> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-public-api.md).
# Disable Injection and Prevention Rules Public API
## Get Disable Injection and Prevention rules
> Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \- Retrieve all rules or filter by specific criteria\
> \- Sort results by any field in ascending or descending order\
> \- Paginate through large result sets\
> \- Get total count and filtered count of rules
```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/fetch":{"post":{"summary":"Get Disable Injection and Prevention rules","description":"Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n- Retrieve all rules or filter by specific criteria\n- Sort results by any field in ascending or descending order\n- Paginate through large result sets\n- Get total count and filtered count of rules\n","operationId":"fetchDisableInjectionPreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetDataRequest"}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicGetDataResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"GetDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from)."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."},"FilterRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux` \n"}}},"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","description":"Container object for the response data and metadata","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisableInjectionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```
## Add Disable Injection and Prevention rule
> Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.\
> \
> This endpoint allows you to:\
> \- Define a new rule with a unique name and description\
> \- Specify the target platform (Windows, Linux, or macOS)\
> \- Set the process name and path to be protected\
> \- Configure expiration time\
> \- Apply the rule globally or to specific profiles
```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/add":{"post":{"summary":"Add Disable Injection and Prevention rule","description":"Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.\n\nThis endpoint allows you to:\n- Define a new rule with a unique name and description\n- Specify the target platform (Windows, Linux, or macOS)\n- Set the process name and path to be protected\n- Configure expiration time\n- Apply the rule globally or to specific profiles\n","operationId":"addDisableInjectionPreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisableInjectionAddRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseString"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","required":true,"description":"{api_key_id}"}]}}},"components":{"schemas":{"DisableInjectionAddRulePAPIRequest":{"type":"object","description":"Request schema for creating a new Disable Injection and Prevention rule. All required fields must be provided to successfully create a rule.","required":["rule_name","description","platform","process_name","path","hours_to_expiration","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":100,"description":"Unique name for the new rule. Must be between 1-100 characters and should be descriptive of the rule's purpose."},"description":{"type":"string","maxLength":500,"description":"Description explaining the purpose and context of this rule. Maximum 500 characters."},"platform":{"type":"string","enum":["windows","linux","macos"],"description":"Target operating system to which the rule applies. "},"process_name":{"type":"string","minLength":1,"maxLength":100,"description":"Name of the process executable to protect. Must match the exact process name (1-100 characters)."},"path":{"type":"string","minLength":1,"maxLength":1000,"description":"Full file system path to the process executable. Must be a valid path for the specified platform (1-1000 characters)."},"hours_to_expiration":{"type":"integer","enum":[24,48],"description":"Number of hours until the rule expires. After expiration, the rule will no longer be applied. For example, 24 hours."},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule should apply. \nRequired when `scope` is `profile`. Must be `null` or omitted when scope is `global`.","nullable":true,"items":{"type":"integer","default":96}},"scope":{"type":"string","enum":["global","profile"],"description":"Defines the application scope of the rule.\n- `global`: Rule applies to all endpoints all matching endpoints (by platform and agent version >= 7.9)\n- `profile`: Rule applies only to endpoints in the specified `profile_ids`"}}},"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Injection and Prevention Rule ID."}}}}}}
```
## Disable Disable Injection and Prevention Rules
> Disables one or more existing Disable Injection and Prevention rules by their IDs.\
> \
> This endpoint allows you to:\
> \- Disable multiple rules in a single request\
> \- Immediately stop rules from being applied
```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/disable":{"post":{"summary":"Disable Disable Injection and Prevention Rules","description":"Disables one or more existing Disable Injection and Prevention rules by their IDs.\n\nThis endpoint allows you to:\n- Disable multiple rules in a single request\n- Immediately stop rules from being applied \n","operationId":"disableDisableInjectionPreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisableInjectionDisableRulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisableInjectionResponseString"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}]}}},"components":{"schemas":{"DisableInjectionDisableRulesPAPIRequest":{"type":"object","description":"Request schema for disabling one or more existing Disable Injection Prevention rules. Requires at least one valid rule ID.","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"Array of rule IDs to disable. Must contain at least one valid rule ID.","items":{"type":"string"}}}},"DisableInjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the success message."}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-public-api.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.