> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/models.md).

# Models

## The PapiErrorResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"PapiErrorResponse":{"type":"object","description":"Canonical error envelope returned by every non-2xx response on\nthis surface.\n","required":["description"],"properties":{"description":{"type":"string","description":"Human-readable error message."},"errors":{"type":"array","description":"Per-field validation failures. Present only on\n`400 Bad Request` responses originating from Pydantic schema\nvalidation; otherwise omitted.\n","items":{"$ref":"#/components/schemas/PapiFieldError"}}}},"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}}}}
```

## The PapiFieldError object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"PapiFieldError":{"description":"One entry in the `errors` array of a `400 Bad Request` response — a Pydantic per-field validation failure.\n","type":"object","required":["field","message"],"properties":{"field":{"type":"string","description":"Dotted path to the offending field within the request body,\nusing ` -> ` as separator for nested keys\n(e.g., `proxy -> type`, `upgrade_window -> days -> 0`).\n"},"message":{"type":"string","description":"Pydantic validation message."}}}}}}
```

## The BrokerActionStatus object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"BrokerActionStatus":{"type":"string","description":"Possible states of an asynchronous broker action.","enum":["SUBMITTED","IN_PROGRESS","COMPLETED","UP_TO_DATE","FAILED","NOT_AVAILABLE"]}}}}
```

## The LifecycleActionResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LifecycleActionResponse":{"type":"object","description":"Acknowledgement of an accepted lifecycle action (reboot, shutdown, or upgrade).","required":["action_id"],"properties":{"action_id":{"type":"string","description":"Opaque identifier of the asynchronous lifecycle action; poll\n[`getActionStatus`](#operation/getActionStatus).\n"}}}}}}
```

## The ImageType object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ImageType":{"type":"string","description":"Hypervisor format of a Broker VM install image.","enum":["OVA","QCOW2","VHD","VHD_AZURE","VMDK"]}}}}
```

## The GetBrokersRequestParams object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"GetBrokersRequestParams":{"type":"object","description":"Optional filters for [`getBrokers`](#operation/getBrokers). Omit\nthe body entirely to return every broker.\n","additionalProperties":false,"properties":{"id":{"type":"array","description":"Exact-match filter on `device_id`.","items":{"type":"string","minLength":1}},"name":{"type":"array","description":"Filter on `device_name`. A value containing shell-style\nwildcards (`*`, `?`) is matched with `fnmatch`\n(case-insensitive); a value without wildcards is matched\nexactly (case-sensitive). Multiple values are OR-combined.\n","items":{"type":"string","minLength":1}}}}}}}
```

## The EditBrokerRequestParams object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"EditBrokerRequestParams":{"type":"object","description":"Patch for a single broker. Any field omitted from the body is left\nunchanged. Server-side validation rules are described per-field\nbelow.\n","additionalProperties":false,"properties":{"name":{"type":"string","description":"New display name for the broker."},"fqdn":{"type":"string","description":"New fully qualified domain name."},"proxy":{"$ref":"#/components/schemas/ProxyConfig"},"webui_port":{"type":"string","description":"Port the broker's web UI listens on. Must parse as an integer\nin `[1, 65535]`.\n"},"ntp":{"type":"array","description":"List of NTP server hostnames or IPs.","items":{"type":"string","minLength":1}},"internal_network":{"type":"string","description":"Internal network CIDR. Must parse as an IPv4 network.\n"},"auto_upgrade":{"type":"boolean","description":"Master switch for auto-upgrade. When `true`, `upgrade_window`\nshould also be provided.\n"},"upgrade_window":{"$ref":"#/components/schemas/UpgradeWindow"},"allow_monitoring":{"type":"boolean","description":"Whether the broker reports monitoring metrics."},"ssh_enabled":{"type":"boolean","description":"Whether SSH access to the broker is enabled."},"ssh_keys":{"type":"array","description":"Authorized SSH public keys. Each entry must start with one of\n`ssh-rsa`, `ssh-ed25519`, `ssh-dss`, `ecdsa-sha2-`.\n","items":{"type":"string","minLength":1}},"welcome_message":{"type":"string","description":"SSH login banner."},"ssl_crt":{"type":"string","description":"PEM-encoded server certificate (paired with `ssl_key`)."},"ssl_key":{"type":"string","description":"PEM-encoded private key (paired with `ssl_crt`)."},"ssl_crt_file_name":{"type":"string","description":"Display name for the SSL certificate file."},"ssl_key_file_name":{"type":"string","description":"Display name for the SSL key file."},"custom_ca":{"$ref":"#/components/schemas/CustomCACertificate"},"broker_ui_password":{"type":"string","description":"New broker web-UI admin password (write-only; never returned\nby `getBrokers`).\n","format":"password"}}},"ProxyConfig":{"type":"object","additionalProperties":false,"description":"Broker outbound proxy configuration.","properties":{"type":{"type":"string","enum":["none","http","socks4","socks5"],"default":"none","description":"Proxy protocol (lowercase)."},"host":{"type":"string","description":"Proxy host. Empty string disables."},"port":{"type":"string","description":"Proxy port (string form, integer in `[1, 65535]`)."},"user":{"type":"string","description":"Proxy username."},"pass":{"type":"string","format":"password","description":"Proxy password (write-only)."}}},"UpgradeWindow":{"type":"object","additionalProperties":false,"description":"Recurring maintenance window for auto-upgrade. Must be at least\n4 hours long when both `start_time` and `end_time` are provided.\n","properties":{"days":{"type":"array","description":"Days of the week the window applies. Accepts ISO weekday\nintegers (1=Monday … 7=Sunday) or English day names\n(\"Monday\", \"Tuesday\", …).\n","items":{"oneOf":[{"type":"integer","minimum":1,"maximum":7},{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}]}},"start_time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$","description":"`HH:MM` in 24-hour format."},"end_time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$","description":"`HH:MM` in 24-hour format."},"timezone":{"type":"string","description":"IANA timezone identifier (e.g., `UTC`, `Europe/Berlin`)."},"schedule":{"type":"string","enum":["any","specific"],"description":"`any` = window applies any time of day on `days`; `specific`\n= window bounded by `start_time`/`end_time`.\n"}}},"CustomCACertificate":{"type":"object","additionalProperties":false,"description":"Custom trusted-CA certificate to install on the broker.","properties":{"cert":{"type":"string","description":"PEM-encoded CA certificate chain."},"name":{"type":"string","description":"Display name for the certificate."},"details":{"type":"string","description":"Free-form description."}}}}}}
```

## The ProxyConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ProxyConfig":{"type":"object","additionalProperties":false,"description":"Broker outbound proxy configuration.","properties":{"type":{"type":"string","enum":["none","http","socks4","socks5"],"default":"none","description":"Proxy protocol (lowercase)."},"host":{"type":"string","description":"Proxy host. Empty string disables."},"port":{"type":"string","description":"Proxy port (string form, integer in `[1, 65535]`)."},"user":{"type":"string","description":"Proxy username."},"pass":{"type":"string","format":"password","description":"Proxy password (write-only)."}}}}}}
```

