> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues.md). # Issues Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata. ## Create a new issue > This endpoint allows users to create a new issue by providing the necessary details. \ > \*\*Users can only create one issue at a time.\*\*\ > \- The request must include the following required fields:\ > \- \`name\`\ > \- \`description\`\ > \- \`observation\_time\`\ > \- \`issue\_domain\`\ > \- \`category\`\ > \- \`severity\`\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue":{"post":{"summary":"Create a new issue","description":"This endpoint allows users to create a new issue by providing the necessary details. \n**Users can only create one issue at a time.**\n- The request must include the following required fields:\n - `name`\n - `description`\n - `observation_time`\n - `issue_domain`\n - `category`\n - `severity`\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"createIssue","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"issue":{"$ref":"#/components/schemas/CreateIssue"}}}}}}}},"responses":{"202":{"description":"Issue created successfully","content":{"application/json":{"schema":{"type":"object","properties":{"external_id":{"type":"string"},"detection_method":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"schemas":{"CreateIssue":{"type":"object","properties":{"owner":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"observation_time":{"type":"integer","format":"int64"},"issue_domain":{"type":"string","description":"Issue domain. Note: The create request uses `issue_domain` as the field name, while the search response returns this value as `domain`."},"category":{"type":"string"},"asset_ids":{"type":"array","items":{"type":"string"}},"mitre_tactics":{"type":"array","items":{"type":"string"}},"mitre_techniques":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"remediation":{"type":"string"},"extended_description":{"type":"string"},"impact":{"type":"string"},"initial_evidence":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"is_excluded":{"type":"boolean"},"is_starred":{"type":"boolean"},"assigned_to":{"type":"string"},"assigned_to_pretty":{"type":"string"},"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"normalized_fields":{"$ref":"#/components/schemas/NormalizedFields"},"custom_fields":{"type":"object"}},"required":["name","description","observation_time","issue_domain","category","severity"]},"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"array","items":{"type":"string"}},"xdm.source.ipv4":{"type":"array","items":{"type":"string"}},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"array","items":{"type":"string"}},"xdm.source.process.causality_id":{"type":"array","items":{"type":"string"}},"xdm.source.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.file.filename":{"type":"array","items":{"type":"string"}},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"array","items":{"type":"integer"}},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"array","items":{"type":"string"}},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"array","items":{"type":"string"}},"xdm.target.registry.data":{"type":"array","items":{"type":"string"}},"xdm.target.registry.key":{"type":"array","items":{"type":"string"}},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"array","items":{"type":"string"}},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Retrieve issues based on filters > This endpoint retrieves a list of issues that match the specified filter criteria. It supports filtering, sorting, and pagination.\ > \ > See the \[Supported Filter Fields & Values]\( > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue/search":{"post":{"summary":"Retrieve issues based on filters","description":"This endpoint retrieves a list of issues that match the specified filter criteria. It supports filtering, sorting, and pagination.\n\nSee the [Supported Filter Fields & Values](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-filter-fields-values)\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"getIssues","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","items":{"type":"object","properties":{"field":{"type":"string","enum":["id","external_id","detection.method","issue_domain","severity","_insert_time","last_modified","status.progress","assigned_to","assigned_to_pretty","observation_time","category","detection.rule_id","asset_ids","asset_names","asset_classes","asset_group_ids","asset_categories","asset_regions","asset_providers","asset_accounts","asset_types","asset_external_provider_ids","asset_cloud_account_names","xdm.compliance.standard_id","xdm.compliance.category_id","xdm.compliance.control_id","xdm.policy_id","asset_group_names","asset_tags"],"description":"Specifies the field to filter issues by. See the endpoint description above for allowed values per field."