by error type.\n","additionalProperties":true}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/endpoint-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.