## The UpgradeWindow object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"UpgradeWindow":{"type":"object","additionalProperties":false,"description":"Recurring maintenance window for auto-upgrade. Must be at least\n4 hours long when both `start_time` and `end_time` are provided.\n","properties":{"days":{"type":"array","description":"Days of the week the window applies. Accepts ISO weekday\nintegers (1=Monday … 7=Sunday) or English day names\n(\"Monday\", \"Tuesday\", …).\n","items":{"oneOf":[{"type":"integer","minimum":1,"maximum":7},{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}]}},"start_time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$","description":"`HH:MM` in 24-hour format."},"end_time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$","description":"`HH:MM` in 24-hour format."},"timezone":{"type":"string","description":"IANA timezone identifier (e.g., `UTC`, `Europe/Berlin`)."},"schedule":{"type":"string","enum":["any","specific"],"description":"`any` = window applies any time of day on `days`; `specific`\n= window bounded by `start_time`/`end_time`.\n"}}}}}}
```

## The CustomCACertificate object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"CustomCACertificate":{"type":"object","additionalProperties":false,"description":"Custom trusted-CA certificate to install on the broker.","properties":{"cert":{"type":"string","description":"PEM-encoded CA certificate chain."},"name":{"type":"string","description":"Display name for the certificate."},"details":{"type":"string","description":"Free-form description."}}}}}}
```

## The EditBrokerResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"EditBrokerResponse":{"type":"object","description":"Acknowledgement of an accepted edit.","required":["action_id"],"properties":{"action_id":{"type":"string","description":"Opaque identifier of the asynchronous action; poll\n[`getActionStatus`](#operation/getActionStatus).\n"}}}}}}
```

## The GenerateTokenResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"GenerateTokenResponse":{"description":"Payload returned by `generateRegistrationToken`. The `token` is opaque to the caller; pass it verbatim to the broker's direct API `/public_api/v1/register` endpoint.\n","type":"object","required":["token"],"properties":{"token":{"type":"string","minLength":1,"description":"Opaque registration token. Pass verbatim to the appliance's\ndirect API `/public_api/v1/register` endpoint.\n"}}}}}}
```

## The BrokerDeviceInfo object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"BrokerDeviceInfo":{"type":"object","description":"Full inventory record for a single registered broker.","required":["device_id","device_name","status","version","external_interface","all_interfaces","configuration_status","fqdn","ntp_servers","internal_network_subnet","monitoring","apps"],"properties":{"device_id":{"type":"string","description":"Unique identifier of the broker within the tenant."},"device_name":{"type":"string","description":"Operator-supplied display name."},"status":{"type":"string","description":"Connectivity / lifecycle status of the broker (e.g.,\n`CONNECTED`, `DISCONNECTED`, transitory states such as\n`IMPORT_CONFIG`).\n"},"version":{"type":"string","description":"Broker VM platform version (e.g., `10.2.0`)."},"external_interface":{"type":"string","description":"IP address of the broker's externally-facing interface."},"all_interfaces":{"type":"array","description":"IP addresses of every configured interface.","items":{"type":"string"}},"cluster_name":{"type":"string","nullable":true,"description":"Cluster the broker belongs to, or `null` if standalone."},"configuration_status":{"type":"string","description":"Whether the broker's persisted configuration matches its\napplied configuration (e.g., `Configured`, `Misconfigured`).\n"},"cpu_usage":{"type":"number","format":"float","nullable":true,"description":"Recent CPU usage as a percentage (0–100), or `null` if unavailable."},"memory_usage":{"type":"number","format":"float","nullable":true,"description":"Recent memory usage as a percentage (0–100), or `null` if unavailable."},"disk_usage":{"type":"number","format":"float","nullable":true,"description":"Recent disk usage as a percentage (0–100), or `null` if unavailable."},"last_seen":{"type":"string","nullable":true,"description":"ISO 8601 UTC timestamp of the broker's last sync."},"upgrade_time":{"type":"string","nullable":true,"description":"ISO 8601 UTC timestamp of the broker's last upgrade."},"fqdn":{"type":"string","description":"Broker's fully qualified domain name."},"proxy_server":{"$ref":"#/components/schemas/ProxyServer"},"web_ui_listening_port":{"type":"string","nullable":true,"description":"Port the broker web UI listens on, or `null`."},"ntp_servers":{"type":"array","description":"Configured NTP servers.","items":{"type":"string"}},"internal_network_subnet":{"type":"string","description":"Broker internal subnet CIDR."},"auto_upgrade":{"$ref":"#/components/schemas/AutoUpgrade"},"monitoring":{"type":"boolean","description":"Whether monitoring metric collection is enabled."},"ssh_access":{"$ref":"#/components/schemas/SSHAccess"},"ssl_server_certificates":{"$ref":"#/components/schemas/SSLServerCertificates"},"trusted_ca_certificate":{"$ref":"#/components/schemas/TrustedCACertificate"},"apps":{"type":"array","description":"Currently configured applets and their per-applet status +\nmetrics. Inactive applets are omitted.\n","items":{"$ref":"#/components/schemas/BrokerApp"}}}},"ProxyServer":{"type":"object","nullable":true,"description":"Outbound proxy currently configured on the broker, or `null` when\nno proxy is set (`type` was `none`/`disabled`/empty).\n","required":["type"],"properties":{"type":{"type":"string","description":"Proxy protocol.","enum":["http","socks4","socks5"]},"address":{"type":"string","nullable":true},"port":{"type":"string","nullable":true},"username":{"type":"string","nullable":true}}},"AutoUpgrade":{"type":"object","description":"Auto-upgrade policy as returned by `getBrokers`.","required":["enabled"],"properties":{"enabled":{"type":"boolean"},"days_in_week":{"type":"array","nullable":true,"description":"Day names the window applies, when `enabled` and a specific\nwindow is configured.\n","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"schedule":{"type":"string","nullable":true,"enum":["any","specific"]},"schedule_from":{"type":"string","nullable":true,"description":"`HH:MM` start of window."},"schedule_to":{"type":"string","nullable":true,"description":"`HH:MM` end of window."},"timezone":{"type":"string","nullable":true}}},"SSHAccess":{"type":"object","description":"SSH access policy as returned by `getBrokers`.","required":["type"],"properties":{"type":{"type":"string","enum":["enabled","disabled"]},"welcome_message":{"type":"string","nullable":true},"ssh_public_keys":{"type":"array","nullable":true,"items":{"type":"string"}}}},"SSLServerCertificates":{"description":"Currently-installed SSL serving certificate, as returned by `getBrokers`. Both `server_certificate` and `private_key` are display-name references; raw PEM material is never returned.\n","type":"object","nullable":true,"required":["server_certificate","private_key"],"properties":{"server_certificate":{"$ref":"#/components/schemas/ServerCertificate"},"private_key":{"type":"string","description":"Display name of the private-key file."}}},"ServerCertificate":{"description":"Display-name reference to an installed SSL server certificate, including its `expires_on` ISO timestamp.\n","type":"object","required":["name","expires_on"],"properties":{"name":{"type":"string"},"expires_on":{"type":"string","description":"ISO 8601 UTC timestamp of certificate expiration."}}},"TrustedCACertificate":{"description":"Custom trusted CA certificate currently installed on the broker, as returned by `getBrokers`.\n","type":"object","nullable":true,"required":["name","expires_on"],"properties":{"name":{"type":"string"},"expires_on":{"type":"string","description":"ISO 8601 UTC timestamp of CA certificate expiration."}}},"BrokerApp":{"type":"object","description":"Per-applet entry within a broker's `apps` list.\n`name` is the applet display name (e.g., `WEC`, `CSV`,\n`Network Mapper`); `status` reflects the applet runtime state.\n\n**Note:** additional metric fields are injected dynamically by the\nbackend from each applet's own metrics class. They are not\nenumerated here because the set is open-ended per applet. Treat\nunknown fields as informational.\n","required":["name","status"],"properties":{"name":{"type":"string"},"status":{"type":"string","description":"Applet runtime status. Known values: `Connected`,\n`WARNING`, `ERROR`, `activating`, `deactivating`,\n`updating`.\n"},"errors":{"type":"array","description":"Present when `status` is `WARNING` or `ERROR` and the applet\nsurfaced one or more reason entries.\n","items":{"$ref":"#/components/schemas/AppError"}}},"additionalProperties":true},"AppError":{"description":"Per-applet error or warning entry surfaced under `BrokerApp.errors`.\n","type":"object","required":["classification","timestamp","message"],"properties":{"classification":{"type":"string","enum":["Error","Warning"]},"timestamp":{"type":"string","description":"ISO 8601 UTC timestamp."},"message":{"type":"string"}}}}}}
```

## The ProxyServer object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ProxyServer":{"type":"object","nullable":true,"description":"Outbound proxy currently configured on the broker, or `null` when\nno proxy is set (`type` was `none`/`disabled`/empty).\n","required":["type"],"properties":{"type":{"type":"string","description":"Proxy protocol.","enum":["http","socks4","socks5"]},"address":{"type":"string","nullable":true},"port":{"type":"string","nullable":true},"username":{"type":"string","nullable":true}}}}}}
```