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"Comparison operator to use with the filter. Note: `gte` and `lte` are only valid for time-based fields (`_insert_time`, `last_modified`, `observation_time`). All other fields support `in`."},"value":{"oneOf":[{"type":"array","items":{"type":"integer"}},{"type":"array","items":{"type":"string"}},{"type":"integer"},{"type":"string"}],"description":"Value(s) for filtering the issues. Allowed values depend on the selected field:\n\n- **severity**: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`\n- **status.progress**: `New`, `In Progress`, `Resolved`\n- **issue_domain**: `Security`, `Health`, `Hunting`, `IT`, `Posture` (custom domains may also be configured)\n- **detection.method**: `XDR Agent`, `XDR Analytics`, `PAN NGFW`, `XDR BIOC`, `XDR IOC`, `Threat Intelligence`, `XDR Managed Threat Hunting`, `XDR Analytics BIOC`, `Correlation`, `Prisma Cloud`, `Prisma Cloud Compute`, `ASM`, `IoT Security`, `Custom Issue`, `Health`, `SaaS Attachments`, `Attack Path`, `Posture Policy`, `CAS Drift Scanner`, `Cloud Network Analyzer`, `IaC Scanner`, `CAS Secret Scanner`, `CI/CD Risks`, `CLI Scanner`, `CIEM Scanner`, `API Traffic Monitor`, `API Posture Scanner`, `Agentless Disk Scanner`, `Kubernetes Scanner`, `Compute Policy`, `CSPM Scanner`, `CAS CVE Scanner`, `CAS License Scanner`, `Secrets Scanner`, `SAST Scanner`, `Data Policy`, `Package Operational Risk`, `Vulnerability Policy`, `AI Security Posture`, `DLP`, `MIRRORING`, `AURL`, `User Reported Phishing`, `Graph Engine`\n- **category**: `CONFIGURATION`, `VULNERABILITY`, `MALWARE`, `IDENTITY`, `NETWORK`, `DATA_LOSS`, `COMPLIANCE`, `RUNTIME`, `SECRETS`, `IAC`, `CI_CD_RISKS`, `DRIFT`, `API_SECURITY`, `POSTURE`, `COMPUTE`, `LICENSE`, `OPERATIONAL_RISK`, `AI_SECURITY`\n- **asset_classes**: `Compute`, `Data`, `Network`, `Identity`, `Security`, `Management`, `Application`, `Other`\n- **asset_categories**: `Storage Bucket`, `Virtual Machine`, `Database Instance`, `Container`, `Serverless Function`, `Load Balancer`, `Firewall`, `VPN Gateway`, `IAM Role`, `IAM User`, `IAM Group`, `IAM Policy`, `Service Account`, `Kubernetes Cluster`, `Kubernetes Pod`, `Kubernetes Node`, `Network Interface`, `Subnet`, `VPC`, `Security Group`, `DNS Zone`, `Certificate`, `Key Vault`, `Disk`, `Snapshot`, `Image`, `Queue`, `Topic`, `API Gateway`, `CDN`, `Other`\n- **asset_providers**: `AWS`, `Azure`, `GCP`, `Oracle Cloud`, `IBM Cloud`, `Alibaba Cloud`, `Other`\n- **_insert_time, last_modified, observation_time**: Epoch timestamp in milliseconds (integer)\n- **id**: Integer issue ID\n- **external_id, detection.rule_id, assigned_to, assigned_to_pretty, asset_ids, asset_names, asset_accounts, asset_regions, asset_types, asset_group_ids, asset_external_provider_ids, asset_cloud_account_names**: Free-text string values\n- **xdm.compliance.standard_id, xdm.compliance.category_id, xdm.compliance.control_id**: Compliance framework identifiers (string)\n- **xdm.policy_id**: Policy identifier (string)\n- **asset_group_names**: Asset group names (string)\n- **asset_tags**: Asset tag values (string)"}}}},"search_from":{"type":"integer","default":0,"description":"Starting index for pagination."},"search_to":{"type":"integer","default":100,"description":"Ending index for pagination."},"sort":{"type":"object","properties":{"field":{"type":"string","enum":["id","severity","observation_time"]},"keyword":{"type":"string","enum":["asc","desc"],"description":"Sort order (ascending or descending)."}}},"include_fields":{"type":"array","items":{"type":"string","enum":["normalized_fields","custom_fields"]},"description":"A list of fields to include in the response.\n- `normalized_fields`: Includes normalized fields in the response.\n- `custom_fields`: Includes custom user-defined fields in the response.\n- By default these fields will not be part of response payload.\n","default":[]},"include_evidences":{"type":"boolean","default":false,"description":"When `true`, each issue includes its `evidences` array."},"include_actions":{"type":"boolean","default":false,"description":"When `true`, each issue includes its `actions` array."