> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-prevention-rule/disable-prevention-rule-public-apis.md).

# Disable Prevention Rule Public APIs

## Get Disable Prevention Rules

> Returns a list of Disable Prevention rules based on filters, sorting, and pagination.

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/fetch":{"post":{"summary":"Get Disable Prevention Rules","description":"Returns a list of Disable Prevention rules based on filters, sorting, and pagination.","operationId":"fetchDisablePreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicGetDataResponse"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"GetDataRequest":{"type":"object","properties":{"search_from":{"type":"integer","default":0,"description":"Zero-based index of the first Disable Prevention rule to return. Used for pagination.","minimum":0},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Index number of Disable Prevention rules to return starting from `search_from`."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}},"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## Get Disable Prevention Modules

> Returns a list of available modules for a specific platform.

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/get_modules":{"post":{"summary":"Get Disable Prevention Modules","description":"Returns a list of available modules for a specific platform.","operationId":"getDisablePreventionModules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionGetModulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseArrayModules"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}]}}},"components":{"schemas":{"DisablePreventionGetModulesPAPIRequest":{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`."}}},"BaseResponseArrayModules":{"type":"object","properties":{"reply":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionModulePAPIObject"}}}},"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## Add Disable Prevention Rule

> Creates a new Disable Prevention rule.

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/add":{"post":{"summary":"Add Disable Prevention Rule","description":"Creates a new Disable Prevention rule.","operationId":"addDisablePreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionAddRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"DisablePreventionAddRulePAPIRequest":{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}},"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## Edit Disable Prevention Rule

> Updates an existing Disable Prevention rule.

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/edit":{"post":{"summary":"Edit Disable Prevention Rule","description":"Updates an existing Disable Prevention rule.","operationId":"editDisablePreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionEditRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}]}}},"components":{"schemas":{"DisablePreventionEditRulePAPIRequest":{"allOf":[{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},{"type":"object","required":["rule_id"],"properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."}}}]},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}},"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## Delete Disable Prevention Rules

> Deletes one or more Disable Prevention rules based on the provided rule ID.

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex Cloud"},"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/delete":{"post":{"summary":"Delete Disable Prevention Rules","description":"Deletes one or more Disable Prevention rules based on the provided rule ID.","operationId":"deleteDisablePreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionDeleteRulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"DisablePreventionDeleteRulesPAPIRequest":{"type":"object","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"The unique identifier of the Disable Prevention rule.","items":{"type":"string"}}}},"DeleteResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the result of the API operation."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-prevention-rule/disable-prevention-rule-public-apis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.