## The AutoUpgrade object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"AutoUpgrade":{"type":"object","description":"Auto-upgrade policy as returned by `getBrokers`.","required":["enabled"],"properties":{"enabled":{"type":"boolean"},"days_in_week":{"type":"array","nullable":true,"description":"Day names the window applies, when `enabled` and a specific\nwindow is configured.\n","items":{"type":"string","enum":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"]}},"schedule":{"type":"string","nullable":true,"enum":["any","specific"]},"schedule_from":{"type":"string","nullable":true,"description":"`HH:MM` start of window."},"schedule_to":{"type":"string","nullable":true,"description":"`HH:MM` end of window."},"timezone":{"type":"string","nullable":true}}}}}}
```

## The SSHAccess object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SSHAccess":{"type":"object","description":"SSH access policy as returned by `getBrokers`.","required":["type"],"properties":{"type":{"type":"string","enum":["enabled","disabled"]},"welcome_message":{"type":"string","nullable":true},"ssh_public_keys":{"type":"array","nullable":true,"items":{"type":"string"}}}}}}}
```

## The ServerCertificate object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ServerCertificate":{"description":"Display-name reference to an installed SSL server certificate, including its `expires_on` ISO timestamp.\n","type":"object","required":["name","expires_on"],"properties":{"name":{"type":"string"},"expires_on":{"type":"string","description":"ISO 8601 UTC timestamp of certificate expiration."}}}}}}
```

## The SSLServerCertificates object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SSLServerCertificates":{"description":"Currently-installed SSL serving certificate, as returned by `getBrokers`. Both `server_certificate` and `private_key` are display-name references; raw PEM material is never returned.\n","type":"object","nullable":true,"required":["server_certificate","private_key"],"properties":{"server_certificate":{"$ref":"#/components/schemas/ServerCertificate"},"private_key":{"type":"string","description":"Display name of the private-key file."}}},"ServerCertificate":{"description":"Display-name reference to an installed SSL server certificate, including its `expires_on` ISO timestamp.\n","type":"object","required":["name","expires_on"],"properties":{"name":{"type":"string"},"expires_on":{"type":"string","description":"ISO 8601 UTC timestamp of certificate expiration."}}}}}}
```

## The TrustedCACertificate object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"TrustedCACertificate":{"description":"Custom trusted CA certificate currently installed on the broker, as returned by `getBrokers`.\n","type":"object","nullable":true,"required":["name","expires_on"],"properties":{"name":{"type":"string"},"expires_on":{"type":"string","description":"ISO 8601 UTC timestamp of CA certificate expiration."}}}}}}
```

## The AppError object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"AppError":{"description":"Per-applet error or warning entry surfaced under `BrokerApp.errors`.\n","type":"object","required":["classification","timestamp","message"],"properties":{"classification":{"type":"string","enum":["Error","Warning"]},"timestamp":{"type":"string","description":"ISO 8601 UTC timestamp."},"message":{"type":"string"}}}}}}
```