}}}}}}}},"responses":{"200":{"description":"Successful response with issues","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"TOTAL_COUNT":{"type":"integer"},"FILTER_COUNT":{"type":"integer"},"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Issue"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"schemas":{"Issue":{"type":"object","description":"Issue object returned by the search endpoint. Fields correspond to the PUBLIC_FIELDS_GET_ISSUE list in the codebase.","properties":{"_insert_time":{"type":"integer","format":"int64","description":"Issue creation timestamp in epoch milliseconds.","nullable":true},"external_id":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"observation_time":{"type":"integer","format":"int64"},"domain":{"type":"string","description":"Issue domain. Default domains listed below; custom domains may also be configured per tenant.","enum":["Security","Health","Hunting","IT","Posture"]},"detection.method":{"type":"string","description":"Detection source or method that created the issue.","enum":["TRAPS","MAGNIFIER","ANALYTICS_BIOC","FW","BIOC","IOC","THREAT_INTELLIGENCE","MTH","CORRELATION","PRISMA_CLOUD","PRISMA_CLOUD_COMPUTE","XPANSE","IOT","CREATE_ALERT_PUBLIC_API","HEALTH","EMAIL_ATTACHMENT","ATTACK_PATH","POSTURE_POLICY","CAS_DRIFT_SCANNER","CLOUD_NETWORK_ANALYZER","CAS_IAC_SCANNER","CAS_SECRET_SCANNER","CAS_CI_CD_RISK_SCANNER","CLI_SCANNER","CIEM_SCANNER","API_TRAFFIC_MONITOR","API_POSTURE_SCANNER","AGENTLESS_DISK_SCANNER","KUBERNETES_SCANNER","COMPUTE_POLICY","CSPM_SCANNER","CAS_CVE_SCANNER","CAS_LICENSE_SCANNER","SECRETS_SCANNER","CAS_SAST_SCANNER","DATA_POLICY","CAS_OPERATIONAL_RISK_SCANNER","VULNERABILITY_POLICY","AISPM_RULE_ENGINE","DLP","MIRRORING","AURL","USER_REPORTED_PHISHING","GRAPH_ENGINE"]},"detection.rule_id":{"type":"string"},"category":{"type":"string","description":"Issue category classification.","enum":["CONFIGURATION","VULNERABILITY","MALWARE","IDENTITY","NETWORK","DATA_LOSS","COMPLIANCE","RUNTIME","SECRETS","IAC","CI_CD_RISKS","DRIFT","API_SECURITY","POSTURE","COMPUTE","LICENSE","OPERATIONAL_RISK","AI_SECURITY"]},"findings":{"type":"array","items":{"type":"string"}},"asset_ids":{"type":"array","items":{"type":"string"}},"asset_names":{"type":"array","items":{"type":"string"}},"asset_group_ids":{"type":"array","items":{"type":"integer"}},"asset_classes":{"type":"array","items":{"type":"string","enum":["Compute","Data","Network","Identity","Security","Management","Application","IoT","Other"]}},"asset_categories":{"type":"array","items":{"type":"string","enum":["Storage Bucket","Virtual Machine","Database Instance","Container","Serverless Function","Load Balancer","Firewall","VPN Gateway","IAM Role","IAM User","IAM Group","IAM Policy","Service Account","Kubernetes Cluster","Kubernetes Pod","Kubernetes Node","Network Interface","Subnet","VPC","Security Group","DNS Zone","Certificate","Key Vault","Disk","Snapshot","Image","Queue","Topic","API Gateway","CDN","Other"]}},"asset_regions":{"type":"array","items":{"type":"string"},"description":"Cloud regions where the assets are located. Values depend on the cloud provider (e.g., AWS: us-east-1, Azure: eastus, GCP: us-central1)."},"asset_providers":{"type":"array","items":{"type":"string","enum":["AWS","Azure","GCP","Oracle Cloud","IBM Cloud","Alibaba Cloud","Other"]}},"asset_accounts":{"type":"array","items":{"type":"string"}},"asset_types":{"type":"array","items":{"type":"string"}},"mitre_tactics":{"type":"array","items":{"type":"string"}},"mitre_techniques":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"remediation":{"type":"string"},"extended_description":{"type":"string"},"impact":{"type":"string"},"id":{"type":"integer","description":"Internal numeric ID of the issue."},"last_update_timestamp":{"type":"integer","format":"int64"},"tags":{"type":"array","items":{"type":"string"}},"is_excluded":{"type":"boolean"},"is_starred":{"type":"boolean"},"assigned_to":{"type":"string"},"assigned_to_pretty":{"type":"string"},"status.progress":{"type":"string","description":"Current status of the issue. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant.","enum":["New","In Progress","Resolved"]},"status.resolution_reason":{"type":"string","description":"Resolution reason for resolved issues. Null when issue is not resolved. Built-in values are listed below. Additional values may be available depending on tenant configuration.","enum":["RESOLVED_THREAT_HANDLED","RESOLVED_KNOWN_ISSUE","RESOLVED_DUPLICATE","RESOLVED_FALSE_POSITIVE","RESOLVED_OTHER","RESOLVED_TRUE_POSITIVE","RESOLVED_SECURITY_TESTING","RESOLVED_RISK_ACCEPTED","RESOLVED_FIXED","RESOLVED_DISMISSED","RESOLVED_AUTO_RESOLVE"],"nullable":true},"status.resolution_comment":{"type":"string","description":"Free-text comment provided when resolving the issue. Null when the issue is not resolved or no comment was provided."},"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"resolution_status_modified_ts":{"type":"integer","format":"int64","description":"Epoch timestamp in milliseconds when the resolution status was last modified."