> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md).

# CLI Tool permissions

Configure permissions for CLI tools.

CLI Tools (Cortex CLI) provides a unified command interface to efficiently scan Cloud Workload Protection (CWP), API Security, and Application Security environments with a single installation, enabling integration of security checks into development processes. It controls access to view the CLI Tools setup within the **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations**), download the CLI, and generate the required API keys.

{% hint style="warning" %}

### Caution

* Licence Requirement: Accessing the CLI Tool requires a Cloud Posture Security, Cloud Runtime Security license.
* This permission only governs the deployment and configuration of the CLI tool itself. To view the actual security findings and vulnerabilities discovered by the CLI scans, users must be granted separate access to the Application Security, Cloud Workload Policies, or Vulnerability Management modules.
  {% endhint %}

For more information, see [Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cli/).

| Component | Description                                                              | Roles Example                                                                                                                                                         |
| --------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None      | No access to CLI Tools configuration or API key generation.              | SOC Tier-1 Analyst: No need for CI/CD integration.                                                                                                                    |
| View      | Read-only access to CLI Tools configuration and download capabilities.   | <ul><li>SOC Tier-2 and 3 Analysts: May need to view scan results but not configure.</li><li>Threat Hunter: May review scan results for threat intelligence.</li></ul> |
| View/Edit | Full access to configure CLI Tools and generate API keys for deployment. | Security Engineer: Configures CI/CD security integrations and needs to generate API keys.                                                                             |

**Required and recommended permissions**

To effectively configure the CLI and review its subsequent scan results, administrators and analysts require visibility into the underlying data sources and security policies. Consider adding the following permissions:

| Permission               | Permission Level  | Reason                                                                                                                                                                                  |
| ------------------------ | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Public API               | View/Edit         | Required for setup. Users must generate an API key to configure the CLI tool successfully. As the backend endpoint is shared, View/Edit access to the Public API is mandatory.          |
| Data Sources             | View or View/Edit | <ul><li>View: Required. Access the Data Sources & Integrations page where CLI Tools is located.</li><li>View/Edit: Strongly recommended to modify data source configurations.</li></ul> |
| CloudSec Policies        | View/Edit         | Required to access and modify the Cloud Workload Protection policies that the CLI evaluates against.                                                                                    |
| Application Security     | View/Edit         | Strongly recommended to view and manage the CI/CD, PR, and periodic scan findings generated by the CLI tool.                                                                            |
| Vulnerability Management | View              | Recommended to view broader vulnerability scan results identified by the CLI tool across the environment.                                                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.