## The BrokerApp object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"BrokerApp":{"type":"object","description":"Per-applet entry within a broker's `apps` list.\n`name` is the applet display name (e.g., `WEC`, `CSV`,\n`Network Mapper`); `status` reflects the applet runtime state.\n\n**Note:** additional metric fields are injected dynamically by the\nbackend from each applet's own metrics class. They are not\nenumerated here because the set is open-ended per applet. Treat\nunknown fields as informational.\n","required":["name","status"],"properties":{"name":{"type":"string"},"status":{"type":"string","description":"Applet runtime status. Known values: `Connected`,\n`WARNING`, `ERROR`, `activating`, `deactivating`,\n`updating`.\n"},"errors":{"type":"array","description":"Present when `status` is `WARNING` or `ERROR` and the applet\nsurfaced one or more reason entries.\n","items":{"$ref":"#/components/schemas/AppError"}}},"additionalProperties":true},"AppError":{"description":"Per-applet error or warning entry surfaced under `BrokerApp.errors`.\n","type":"object","required":["classification","timestamp","message"],"properties":{"classification":{"type":"string","enum":["Error","Warning"]},"timestamp":{"type":"string","description":"ISO 8601 UTC timestamp."},"message":{"type":"string"}}}}}}
```

## The ActionStatusResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ActionStatusResponse":{"description":"Status payload returned by `getActionStatus`. The single `status` field reflects the current state of the asynchronous broker action.\n","type":"object","required":["status"],"properties":{"status":{"$ref":"#/components/schemas/BrokerActionStatus"}}},"BrokerActionStatus":{"type":"string","description":"Possible states of an asynchronous broker action.","enum":["SUBMITTED","IN_PROGRESS","COMPLETED","UP_TO_DATE","FAILED","NOT_AVAILABLE"]}}}}
```

## The DownloadImageRequest object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DownloadImageRequest":{"description":"Body for `downloadInstallImage`. The `type` selector picks the hypervisor image format.\n","type":"object","required":["type"],"additionalProperties":false,"properties":{"type":{"$ref":"#/components/schemas/ImageType"}}},"ImageType":{"type":"string","description":"Hypervisor format of a Broker VM install image.","enum":["OVA","QCOW2","VHD","VHD_AZURE","VMDK"]}}}}
```

## The ImageDownloadInfo object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"ImageDownloadInfo":{"description":"Payload returned by `downloadInstallImage`. The `download_url` is a short-lived signed URL for direct image download.\n","type":"object","required":["image_type","download_url","file_name"],"properties":{"image_type":{"$ref":"#/components/schemas/ImageType"},"download_url":{"type":"string","format":"uri","description":"Short-lived signed URL for direct image download."},"file_name":{"type":"string","description":"Suggested filename for the download."},"version":{"type":"string","nullable":true,"description":"Broker VM platform version embedded in the image."}}},"ImageType":{"type":"string","description":"Hypervisor format of a Broker VM install image.","enum":["OVA","QCOW2","VHD","VHD_AZURE","VMDK"]}}}}
```

## The LogBundleGenerateResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LogBundleGenerateResponse":{"description":"Payload returned by `generateLogBundle`. The `code` field discriminates between newly-enqueued (`LogRequestSubmitted`) and already-in-flight (`LogRequestAlreadyInProgress`).\n","type":"object","required":["code","status"],"properties":{"code":{"type":"string","enum":["LogRequestSubmitted","LogRequestAlreadyInProgress"],"description":"`LogRequestSubmitted` — a new bundle request was enqueued.\n`LogRequestAlreadyInProgress` — a prior request is still in\nflight and was not duplicated.\n"},"status":{"type":"boolean","description":"Always `true` for this endpoint; reserved for parity with the legacy log-status payload."}}}}}}
```

## The LogBundleStatusResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LogBundleStatusResponse":{"description":"Payload returned by `getLogBundleStatus`. The `code` field reflects the current state of the log bundle.\n","type":"object","required":["code","status","log_collection_time"],"properties":{"code":{"type":"string","enum":["LogRequestInProgress","LogRequestSucceeded","LogRequestTimedout","LogBundleCollectionInVMFailed"],"description":"Status of the most recent log-bundle request. See the\nendpoint description for the meaning of each value.\n"},"status":{"type":"boolean","description":"`true` only when the bundle is ready for download\n(`LogRequestSucceeded`); `false` for in-progress and all\nfailure states. Key off `code` rather than `status` to\ndistinguish in-progress from failure.\n"},"log_collection_time":{"type":"string","nullable":true,"description":"ISO 8601 UTC timestamp of when the broker finished\ncollecting the bundle. `null` when the bundle has not yet\ncompleted (or the request failed before completion).\n"}}}}}}
```

## The AppletName object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"AppletName":{"type":"string","description":"Closed set of supported PAPI applet identifiers. Each applet has\nits own request and response schema, keyed by this value.\n","enum":["syslog","kafka","db","ftp","file","csv","wec","netflow","network_mapper","local_agent_settings"]}}}}
```

## The AppletDeactivateRequest object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"AppletDeactivateRequest":{"type":"object","additionalProperties":false,"description":"Optional body for [`deactivateApplet`](#operation/deactivateApplet).\nThe body itself is optional; when absent or `save_config` is\nomitted, the broker preserves the applet's prior configuration so\na later `activate` without a body restores it.\n","properties":{"save_config":{"type":"boolean","default":true,"description":"`true` (default) — preserve the applet's current configuration\nfor later reactivation. `false` — drop the configuration; a\nsubsequent `activate` requires a full body.\n"}}}}}}
```

## The DownloadWefCertRequest object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DownloadWefCertRequest":{"description":"Body for `downloadWefCert`. The `password` (min 5 chars) is the PFX export password.\n","type":"object","additionalProperties":false,"required":["password"],"properties":{"password":{"type":"string","format":"password","minLength":5,"description":"Export password applied to the PFX archive returned to the\ncaller. The password protects the embedded private key on the\nwire; the customer-facing minimum length is 5 characters.\n"}}}}}}
```

## The CollectEvery object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The SyslogNetworkSetting object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}}}}}
```