},"case_ids":{"type":"array","items":{"type":"integer"},"description":"List of case IDs this issue is associated with."},"initial_evidence":{"type":"string","description":"Initial evidence that triggered the issue."},"is_excepted":{"type":"boolean","description":"Indicates if the issue has an active exception."},"exception_ids":{"type":"array","items":{"type":"string"},"description":"List of exception IDs applied to this issue.","nullable":true},"exception_expiration":{"type":"integer","format":"int64","description":"Epoch timestamp in milliseconds when the exception expires.","nullable":true},"agentic_response_status":{"type":"string","description":"Status of the agentic response for this issue.","nullable":true},"agentic_assistant_id":{"type":"string","description":"ID of the agentic assistant handling this issue.","nullable":true},"agentic_response_conversation_id":{"type":"string","description":"Conversation ID for the agentic response.","nullable":true},"action_status":{"type":"string","description":"Current action status of the issue."},"asset_external_provider_ids":{"type":"array","items":{"type":"string"},"description":"List of external provider IDs for assets associated with the issue."},"asset_cloud_account_names":{"type":"array","items":{"type":"string"},"description":"List of cloud account names for assets associated with the issue."},"normalized_fields":{"$ref":"#/components/schemas/NormalizedFields"},"custom_fields":{"type":"object"}}},"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"array","items":{"type":"string"}},"xdm.source.ipv4":{"type":"array","items":{"type":"string"}},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"array","items":{"type":"string"}},"xdm.source.process.causality_id":{"type":"array","items":{"type":"string"}},"xdm.source.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.file.filename":{"type":"array","items":{"type":"string"}},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"array","items":{"type":"integer"}},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"array","items":{"type":"string"}},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"array","items":{"type":"string"}},"xdm.target.registry.data":{"type":"array","items":{"type":"string"}},"xdm.target.registry.key":{"type":"array","items":{"type":"string"}},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"array","items":{"type":"string"}},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Update existing issue > Update an existing issue in the system. \*\*Users can only update one issue at a time.\*\* \ > At least one of the following fields must be provided: \ > \- \`severity\`\ > \- \`status\`\ > \ > When setting \`status\` to \`Resolved\`, the \`status\_resolution\_reason\` field is \*\*required\*\*.\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue/{issue-id}":{"post":{"summary":"Update existing issue","description":"Update an existing issue in the system. **Users can only update one issue at a time.** \nAt least one of the following fields must be provided: \n - `severity`\n - `status`\n\nWhen setting `status` to `Resolved`, the `status_resolution_reason` field is **required**.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"updateIssue","parameters":[{"name":"issue-id","in":"path","description":"Numeric ID of the issue to update","required":true,"schema":{"type":"integer"}},{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"update_data":{"$ref":"#/components/schemas/UpdateIssue"}}}}}}}},"responses":{"204":{"description":"Issues updated successfully"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"schemas":{"UpdateIssue":{"type":"object","description":"At least one of `severity` or `status` must be provided. When setting `status` to `Resolved`, the `status_resolution_reason` field is required.","properties":{"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"status":{"type":"string","enum":["New","In Progress","Resolved"]},"status_resolution_reason":{"type":"string","description":"Resolution reason when status is set to 'Resolved'. Required when resolving an issue. Built-in values are listed below. Additional values such as 'Resolved - Risk Accepted', 'Resolved - Fixed', and 'Resolved - Dismissed' may be available depending on tenant licensing. Values are case-insensitive.","enum":["Resolved - Threat Handled","Resolved - Known Issue","Resolved - Duplicate Issue","Resolved - False Positive","Resolved - Other","Resolved - True Positive","Resolved - Security Testing","Resolved - Risk Accepted","Resolved - Fixed","Resolved - Dismissed"]},"status_resolution_comment":{"type":"string"}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Retrieve issue schema > This endpoint retrieves the schema definition for issues, including core fields, normalized fields, and custom fields. Each field includes its name, pretty name, and data type.\ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue/schema/":{"post":{"summary":"Retrieve issue schema","description":"This endpoint retrieves the schema definition for issues, including core fields, normalized fields, and custom fields. Each field includes its name, pretty name, and data type.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"getIssueSchema","tags":["Issues"],"responses":{"200":{"description":"Successful response with issue schema","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/IssueSchemaField"}}}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"IssueSchemaField":{"type":"object","properties":{"field_name":{"type":"string"},"field_pretty_name":{"type":"string"},"data_type":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Create a new issue exception > This endpoint allows users to create a new issue exception by providing the necessary details.\ > \*\*Users can only create one exception at a time.\*\*\ > \- The request must include the following required fields:\ > \- \`name\`\ > \- \`rule\`\ > \- \`justification\_text\`\ > \- \`justification\_category\`\ > \- \`expiration\_ts\`\ > \- \`approver\_email\`\ > \ > \- Optional fields:\ > \- \`external\_exception\_id\`\ > \ > If the tenant has approval required enabled, the \`approver\_email\` field is mandatory and the exception will be created with \`Pending Status\` status. Otherwise, the exception is \`Self Approved\` automatically.\ > \ > The \`requestor\_name\` and \`requestor\_email\` fields are automatically populated from the API key context.\ > \ > \*\*Required permission:\*\* \`Exception Management Admin View/Edit\`, \`Exception Approver Admin View/Edit\`\ > \ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management\ > \ > For the complete list of fields you can use as \`SEARCH\_FIELD\` in the \`rule\` parameter, see \[Issue exception supported fields]\(). ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue_exceptions/":{"post":{"summary":"Create a new issue exception","description":"This endpoint allows users to create a new issue exception by providing the necessary details.\n**Users can only create one exception at a time.**\n- The request must include the following required fields:\n - `name`\n - `rule`\n - `justification_text`\n - `justification_category`\n - `expiration_ts`\n - `approver_email`\n\n- Optional fields:\n - `external_exception_id`\n\nIf the tenant has approval required enabled, the `approver_email` field is mandatory and the exception will be created with `Pending Status` status. Otherwise, the exception is `Self Approved` automatically.\n\nThe `requestor_name` and `requestor_email` fields are automatically populated from the API key context.\n\n**Required permission:** `Exception Management Admin View/Edit`, `Exception Approver Admin View/Edit`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management\n\nFor the complete list of fields you can use as `SEARCH_FIELD` in the `rule` parameter, see [Issue exception supported fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-fields-for-issue-exception-filters).","operationId":"createIssueException","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/CreateIssueException"}}}}}},"responses":{"200":{"description":"Exception created successfully","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"exception_id":{"type":"integer","description":"ID of the newly created exception"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"schemas":{"CreateIssueException":{"type":"object","description":"Request data for creating a new issue exception.","required":["name","rule","justification_text","justification_category","approver_email","expiration_ts"],"properties":{"name":{"type":"string","description":"Human-readable name for the exception"},"external_exception_id":{"type":"string","nullable":true,"description":"Optional external tracking ID for the exception"},"rule":{"type":"string","description":"JSON-encoded filter rule defining which issues this exception applies to. Uses the standard Cortex filter format with `AND`/`OR` structure. The value of each `SEARCH_FIELD` must be one of the supported field names — see [Issue exception supported fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-fields-for-issue-exception-filters) for the complete list."