> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/install-images.md).
# Install images
Obtain signed download URLs for the Broker VM installation images in the supported hypervisor formats (OVA, QCOW2, VHD, VHD\_AZURE, VMDK).
## Get a signed URL for a Broker VM install image
> Return a short-lived signed URL for the Broker VM installation\
> image in the requested hypervisor format. The signed URL is valid\
> for direct download from object storage; the caller does not need\
> to re-authenticate.\
> \
> The request body carries the image type as a JSON object so the\
> endpoint stays consistent with the other GET-but-with-body\
> endpoints in this spec (the backend gates allow GET on this route\
> and parse the body identically to a POST).\
> \
> \*\*Required permission:\*\* \`broker\_action\`.
```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"tags":[{"name":"images","description":"Obtain signed download URLs for the Broker VM installation images in\nthe supported hypervisor formats (OVA, QCOW2, VHD, VHD_AZURE, VMDK).\n"}],"servers":[{"url":"https://api-{fqdn}","description":"Cortex tenant base URL","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"Fully qualified domain name of the Cortex tenant."}}}],"security":[{"XDRAuth":[],"XDRAuthToken":[]}],"components":{"securitySchemes":{"XDRAuth":{"type":"apiKey","in":"header","name":"Authorization","description":"The tenant API key value, sent as the literal `Authorization`\nheader value (no `Bearer ` prefix).\n"}},"schemas":{"DownloadImageRequest":{"description":"Body for `downloadInstallImage`. The `type` selector picks the hypervisor image format.\n","type":"object","required":["type"],"additionalProperties":false,"properties":{"type":{"$ref":"#/components/schemas/ImageType"}}},"ImageType":{"type":"string","description":"Hypervisor format of a Broker VM install image.","enum":["OVA","QCOW2","VHD","VHD_AZURE","VMDK"]},"ImageDownloadInfo":{"description":"Payload returned by `downloadInstallImage`. The `download_url` is a short-lived signed URL for direct image download.\n","type":"object","required":["image_type","download_url","file_name"],"properties":{"image_type":{"$ref":"#/components/schemas/ImageType"},"download_url":{"type":"string","format":"uri","description":"Short-lived signed URL for direct image download."},"file_name":{"type":"string","description":"Suggested filename for the download."},"version":{"type":"string","nullable":true,"description":"Broker VM platform version embedded in the image."}}},"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}},"responses":{"BadRequest":{"description":"Request validation failed. `errors` is present when the failure\noriginates from Pydantic schema validation; otherwise only\n`description` is populated.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Unauthorized":{"description":"Missing or invalid `Authorization` / `x-xdr-auth-id` credentials.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"Forbidden":{"description":"Authenticated caller lacks the `broker_action` permission, or the\ntargeted broker is a cluster member and the operation is rejected\nat that level.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"NotFound":{"description":"The targeted resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}},"InternalServerError":{"description":"Unexpected server-side failure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PapiErrorResponse"}}}}}},"paths":{"/public_api/v1/brokers/images/":{"get":{"tags":["images"],"operationId":"downloadInstallImage","summary":"Get a signed URL for a Broker VM install image","description":"Return a short-lived signed URL for the Broker VM installation\nimage in the requested hypervisor format. The signed URL is valid\nfor direct download from object storage; the caller does not need\nto re-authenticate.\n\nThe request body carries the image type as a JSON object so the\nendpoint stays consistent with the other GET-but-with-body\nendpoints in this spec (the backend gates allow GET on this route\nand parse the body identically to a POST).\n\n**Required permission:** `broker_action`.\n","requestBody":{"required":true,"description":"Image type selector.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DownloadImageRequest"}}}},"responses":{"200":{"description":"Signed download metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImageDownloadInfo"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/install-images.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.