## The SyslogDataSource object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SyslogDataSource":{"type":"object","additionalProperties":false,"required":["protocol","port"],"description":"A syslog data source — a (protocol, port) binding with one or\nmore `network_settings`. Cert material is required iff\n`protocol = \"secure_TCP\"`.\n","properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$","description":"Numeric string in `[1, 65535]`."},"network_settings":{"type":"array","minItems":1,"description":"At least one entry. Within a single data source, every\n`source_network` value must be unique.\n","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"server_cert":{"type":"string","description":"PEM-encoded server certificate (required for `secure_TCP`)."},"private_key":{"type":"string","format":"password","description":"PEM-encoded private key (required for `secure_TCP`)."},"ca_cert":{"type":"string","description":"PEM-encoded CA bundle (optional for `secure_TCP`)."},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Minimum TLS version (only meaningful for `secure_TCP`)."}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}}}}}
```

## The SyslogConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SyslogConfig":{"type":"object","additionalProperties":false,"required":["syslog_data_sources"],"description":"Request body for the `syslog` applet. Every\n`(protocol, port)` pair must be unique across\n`syslog_data_sources`.\n","properties":{"syslog_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SyslogDataSource"}}}},"SyslogDataSource":{"type":"object","additionalProperties":false,"required":["protocol","port"],"description":"A syslog data source — a (protocol, port) binding with one or\nmore `network_settings`. Cert material is required iff\n`protocol = \"secure_TCP\"`.\n","properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$","description":"Numeric string in `[1, 65535]`."},"network_settings":{"type":"array","minItems":1,"description":"At least one entry. Within a single data source, every\n`source_network` value must be unique.\n","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"server_cert":{"type":"string","description":"PEM-encoded server certificate (required for `secure_TCP`)."},"private_key":{"type":"string","format":"password","description":"PEM-encoded private key (required for `secure_TCP`)."},"ca_cert":{"type":"string","description":"PEM-encoded CA bundle (optional for `secure_TCP`)."},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Minimum TLS version (only meaningful for `secure_TCP`)."}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}}}}}
```

## The SyslogGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SyslogGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","syslog_data_sources"],"description":"GET-config response for the `syslog` applet. Cert payloads\n(`server_cert`, `private_key`, `ca_cert`) are write-only and are\nintentionally omitted; `min_tls_ver` is echoed for `secure_TCP`\nentries so a GET → unmodified PUT round-trip preserves the\nstored TLS floor.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["syslog"]},"syslog_data_sources":{"type":"array","description":"May be empty if the applet has been activated with no rows yet.","items":{"type":"object","additionalProperties":false,"required":["protocol","port","network_settings"],"properties":{"protocol":{"type":"string","enum":["udp","tcp","secure_TCP"]},"port":{"type":"string"},"network_settings":{"type":"array","items":{"$ref":"#/components/schemas/SyslogNetworkSetting"}},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"nullable":true}}}}}},"SyslogNetworkSetting":{"type":"object","additionalProperties":false,"description":"A single network-setting entry within a syslog data source — maps a\nsource network to a vendor/product/format triple. All four fields\nare optional; defaults realize the “autodetect” sentinels (`\"Any\"`\n/ `\"auto\"`).\n","properties":{"source_network":{"type":"string","default":"Any","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`). CIDR networks are\ncanonicalized (host bits cleared) so semantically equal inputs\ncollapse to a single key in the broker's internal mapping.\n"},"format":{"type":"string","enum":["auto","CEF","LEEF","CISCO","CORELIGHT","RAW"],"default":"auto"},"vendor":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."},"product":{"type":"string","default":"auto","description":"ASCII alphanumerics, hyphens, and underscores only."}}}}}}
```

## The KafkaTopicCollection object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}}}}}
```

## The KafkaConnection object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"KafkaConnection":{"description":"A single Kafka server connection within the `kafka` applet config. `ssl` requires `broker_cert` and `private_key`; `sasl` requires `username` and `password`.\n","type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string","description":"Comma-separated `host:port` Kafka bootstrap servers."},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true,"description":"Base64-encoded broker certificate (PEM). Required for `ssl`."},"private_key":{"type":"string","format":"password","nullable":true,"description":"Base64-encoded private key (PEM). Required for `ssl`."},"ca_cert":{"type":"string","nullable":true,"description":"Base64-encoded CA certificate (PEM). Optional."},"username":{"type":"string","nullable":true,"description":"SASL username (required for `sasl`)."},"password":{"type":"string","format":"password","nullable":true,"description":"SASL password (required for `sasl`)."},"topics_collection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}}}}}
```

## The KafkaConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"KafkaConfig":{"description":"Request body for the `kafka` applet — wraps a non-empty list of Kafka server connections.\n","type":"object","additionalProperties":false,"required":["kafka_connection"],"properties":{"kafka_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaConnection"}}}},"KafkaConnection":{"description":"A single Kafka server connection within the `kafka` applet config. `ssl` requires `broker_cert` and `private_key`; `sasl` requires `username` and `password`.\n","type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string","description":"Comma-separated `host:port` Kafka bootstrap servers."},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true,"description":"Base64-encoded broker certificate (PEM). Required for `ssl`."},"private_key":{"type":"string","format":"password","nullable":true,"description":"Base64-encoded private key (PEM). Required for `ssl`."},"ca_cert":{"type":"string","nullable":true,"description":"Base64-encoded CA certificate (PEM). Optional."},"username":{"type":"string","nullable":true,"description":"SASL username (required for `sasl`)."},"password":{"type":"string","format":"password","nullable":true,"description":"SASL password (required for `sasl`)."},"topics_collection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}}}}}
```