},"justification_text":{"type":"string","description":"Free-text justification explaining why this exception is needed"},"justification_category":{"type":"string","enum":["COMPENSATING_CONTROL","PLANNED_REMEDIATION","RISK_ACCEPTED","VENDOR_DEPENDENCY"],"description":"Category of justification for the exception"},"approval_justification":{"type":"string","description":"Free-text justification explaining why this exception is approved or rejected"},"approver_email":{"type":"string","description":"Email of the designated approver. Required when the tenant has approval workflow enabled. Must match a registered approver."},"expiration_ts":{"type":"string","format":"date-time","description":"Expiration date/time for the exception. Accepts ISO 8601 date-time or date-only format. Date-only values are normalized to end-of-day UTC (23:59:59)."}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Disable an issue exception > This endpoint allows users to disable an existing issue exception. This will trigger a reversion scan to restore matching issues that were previously suppressed by this exception. \*\*A disabled exception cannot be reactivated.\*\*\ > \ > \*\*Required permission:\*\* \`Exception Management Admin View/Edit\`, \`Exception Approver Admin View/Edit\`\ > \ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue_exceptions/disable/":{"post":{"summary":"Disable an issue exception","description":"This endpoint allows users to disable an existing issue exception. This will trigger a reversion scan to restore matching issues that were previously suppressed by this exception. **A disabled exception cannot be reactivated.**\n\n**Required permission:** `Exception Management Admin View/Edit`, `Exception Approver Admin View/Edit`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"disableIssueException","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["exception_id"],"properties":{"exception_id":{"type":"integer","description":"ID of the issue exception to disable"}}}}}}}},"responses":{"200":{"description":"Exception disabled successfully","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"rows_affected":{"type":"integer","description":"Number of database rows affected"},"status":{"type":"string","description":"New status of the exception"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` ## Retrieve issue exceptions based on filters > This endpoint retrieves a list of issue exceptions that match the specified filter criteria. It supports filtering along with sorting and pagination. \ > \ > \*\*Required permission:\*\* \`Exception Management Admin View\`, \`Exception Approver Admin View\`\ > \ > \ > \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management ```json {"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex Cloud"},"tags":[{"name":"Issues","description":"Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata."}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/issue_exceptions/search/":{"post":{"summary":"Retrieve issue exceptions based on filters","description":"This endpoint retrieves a list of issue exceptions that match the specified filter criteria. It supports filtering along with sorting and pagination. \n\n**Required permission:** `Exception Management Admin View`, `Exception Approver Admin View`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","operationId":"searchIssueExceptions","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"object","description":"Filter criteria using AND/OR structure. Each filter condition contains SEARCH_FIELD, SEARCH_TYPE, and SEARCH_VALUE.","properties":{"SEARCH_FIELD":{"type":"string","enum":["EXCEPTION_ID","EXTERNAL_EXCEPTION_ID","NAME","STATUS","EXPIRATION_TS","IMPACTED_ISSUES_COUNT","BACKWARD_SCAN_STATUS","JUSTIFICATION_CATEGORY","REQUESTOR_NAME","APPROVER_NAME","CREATED_TS","APPROVAL_TS","JUSTIFICATION_TEXT","APPROVAL_JUSTIFICATION","REQUESTOR_EMAIL","APPROVER_EMAIL"],"description":"String that identifies the exception field the filter is matching."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GTE","LTE","GT","LT","IN","CONTAINS","CONTAINS_NOT"],"description":"Identifies the comparison operator to use for this filter. The following list shows which operators can be used for each filter field:\n\n- **EQ** / **NEQ** - use with all fields\n- **GTE** / **LTE** / **GT** / **LT** - use with `EXCEPTION_ID`, `EXPIRATION_TS`, `IMPACTED_ISSUES_COUNT`, `CREATED_TS`, `APPROVAL_TS`\n- **IN** - use with `EXCEPTION_ID`, `STATUS`, `BACKWARD_SCAN_STATUS`, `JUSTIFICATION_CATEGORY`\n- **CONTAINS** / **CONTAINS_NOT** — use with `EXTERNAL_EXCEPTION_ID`, `NAME`, `REQUESTOR_NAME`, `APPROVER_NAME`, `JUSTIFICATION_TEXT`, `APPROVAL_JUSTIFICATION`, `REQUESTOR_EMAIL`, `APPROVER_EMAIL`"},"SEARCH_VALUE":{"description":"Value that this filter must match. The contents of this field will differ depending on the field that you specified for this