> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/models.md).

# Models

## The reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The violation object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"violation":{"type":"object","title":"violation","properties":{"hostname":{"type":"string"},"username":{"type":"string"},"ip":{"type":"string"},"timestamp":{"type":"integer"},"violation_id":{"type":"integer"},"type":{"type":"string"},"vendor_id":{"type":"string"},"vendor":{"type":"string"},"product_id":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"},"endpoint_id":{"type":"string"}}}}}}
```

## The GetAttackSurfaceRulesRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetAttackSurfaceRulesRequest":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/GetAttackSurfaceRulesRequestData"}},"required":["request_data"]},"GetAttackSurfaceRulesRequestData":{"type":"object","description":"(Required) A dictionary containing the API request fields.<br />An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filtered fields. Each JSON object can contain the following keywords:\n  - field\n  - operators\n  - value\n","items":{"$ref":"#/components/schemas/AttackSurfaceRulesFilter"}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want attack surface rules returned","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want attack surface rules returned. <br />Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set.","minimum":0,"default":500},"sort":{"$ref":"#/components/schemas/GetAttackSurfaceRulesSort"}}},"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The GetAttackSurfaceRulesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetAttackSurfaceRulesRequestData":{"type":"object","description":"(Required) A dictionary containing the API request fields.<br />An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filtered fields. Each JSON object can contain the following keywords:\n  - field\n  - operators\n  - value\n","items":{"$ref":"#/components/schemas/AttackSurfaceRulesFilter"}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want attack surface rules returned","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want attack surface rules returned. <br />Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set.","minimum":0,"default":500},"sort":{"$ref":"#/components/schemas/GetAttackSurfaceRulesSort"}}},"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The AttackSurfaceRulesFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The GetAttackSurfaceRulesSort object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The GetAttackSurfaceRulesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetAttackSurfaceRulesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/AttackSurfaceRulesPage"}},"required":["reply"]},"AttackSurfaceRulesPage":{"type":"object","properties":{"total_count":{"type":"integer","minimum":0},"result_count":{"type":"integer","minimum":0},"attack_surface_rules":{"type":"array","items":{"$ref":"#/components/schemas/AttackSurfaceRule"}}},"required":["total_count","result_count","attack_surface_rules"]},"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The AttackSurfaceRulesPage object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AttackSurfaceRulesPage":{"type":"object","properties":{"total_count":{"type":"integer","minimum":0},"result_count":{"type":"integer","minimum":0},"attack_surface_rules":{"type":"array","items":{"$ref":"#/components/schemas/AttackSurfaceRule"}}},"required":["total_count","result_count","attack_surface_rules"]},"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The AttackSurfaceRule object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The DefaultApiErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"DefaultApiErrorResponse":{"type":"object","properties":{"reply":{"description":"The query results upon error.","allOf":[{"$ref":"#/components/schemas/GenericReply"}]}},"required":["reply"]},"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The GenericReply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The Error object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"Error":{"type":"object","properties":{"code":{"type":"integer","description":"Error code"},"status":{"type":"string","description":"Error name"},"message":{"type":"string","description":"Error message"},"errors":{"type":"object","description":"Errors"}}}}}}
```

## The VersionObj object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"VersionObj":{"title":"VersionObj","type":"object","required":["version"],"properties":{"version":{"type":"string","description":"Cortex CLI version"}}}}}}
```

## The NormalizedFields object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"string"},"xdm.source.ipv4":{"type":"string"},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"string"},"xdm.source.process.causality_id":{"type":"string"},"xdm.source.process.command_line":{"type":"string"},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"string"},"xdm.source.process.executable.path":{"type":"string"},"xdm.source.process.executable.sha256":{"type":"string"},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"string"},"xdm.target.file.filename":{"type":"string"},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"string"},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"string"},"xdm.target.process.executable.sha256":{"type":"string"},"xdm.target.process.executable.signature_status":{"type":"string"},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"integer"},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"string"},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"string"},"xdm.target.registry.data":{"type":"string"},"xdm.target.registry.key":{"type":"string"},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"string"},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}}}}
```

## The GetDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","additionalProperties":false,"properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"maximum":100,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (`search_to` - `search_from`). The maximum allowed value is <=100. Requests exceeding this limit will return a 400 error."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","description":"Array of filter conditions to apply. Multiple filters are combined with either `AND` or `OR` logic.","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","description":"Sorting criteria for query results.","additionalProperties":false,"required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","description":"Filter condition to apply to the query","additionalProperties":false,"required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n"},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` ","oneOf":[{"type":"string","nullable":true},{"type":"integer","nullable":true}]}}}}}}
```

## The SortingRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SortingRequest":{"type":"object","description":"Sorting criteria for query results.","additionalProperties":false,"required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}}}}}
```

