> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md).

# CLI Tool permissions

CLI Tools (Cortex CLI) provides a unified command interface to efficiently scan Cloud Workload Protection (CWP), API Security, and Application Security environments with a single installation, enabling integration of security checks into development processes. It controls access to view the CLI Tools setup within the **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations**), download the CLI, and generate the required API keys.

{% hint style="warning" %}

### Caution

* Licence Requirement: Accessing the CLI Tool requires a Cloud Posture Security, Cloud Runtime Security license.
* This permission only governs the deployment and configuration of the CLI tool itself. To view the actual security findings and vulnerabilities discovered by the CLI scans, users must be granted separate access to the Application Security, Cloud Workload Policies, or Vulnerability Management modules.
  {% endhint %}

For more information, see [Cortex CLI](/cortex-cli/cortex-cli.md).

| Component | Description                                                              | Roles Example                                                                                                                                                         |
| --------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None      | No access to CLI Tools configuration or API key generation.              | SOC Tier-1 Analyst: No need for CI/CD integration.                                                                                                                    |
| View      | Read-only access to CLI Tools configuration and download capabilities.   | <ul><li>SOC Tier-2 and 3 Analysts: May need to view scan results but not configure.</li><li>Threat Hunter: May review scan results for threat intelligence.</li></ul> |
| View/Edit | Full access to configure CLI Tools and generate API keys for deployment. | Security Engineer: Configures CI/CD security integrations and needs to generate API keys.                                                                             |

**Required and recommended permissions**

To effectively configure the CLI and review its subsequent scan results, administrators and analysts require visibility into the underlying data sources and security policies. Consider adding the following permissions:

| Permission               | Permission Level  | Reason                                                                                                                                                                                  |
| ------------------------ | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Public API               | View/Edit         | Required for setup. Users must generate an API key to configure the CLI tool successfully. As the backend endpoint is shared, View/Edit access to the Public API is mandatory.          |
| Data Sources             | View or View/Edit | <ul><li>View: Required. Access the Data Sources & Integrations page where CLI Tools is located.</li><li>View/Edit: Strongly recommended to modify data source configurations.</li></ul> |
| CloudSec Policies        | View/Edit         | Required to access and modify the Cloud Workload Protection policies that the CLI evaluates against.                                                                                    |
| Application Security     | View/Edit         | Strongly recommended to view and manage the CI/CD, PR, and periodic scan findings generated by the CLI tool.                                                                            |
| Vulnerability Management | View              | Recommended to view broader vulnerability scan results identified by the CLI tool across the environment.                                                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.