filter:\n\n- EXCEPTION_ID — Integer, e.g. `1`, `42`\n- EXTERNAL_EXCEPTION_ID — String, e.g. `\"EXT-001\"`\n- NAME — String, e.g. `\"CVE Exception\"`\n- STATUS — String. Values are: `APPROVED`, `DISABLED`, `EXPIRED`, `NO_DECISION_MADE`, `PENDING_DECISION`, `REJECTED`, `SELF_APPROVED`\n- EXPIRATION_TS — Epoch milliseconds, e.g. `1712448000000`\n- IMPACTED_ISSUES_COUNT — Integer, e.g. `0`, `10`, `100`\n- BACKWARD_SCAN_STATUS — String. Values are: `COMPLETED`, `FAILED`, `IN_PROGRESS`, `PENDING`\n- JUSTIFICATION_CATEGORY — String. Values are: `COMPENSATING_CONTROL`, `PLANNED_REMEDIATION`, `RISK_ACCEPTED`, `VENDOR_DEPENDENCY`\n- REQUESTOR_NAME — String, e.g. `\"John Doe\"`\n- APPROVER_NAME — String, e.g. `\"Jane Smith\"`\n- CREATED_TS — Epoch milliseconds, e.g. `1712448000000`\n- APPROVAL_TS — Epoch milliseconds, e.g. `1712448000000`\n- JUSTIFICATION_TEXT — String, e.g. `\"Risk accepted per policy\"`\n- APPROVAL_JUSTIFICATION — String, e.g. `\"Approved by security team\"`\n- REQUESTOR_EMAIL — String, e.g. `\"john@example.com\"`\n- APPROVER_EMAIL — String, e.g. `\"jane@example.com\"`","oneOf":[{"type":"string"},{"type":"integer"},{"type":"array","items":{"type":"string"}}]}}},"search_from":{"type":"integer","default":0,"description":"Starting index for pagination."},"search_to":{"type":"integer","default":100,"description":"Ending index for pagination."},"sort":{"type":"object","nullable":true,"description":"Sort configuration","properties":{"FIELD":{"type":"string","description":"Field name to sort by"},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Sort direction"}}}}}}}}}},"responses":{"200":{"description":"Exceptions retrieved successfully","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"exceptions":{"type":"array","description":"List of matching exception objects","items":{"$ref":"#/components/schemas/IssueException"}},"filter_count":{"type":"integer","description":"Number of exceptions matching the applied filters"},"total_count":{"type":"integer","description":"Total number of exceptions (ignoring filters)"}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}},"tags":["Issues"]}}},"components":{"schemas":{"IssueException":{"type":"object","description":"Full issue exception object as returned by the public API","properties":{"exception_id":{"type":"integer","nullable":true,"description":"Auto-incremented exception ID"},"external_exception_id":{"type":"string","nullable":true,"description":"External tracking ID"},"name":{"type":"string","description":"Exception name"},"status":{"type":"string","enum":["APPROVED","DISABLED","EXPIRED","NO_DECISION_MADE","PENDING_DECISION","REJECTED","SELF_APPROVED"],"description":"Exception status"},"rule":{"type":"string","description":"JSON-encoded filter rule"},"pretty_rule":{"type":"string","nullable":true,"description":"Human-readable representation of the rule"},"justification_text":{"type":"string","description":"Justification text"},"justification_category":{"type":"string","enum":["COMPENSATING_CONTROL","PLANNED_REMEDIATION","RISK_ACCEPTED","VENDOR_DEPENDENCY"],"nullable":true,"description":"Justification category"},"approval_justification":{"type":"string","nullable":true,"description":"Approval decision justification"},"requestor_name":{"type":"string","description":"Name of the user who requested the exception"},"requestor_email":{"type":"string","description":"Email of the user who requested the exception"},"approver_email":{"type":"string","nullable":true,"description":"Email of the assigned approver"},"approver_name":{"type":"string","nullable":true,"description":"Name of the assigned approver"},"created_ts":{"type":"string","format":"date-time","nullable":true,"description":"Creation timestamp"},"modified_ts":{"type":"string","format":"date-time","nullable":true,"description":"Last modification timestamp"},"approval_ts":{"type":"string","format":"date-time","nullable":true,"description":"Approval decision timestamp"},"expiration_ts":{"type":"string","format":"date-time","description":"Exception expiration timestamp"},"impacted_issues_count":{"type":"integer","description":"Number of issues impacted by this exception"},"backward_scan_status":{"type":"string","enum":["COMPLETED","FAILED","IN_PROGRESS","PENDING"],"nullable":true,"description":"Status of backward scan"},"backward_scan_ts":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last backward scan"},"reversion_scan_status":{"type":"string","enum":["COMPLETED","FAILED","IN_PROGRESS","PENDING"],"nullable":true,"description":"Reversion scan status"},"reversion_scan_ts":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last reversion scan"}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.