## The FilterRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"FilterRequest":{"type":"object","description":"Filter condition to apply to the query","additionalProperties":false,"required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n"},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` ","oneOf":[{"type":"string","nullable":true},{"type":"integer","nullable":true}]}}}}}}
```

## The PublicGetDataResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"PublicGetDataResponse":{"type":"object","description":"Response object containing the list of distributions and metadata","required":["reply"],"properties":{"reply":{"type":"object","description":"Container object for the response data","properties":{"data":{"type":"array","description":"Array of distribution objects matching the filter criteria","items":{"$ref":"#/components/schemas/Distribution"}},"filter_count":{"type":"integer","description":"Number of distributions returned in the current response after applying filters."},"total_count":{"type":"integer","description":"Total number of distributions available in the system without filters."}}}}},"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## The Distribution object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## The Artifact object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"Artifact":{"type":"object","properties":{"artifact_id":{"type":"string","description":"Unique identifier for the artifact"},"file_name":{"type":"string","description":"File name for the artifact"},"file_sha256":{"type":"string","description":"File sha256 for the artifact"},"file_signature_status":{"type":"string","description":"File signature for the artifact"},"file_wildfire_verdict":{"type":"string","description":"File wildfire verdict for the artifact"},"is_malicious":{"type":"boolean","description":"Indicates if the artifact is malicious"},"is_manual":{"type":"boolean","description":"Indicates if the artifact is manual"},"is_process":{"type":"boolean","description":"Indicates if the artifact is related_to_process"},"low_confidence":{"type":"boolean","description":"Indicates the artifact confidence"},"type":{"type":"string","description":"Type of the artifact"}}}}}}
```

## The AndFilterForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AndFilterForGroups":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The OrFilterForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"OrFilterForGroups":{"required":["OR"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The AndFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The OrFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The Sort object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"Sort":{"type":"array","items":{"$ref":"#/components/schemas/SortObject"}},"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The SortForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SortForGroups":{"type":"array","items":{"$ref":"#/components/schemas/SortObjectForGroups"}},"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The SortObjectForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The SortObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The FilterCondition object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The FilterConditionForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The AssetGroup object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The GenericErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The NotFoundErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"NotFoundErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The UnauthorizedErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The GenericAssetGroupsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericAssetGroupsResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply"}}},"GenericAssetGroupsResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply_data"}}},"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The CreateAssetGroupResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"CreateAssetGroupResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply"}}},"CreateAssetGroupResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply_data"}}},"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The GenericApiResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericApiResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GenericApiResponse_reply"}}},"GenericApiResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object"}},"metadata":{"$ref":"#/components/schemas/GenericApiResponse_reply_metadata"}}},"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The SchemaField object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumField object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The GetSchemaResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetSchemaResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GetSchemaResponse_reply"}}},"GetSchemaResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SchemaField"}}}},"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumValuesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EnumValuesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/EnumValuesResponse_reply"}}},"EnumValuesResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EnumField"}}}},"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The assets\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"assets_body":{"type":"object","properties":{"filters":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}]},"on_demand_fields":{"type":"array","items":{"type":"string"}},"sort":{"$ref":"#/components/schemas/Sort"},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want assets returned."},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want assets returned. <br />Assets in the asset inventory that are indexed higher than this value are not returned in the final results set."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"Sort":{"type":"array","items":{"$ref":"#/components/schemas/SortObject"}},"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The assetgroups\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"assetgroups_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"oneOf":[{"$ref":"#/components/schemas/AndFilterForGroups"},{"$ref":"#/components/schemas/OrFilterForGroups"}]},"sort":{"$ref":"#/components/schemas/SortForGroups"},"search_from":{"type":"integer"},"search_to":{"type":"integer"}}}}},"AndFilterForGroups":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}},"OrFilterForGroups":{"required":["OR"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"SortForGroups":{"type":"array","items":{"$ref":"#/components/schemas/SortObjectForGroups"}},"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The assetgroups\_create\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"assetgroups_create_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"asset_group":{"$ref":"#/components/schemas/AssetGroup"}}}}},"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The update\_group\_id\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"update_group_id_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"asset_group":{"$ref":"#/components/schemas/AssetGroup"}}}}},"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The GenericAssetGroupsResponse\_reply\_data object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The GenericAssetGroupsResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericAssetGroupsResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply_data"}}},"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The CreateAssetGroupResponse\_reply\_data object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The CreateAssetGroupResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"CreateAssetGroupResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply_data"}}},"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The GenericApiResponse\_reply\_metadata object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The GenericApiResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GenericApiResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object"}},"metadata":{"$ref":"#/components/schemas/GenericApiResponse_reply_metadata"}}},"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The GetSchemaResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetSchemaResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SchemaField"}}}},"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumValuesResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EnumValuesResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EnumField"}}}},"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The GetLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetLegacyExceptionDataRequest":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from).","minimum":1,"default":100},"sort":{"type":"object","description":"Defines sorting criteria for query results.","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Field name to sort by. "},"keyword":{"description":"Determines the sort order.","type":"string","enum":["asc","desc"]}}},"filters":{"type":"array","description":"List of filter conditions. Multiple filters are combined with AND logic.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. For example, `id`, `rule_name`, `platform`, `status`, `created_by`, and `user_email`."},"operator":{"type":"string","description":"The comparison operator. Currently, **all** the fields only support `eq`condition."},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `ENABLED` or `DISABLED`\n* If the `field` is `platform`, the `value` can be a string such as `Windows`, `macOS`, or `Linux`                \n","nullable":true}}}}}}},"description":""}}}}
```

## The AddLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"AddLegacyExceptionDataRequest":{"type":"object","description":"Request body for creating a legacy exception rule.","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule.","minLength":1,"maxLength":128},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint.","minimum":1},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get endpoint security profiles](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule.","nullable":true},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}
```