## The KafkaGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"KafkaGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","kafka_connection"],"description":"GET-config response for the `kafka` applet. `password` and\n`private_key` are write-only and are omitted from the response.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["kafka"]},"kafka_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["bootstrap_server_list","auth_method","topics_collection"],"properties":{"bootstrap_server_list":{"type":"string"},"auth_method":{"type":"string","enum":["noauth","ssl","sasl"]},"description":{"type":"string","default":""},"broker_cert":{"type":"string","nullable":true},"ca_cert":{"type":"string","nullable":true},"username":{"type":"string","nullable":true},"topics_collection":{"type":"array","items":{"$ref":"#/components/schemas/KafkaTopicCollection"}}}}}}},"KafkaTopicCollection":{"description":"One topic-collection entry within a Kafka connection — selects topics by list or regex and binds each to a `vendor`/`product` pair.\n","type":"object","additionalProperties":false,"required":["log_format","topics","vendor","product"],"properties":{"topic_subscription_method":{"type":"string","enum":["list_topics","REGEX"],"default":"list_topics","description":"Topic selection strategy. Note the intentional mixed casing:\n`list_topics` (lowercase) subscribes to an explicit topic list,\n`REGEX` (uppercase) subscribes by regex pattern. These are the\nexact wire values accepted on input and returned on output.\n"},"log_format":{"type":"string","enum":["JSON","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"topics":{"type":"string","description":"Topic list (when `topic_subscription_method=list_topics`) or\nregex pattern (when `topic_subscription_method=REGEX`).\nFree-form comma-separated string for the list variant.\n"},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string"},"product":{"type":"string"}}}}}}
```

## The DbQueryConf object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The DbServerEntry object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DbServerEntry":{"type":"object","additionalProperties":false,"required":["connection","host","port","username","password","database_query"],"description":"A single database connection. `database` is required for every\ndriver except `Oracle`, which uses `service_name` instead.\n","properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"],"description":"Database driver."},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true,"description":"Required (and `database` must be unset) when `connection=Oracle`."},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"password":{"type":"string","format":"password"},"database_query":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbQueryConf"}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The DbCollectorConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DbCollectorConfig":{"description":"Request body for the `db` applet — wraps a non-empty list of database server entries (`database_connection`).\n","type":"object","additionalProperties":false,"required":["database_connection"],"properties":{"database_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbServerEntry"}}}},"DbServerEntry":{"type":"object","additionalProperties":false,"required":["connection","host","port","username","password","database_query"],"description":"A single database connection. `database` is required for every\ndriver except `Oracle`, which uses `service_name` instead.\n","properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"],"description":"Database driver."},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true,"description":"Required (and `database` must be unset) when `connection=Oracle`."},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"password":{"type":"string","format":"password"},"database_query":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/DbQueryConf"}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The DbCollectorGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"DbCollectorGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","database_connection"],"description":"GET-config response for the `db` applet. `password` is write-only\nand is omitted from the response.\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["db"]},"database_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["connection","host","port","username"],"properties":{"connection":{"type":"string","enum":["MySQL","PostgreSQL","MSSQL","Oracle"]},"description":{"type":"string","default":""},"host":{"type":"string"},"port":{"type":"string"},"database":{"type":"string","nullable":true},"service_name":{"type":"string","nullable":true},"enable_ssl":{"type":"boolean","default":false},"username":{"type":"string"},"database_query":{"type":"array","items":{"$ref":"#/components/schemas/DbQueryConf"}}}}}}},"DbQueryConf":{"type":"object","additionalProperties":false,"required":["sql_query","collect_every"],"description":"A single database query within a `db` server entry. Fields are\nconditionally required by `storage_method`:\n- `append` (default) — requires `rising_column`,\n  `retrieval_value`, `vendor`, `product`; rejects `target_dataset`.\n- `replace` — requires `target_dataset`; rejects the four\n  append-only fields.\n","properties":{"sql_query":{"type":"string"},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"rising_column":{"type":"string","nullable":true},"retrieval_value":{"type":"string","nullable":true},"unique_ids":{"type":"string","nullable":true},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FtpSettings object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FtpConnection object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FtpConnection":{"description":"A single FTP / SFTP / FTPS server connection within the `ftp` applet config. SFTP servers may authenticate with either `password` or `private_key`.\n","type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"password":{"type":"string","format":"password","nullable":true,"description":"Required for `FTP` / `FTPS` and for `SFTP` when no\n`private_key` is provided.\n"},"private_key":{"type":"string","format":"password","nullable":true,"description":"PEM-encoded SSH private key (mutually exclusive with\n`password` for `SFTP`).\n"},"ftp_settings":{"oneOf":[{"$ref":"#/components/schemas/FtpSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpSettings"}}],"description":"Per-server scan settings. The wire accepts a single object\nor a one-element list — the backend normalizes either to a\nsingle-element list.\n"}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FtpConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FtpConfig":{"description":"Request body for the `ftp` applet — wraps a non-empty list of FTP / SFTP / FTPS server connections.\n","type":"object","additionalProperties":false,"required":["ftp_connection"],"properties":{"ftp_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpConnection"}}}},"FtpConnection":{"description":"A single FTP / SFTP / FTPS server connection within the `ftp` applet config. SFTP servers may authenticate with either `password` or `private_key`.\n","type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"password":{"type":"string","format":"password","nullable":true,"description":"Required for `FTP` / `FTPS` and for `SFTP` when no\n`private_key` is provided.\n"},"private_key":{"type":"string","format":"password","nullable":true,"description":"PEM-encoded SSH private key (mutually exclusive with\n`password` for `SFTP`).\n"},"ftp_settings":{"oneOf":[{"$ref":"#/components/schemas/FtpSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FtpSettings"}}],"description":"Per-server scan settings. The wire accepts a single object\nor a one-element list — the backend normalizes either to a\nsingle-element list.\n"}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FtpGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FtpGetConfigResponse":{"description":"GET-config response for the `ftp` applet. The `password` and `private_key` on each connection are omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","ftp_connection"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["ftp"]},"ftp_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["auth_method","host","port","folder_path","recursive","username","ftp_settings"],"properties":{"description":{"type":"string","default":""},"auth_method":{"type":"string","enum":["FTP","SFTP","FTPS"]},"host":{"type":"string"},"port":{"type":"string"},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"]},"username":{"type":"string"},"ftp_settings":{"type":"array","items":{"$ref":"#/components/schemas/FtpSettings"}}}}}}},"FtpSettings":{"type":"object","additionalProperties":false,"required":["collect_every","after_files_uploaded","include","log_format","vendor","product"],"description":"Per-server FTP scan settings (always batch mode for FTP).\n","properties":{"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Action to take after a file has been uploaded. When\n`rename`, `suffix` is required.\n"},"suffix":{"type":"string","nullable":true},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"oneOf":[{"type":"integer","minimum":0},{"type":"string","pattern":"^[0-9]+$"}],"default":0,"description":"Header lines to skip. Accepted as int or numeric string per\nthe request validator.\n"},"vendor":{"type":"string"},"product":{"type":"string"}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FileSettings object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The SharedFolderConnection object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"SharedFolderConnection":{"description":"A single shared-folder (CIFS/NFS) connection within the `file` applet config.\n","type":"object","additionalProperties":false,"required":["folder_path","recursive","username","password","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"password":{"type":"string","format":"password"},"file_settings":{"oneOf":[{"$ref":"#/components/schemas/FileSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FileSettings"}}]}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FileConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FileConfig":{"description":"Request body for the `file` (generic shared-folder Log Collector) applet — wraps a non-empty list of shared-folder connections.\n","type":"object","additionalProperties":false,"required":["shared_folder_connection"],"properties":{"shared_folder_connection":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/SharedFolderConnection"}}}},"SharedFolderConnection":{"description":"A single shared-folder (CIFS/NFS) connection within the `file` applet config.\n","type":"object","additionalProperties":false,"required":["folder_path","recursive","username","password","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"password":{"type":"string","format":"password"},"file_settings":{"oneOf":[{"$ref":"#/components/schemas/FileSettings"},{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/FileSettings"}}]}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The FileGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"FileGetConfigResponse":{"description":"GET-config response for the `file` applet. The `password` on each shared-folder connection is omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","shared_folder_connection"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["file"]},"shared_folder_connection":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["folder_path","recursive","username","file_settings"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean"},"username":{"type":"string"},"file_settings":{"type":"array","items":{"$ref":"#/components/schemas/FileSettings"}}}}}}},"FileSettings":{"type":"object","additionalProperties":false,"required":["mode","include","log_format"],"description":"Per-file scan configuration within a shared-folder entry of the\n`file` applet. `mode=tail` requires `vendor` and `product`;\n`mode=batch` requires `collect_every` and (when\n`after_files_uploaded=rename`) `suffix`.\n","properties":{"mode":{"type":"string","enum":["tail","batch"],"default":"tail"},"include":{"type":"string","description":"Glob (or comma-separated list) of files to include."},"exclude":{"type":"string","default":""},"log_format":{"type":"string","enum":["JSON","CSV","TSV","PSV","CEF","LEEF","CISCO","CORELIGHT","RAW"]},"num_lines_to_skip":{"type":"integer","minimum":0,"default":0},"consumer_group":{"type":"string","default":""},"vendor":{"type":"string","nullable":true},"product":{"type":"string","nullable":true},"collect_every":{"$ref":"#/components/schemas/CollectEvery"},"after_files_uploaded":{"type":"string","enum":["rename","delete"],"description":"Only meaningful when `mode=batch`."},"suffix":{"type":"string","nullable":true},"storage_method":{"type":"string","enum":["append","replace"],"default":"append"},"target_dataset":{"type":"string","nullable":true}}},"CollectEvery":{"type":"object","description":"Batch-mode collection schedule. `number` is a positive-integer\nstring; `units` selects the time unit.\n","required":["number","units"],"additionalProperties":false,"properties":{"number":{"type":"string","pattern":"^[1-9][0-9]*$","description":"Positive integer as a string (e.g., `\"15\"`)."},"units":{"type":"string","enum":["seconds","minutes","hours"]}}}}}}
```

