> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-common-command-line-reference-guide.md). # Cortex CLI common command line reference guide This reference guide describes the command line flags used to manage the Cortex Cloud Application Security (AppSec), Cloud Workload Protection (CWP), and API Security modules through the Cortex CLI. It includes [common flags](#common-flags), which apply to all supported modules, and [global flags](#global-flags), which are shared specifically across AppSec and CWP and must be placed before the command. In instances where the same flag is available in both categories, its underlying functionality remains identical; however, its required placement within the command structure differs depending on how it is used. ## Common flags The following table describes CLI commands common to all supported Cortex CLI modules. {% hint style="warning" %} These flags are typically used **after** the module and command. {% endhint %} | Command | Description | | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--api-base-url` / `$CORTEX_API_BASE_URL` | **Required: true**. The public facing API URL. To retrieve the URL, under Settings, select Configurations → API Keys copy API URL | | `--api-key` / `$CORTEX_API_KEY` | **Required: true**. The API key used for authorization | | `--api-key-id` / `$CORTEX_API_KEY_ID` | **Required: true**.The API key ID | | `--support` / `$SUPPORT` | Enable debug logs and upload the logs to the platform. Usage: Before the module name.**EXAMPLE**`cortexcli --api-base-url --api-key --api-key-id --support code scan directory. --upload-mode no-upload --repo-id my/test --branch test` | | `--log-level` | Set the logging level (INFO, WARNING, ERROR, DEBUG) for Stdout output | | `--http-proxy` / `$HTTP_PROXY` | The HTTP proxy server URL to route traffic through | | `--https-proxy` / `$HTTPS_PROXY` | The HTTPS proxy server URL to route traffic through | | `--ca-certificate` / `$CORTEX_CODE_CA_CERTIFICATE` |

Required: No

Path to a custom CA certificate (bundle) file, in PEM format, used for TLS certificate verification. It is intended for environments that use a corporate proxy or perform TLS interception, where the standard system CA bundle does not contain the intercepting proxy's certificate.
EXAMPLE: cortexcli --ca-certificate /path/to/ca-bundle.pem code scan --directory

| | `--no-cert-verify` / `$CORTEX_CODE_NO_CERT_VERIFY` / `$NO_CERT_VERIFY` | This flag disables TLS/SSL certificate verification (default: false). Skips TLS certificate verification when connecting to the API. **Not recommended for production**. Use only in test or development environments, as this reduces connection security | | `--help` | Displays usage information, available subcommands, global flags, and flag descriptions for the Cortex CLI or any specific subcommand. Run `--help` at any level of the command hierarchy to discover available options:• `cortexcli --hel`p: Lists all available modules (AppSec, CWP, WAAS), global flags, and getting-started guidance.• **Authentication**: The --help flag works without API key authentication. No credentials, network connectivity, or platform access are required. This allows developers to explore the CLI interface before configuring authentication | | `--version` | Retrieves the version of the Cortex CLI currently in use | ## Global flags The following table describes global CLI flags that are common specifically to the Application Security (AppSec) and Cloud Workload Protection (CWP) modules. {% hint style="warning" %} These flags must be placed **before** the command. {% endhint %} | Command | Description | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--upload-mode` / `$CORTEX_UPLOAD_MODE` | Controls whether scan results are uploaded to the Cortex Cloud platform.Accepts placement in both the global position (`cortexcli --upload-mode no-upload code scan`) and the command position (`cortexcli code scan --upload-mode no-upload`). The global position takes priority over the command position.**Accepted values**:• `upload`: Uploads results to the platform and triggers policy evaluation• `no-upload`: Executes scanners locally without uploading results. Enables --severity filtering• `no-code`: Uploads results without uploading source code | | `--soft-fail` / `$CORTEX_SOFT_FAIL` |

Required: false.Allows CI/CD pipelines to continue without disruption by returning a successful exit code (0) when scan errors are detected.

  • Visibility: Unlike skipped or suppressed checks, soft-fail errors remain fully reported in the output
  • Thresholds: Failed checks are evaluated against the defined severity threshold. If multiple severities are specified, the highest acts as the threshold
  • Exceptions: Fundamental execution errors (such as exit codes 126 or 127) are not suppressed and will still fail the build
| | `--no-fail-on-crash` / `$CORTEX_NO_FAIL_ON_CRASH` |

Prevents the CLI from returning a non-zero exit code during internal errors (such as scanner crashes or network timeouts), ensuring CI/CD pipeline continuity even if a scan fails.

  • When to use: Enable in production pipelines where build availability takes priority over scan enforcement
  • EXAMPLE: Prevents a temporary Cortex Cloud platform outage from blocking all organizational builds
  • Best Practice: Combine with --log to ensure internal errors are still captured for post-incident review
  • Exceptions: Signal-based exit codes (126, 127, 128+) indicating the CLI itself failed to execute are never suppressed and require immediate investigation
  • IMPORTANT: The environment variable changed from $CORTEX\_CODE\_NO\_FAIL\_ON\_CRASH to $CORTEX\_NO\_FAIL\_ON\_CRASH during the framework migration. Ensure CI/CD pipeline configurations referencing the previous variable name are updated
| | `--log` | Displays the path to the log file after command execution. Use this to troubleshoot CI/CD failures or provide details for support cases. By default, logs are stored at `~/.cortexcli/cortexcli-log/`.Log rotation: Includes automatic log rotation (10 MB per file, 3 backups, 24-hour retention) | | `--help` | See `--help` flag under Common flags above | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-common-command-line-reference-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.