## The EditLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EditLegacyExceptionDataRequest":{"type":"object","description":"Request body for editing or updating an existing legacy exception rule.","required":["exception_id","update_data"],"properties":{"exception_id":{"type":"string","description":"The ID of the legacy exception to edit. Corresponds to the `id` field returned by the fetch API."},"update_data":{"type":"object","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get endpoint security profiles](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule."},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}}}
```

## The GetPublicLegacyExceptionResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetPublicLegacyExceptionResponse":{"type":"object","description":"A legacy exception record as returned by the fetch API.","title":"Get Legacy Exception Response","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the legacy exception rule."},"rule_name":{"type":"string","description":"Name of the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception rule."},"conditions":{"type":"string","description":"Human-readable string representation of the exception conditions. This is a display string only."},"module":{"type":"integer","description":"Numeric ID of the protection module this exception applies to."},"module_name":{"type":"string","description":"Name of the protection module."},"description":{"type":"string","description":"Optional description of the exception rule."},"generating_alert_id":{"type":"string","description":"ID of the alert that generated this exception, if applicable.","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key that created the legacy exception rule. **Note**: API-created exception rules show as \"Public API - <key_id>\"."},"modification_time":{"type":"integer","description":"Unix timestamp in milliseconds of the last modification."},"user_email":{"type":"string","description":"Email of the user who created the exception. **Note**: API-created exceptions show `n/a`."},"status":{"type":"string","description":"Indicates the current status of the rule."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception is scoped to. Empty array `[]` indicates a GLOBAL scope exception.","items":{"type":"integer"}},"associated_targets":{"type":"array","description":"Describes the endpoint targeting scope of the exception.","items":{"type":"string"}},"is_in_user_scope":{"type":"boolean","description":"Whether the exception is within the current user's RBAC scope."}}}},"FILTER_COUNT":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"TOTAL_COUNT":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}}}}}
```

## The GetProfilesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetProfilesRequestData":{"title":"GetProfilesRequestData","type":"object","description":"Parameters for the `get_profiles` call","required":["type"],"properties":{"type":{"type":"string","enum":["prevention","extension"],"description":"The category of profiles to retrieve.\n- `prevention` – standard endpoint prevention profiles managed by\n  `ProfilesService` (malware, exploit, restrictions, agent-settings,\n  exceptions, etc.)\n- `extension` – device-control and host-firewall profiles managed by\n  `DeviceControlProfilesService`\n"},"profile_ids":{"type":"array","description":"Optional list of profile IDs to filter by.\nWhen omitted or `null`, all profiles of the requested type are returned.\nWhen provided, only profiles whose `id` is in this list are returned.\nMust be a JSON array; passing a non-array value yields HTTP 400.\n","items":{"type":"integer","format":"int64","nullable":true}}}}}}}
```

## The EditPreventionPolicyRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EditPreventionPolicyRequest":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/EditPreventionPolicyRequestData"}}},"EditPreventionPolicyRequestData":{"type":"object","required":["edit_requests"],"properties":{"edit_requests":{"type":"array","minItems":1,"description":"List of policy rule edits to apply. All edits are validated before any change is persisted.\n","items":{"$ref":"#/components/schemas/PreventionPolicyEditParameters"}}}},"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/cortex-cloud-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The EditPreventionPolicyRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"EditPreventionPolicyRequestData":{"type":"object","required":["edit_requests"],"properties":{"edit_requests":{"type":"array","minItems":1,"description":"List of policy rule edits to apply. All edits are validated before any change is persisted.\n","items":{"$ref":"#/components/schemas/PreventionPolicyEditParameters"}}}},"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/cortex-cloud-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The PreventionPolicyEditParameters object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/cortex-cloud-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The TargetFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/cortex-cloud-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The PolicyAndFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The PolicyOrFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The SearchCondition object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The SuccessResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"SuccessResponse":{"type":"object","properties":{"reply":{"type":"boolean","description":"Always `true` on success."}}}}}}
```

## The ErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-aligned error code."},"err_msg":{"type":"string","description":"Human-readable error message."},"err_extra":{"type":"object","description":"Additional context about the error (field names, IDs, invalid values, etc.). Shape varies by error type.\n","additionalProperties":true}}}}}}}}
```

## The GetProfilesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"GetProfilesResponse":{"title":"GetProfilesResponse","type":"object","description":"Successful response envelope","properties":{"reply":{"type":"array","description":"List of matching profile objects.","items":{"$ref":"#/components/schemas/ProfileObject"}}}},"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```

## The ProfileObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"components":{"schemas":{"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.