## The MounterFolder object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"MounterFolder":{"type":"object","additionalProperties":false,"required":["folder_path"],"description":"A CIFS / NFS mount target. For CIFS / SMB shares both `username`\nand `password` are required (the masked sentinel `******` is\naccepted to round-trip a GET → modified PUT without re-supplying\nthe password). NFS shares may omit both.\n","properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"],"default":"no"},"username":{"type":"string","default":""},"password":{"type":"string","format":"password","default":""}}}}}}
```

## The MonitoredCsvFile object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}}}}}
```

## The CsvParameters object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"CsvParameters":{"description":"Inner container for the `csv` applet — joins mounter folders with the monitored CSV files that scan them.\n","type":"object","additionalProperties":false,"required":["mounter_folders","monitored_csv_files"],"properties":{"mounter_folders":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MounterFolder"}},"monitored_csv_files":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}},"MounterFolder":{"type":"object","additionalProperties":false,"required":["folder_path"],"description":"A CIFS / NFS mount target. For CIFS / SMB shares both `username`\nand `password` are required (the masked sentinel `******` is\naccepted to round-trip a GET → modified PUT without re-supplying\nthe password). NFS shares may omit both.\n","properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"],"default":"no"},"username":{"type":"string","default":""},"password":{"type":"string","format":"password","default":""}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}}}}}
```

## The CsvConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"CsvConfig":{"description":"Request body for the `csv` applet — wraps `csv_parameters` (mounter folders + monitored CSV files).\n","type":"object","additionalProperties":false,"required":["csv_parameters"],"properties":{"csv_parameters":{"$ref":"#/components/schemas/CsvParameters"}}},"CsvParameters":{"description":"Inner container for the `csv` applet — joins mounter folders with the monitored CSV files that scan them.\n","type":"object","additionalProperties":false,"required":["mounter_folders","monitored_csv_files"],"properties":{"mounter_folders":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MounterFolder"}},"monitored_csv_files":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}},"MounterFolder":{"type":"object","additionalProperties":false,"required":["folder_path"],"description":"A CIFS / NFS mount target. For CIFS / SMB shares both `username`\nand `password` are required (the masked sentinel `******` is\naccepted to round-trip a GET → modified PUT without re-supplying\nthe password). NFS shares may omit both.\n","properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"string","enum":["yes","no"],"default":"no"},"username":{"type":"string","default":""},"password":{"type":"string","format":"password","default":""}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}}}}}
```

## The CsvGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"CsvGetConfigResponse":{"description":"GET-config response for the `csv` applet. The `password` field on each mounter is omitted (write-only).\n","type":"object","additionalProperties":false,"required":["device_id","applet","csv_parameters"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["csv"]},"csv_parameters":{"type":"object","additionalProperties":false,"properties":{"mounter_folders":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["folder_path","username"],"properties":{"description":{"type":"string","default":""},"folder_path":{"type":"string"},"recursive":{"type":"boolean","default":false},"username":{"type":"string"}}}},"monitored_csv_files":{"type":"array","items":{"$ref":"#/components/schemas/MonitoredCsvFile"}}}}}},"MonitoredCsvFile":{"description":"A single monitored CSV file glob within the `csv` applet config. The `folder` field must reference one of `mounter_folders[].folder_path`.\n","type":"object","additionalProperties":false,"required":["folder","files","target_dataset"],"properties":{"folder":{"type":"string","description":"Must reference one of `mounter_folders[].folder_path`."},"files":{"type":"string","description":"Glob (or comma-separated list) of files to monitor."},"exclude":{"type":"string","default":""},"tags":{"type":"string","default":""},"target_dataset":{"type":"string"}}}}}}
```

## The WecCollectedEvent object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"WecCollectedEvent":{"description":"One Windows event subscription entry. `event_ids` is required when `event_ids_group` is `Included` or `Excluded`; must be absent when it's `All`.\n","type":"object","additionalProperties":false,"required":["source","min_event_level"],"properties":{"source":{"type":"string","description":"Windows event source name (e.g., `Security`, `Application`,\n`System`).\n"},"min_event_level":{"type":"string","enum":["Critical","Error","Warning","Information","Verbose"],"description":"Minimum event level to collect. `Informational` is accepted\nas an alias for `Information`.\n"},"event_ids_group":{"type":"string","enum":["All","Included","Excluded"],"default":"All"},"event_ids":{"type":"array","nullable":true,"description":"Required when `event_ids_group` is `Included` or `Excluded`;\nmust be omitted (or `null`) when `event_ids_group` is `All`.\nEntries are strings — individual event IDs (`\"4624\"`) or\nranges (`\"4778-4803\"`).\n","items":{"type":"string"}}}}}}}
```

## The WecConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"WecConfig":{"description":"Request body for the `wec` (Windows Event Collector) applet — wraps the TLS floor and the non-empty list of collected event subscriptions.\n","type":"object","additionalProperties":false,"required":["collected_events"],"properties":{"min_tls_ver":{"oneOf":[{"type":"boolean"},{"type":"string","enum":["1.0","1.2"]}],"default":true,"description":"TLS floor. Wire shape is **either** a boolean (`true` =\nTLS 1.2, `false` = TLS 1.0 — the internal representation) or\nthe spec string `\"1.0\"` / `\"1.2\"`. Both forms are accepted\non input; the GET response returns the string form.\n"},"collected_events":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/WecCollectedEvent"}}}},"WecCollectedEvent":{"description":"One Windows event subscription entry. `event_ids` is required when `event_ids_group` is `Included` or `Excluded`; must be absent when it's `All`.\n","type":"object","additionalProperties":false,"required":["source","min_event_level"],"properties":{"source":{"type":"string","description":"Windows event source name (e.g., `Security`, `Application`,\n`System`).\n"},"min_event_level":{"type":"string","enum":["Critical","Error","Warning","Information","Verbose"],"description":"Minimum event level to collect. `Informational` is accepted\nas an alias for `Information`.\n"},"event_ids_group":{"type":"string","enum":["All","Included","Excluded"],"default":"All"},"event_ids":{"type":"array","nullable":true,"description":"Required when `event_ids_group` is `Included` or `Excluded`;\nmust be omitted (or `null`) when `event_ids_group` is `All`.\nEntries are strings — individual event IDs (`\"4624\"`) or\nranges (`\"4778-4803\"`).\n","items":{"type":"string"}}}}}}}
```

## The WecGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"WecGetConfigResponse":{"description":"GET-config response for the `wec` applet. The `subscription_manager_url` is `null` until WEC certificate material has been generated on the broker.\n","type":"object","additionalProperties":false,"required":["device_id","applet","min_tls_ver","collected_events"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["wec"]},"subscription_manager_url":{"type":"string","nullable":true,"description":"URL Windows hosts use to subscribe to the broker's WEC\ncollector. Computed from the broker FQDN and CA certificate\nthumbprint. `null` until WEC certificate material has been\ngenerated on the broker.\n"},"min_tls_ver":{"type":"string","enum":["1.0","1.2"],"description":"Response form is always the string `\"1.0\"` or `\"1.2\"`."},"collected_events":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["source"],"properties":{"source":{"type":"string"},"min_event_level":{"type":"string","default":"Information"},"event_ids_group":{"type":"string","default":"All"},"event_ids":{"type":"array","nullable":true,"items":{"type":"string"}}}}}}}}}}
```

## The NetflowNetworkSetting object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}}}}}
```

## The NetflowDataSource object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}}}}}
```

## The NetflowConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetflowConfig":{"type":"object","additionalProperties":false,"required":["netflow_data_sources"],"description":"`UDP_port` values must be unique across `netflow_data_sources`.\n","properties":{"netflow_data_sources":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/NetflowDataSource"}}}},"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}}}}}
```

## The NetflowGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetflowGetConfigResponse":{"description":"GET-config response for the `netflow` applet.\n","type":"object","additionalProperties":false,"required":["device_id","applet","netflow_data_sources"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["netflow"]},"netflow_data_sources":{"type":"array","items":{"$ref":"#/components/schemas/NetflowDataSource"}}}},"NetflowDataSource":{"description":"A Netflow data source grouped by UDP port. Within a single port, every `source_network` must be unique.\n","type":"object","additionalProperties":false,"required":["UDP_port","network_settings"],"properties":{"UDP_port":{"type":"string","pattern":"^[1-9][0-9]{0,4}$"},"network_settings":{"type":"array","minItems":1,"description":"At least one entry; within a single UDP port,\n`source_network` values must be unique\n(post-normalization).\n","items":{"$ref":"#/components/schemas/NetflowNetworkSetting"}}}},"NetflowNetworkSetting":{"description":"A single network-setting entry within a Netflow data source — maps a `source_network` to a vendor/product pair.\n","type":"object","additionalProperties":false,"required":["source_network","vendor","product"],"properties":{"source_network":{"type":"string","description":"IPv4 address, IPv4 CIDR network, or the literal `\"Any\"`\n(case-insensitive, normalized to `\"Any\"`).\n"},"vendor":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"},"product":{"type":"string","description":"ASCII alphanumerics, spaces, hyphens, and underscores.\n"}}}}}}
```

## The NetworkMapperScanningScheduler object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetworkMapperScanningScheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"description":"Scanning scheduler — three discriminated cases driven by\n`method`. `daily` permits only `time`; `weekly` requires\n`day_of_week`; `monthly` requires both `day_of_week` and `week`.\n","properties":{"method":{"type":"string","enum":["daily","weekly","monthly"]},"time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}}}}}
```

## The NetworkMapperParameters object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetworkMapperParameters":{"description":"Single-scanner configuration for the `network_mapper` applet. `TCP_SYN` requires `ports`; `ICMP` rejects `ports`.\n","type":"object","additionalProperties":false,"required":["scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"],"default":"ICMP"},"scan_requests_per_second":{"oneOf":[{"type":"integer","minimum":1,"maximum":1000000},{"type":"string","pattern":"^[1-9][0-9]*$"}],"default":1000},"scanning_scheduler":{"$ref":"#/components/schemas/NetworkMapperScanningScheduler"},"scanned_ranges":{"type":"array","description":"List of IP-range names defined in the platform's IP Ranges.\nNames are resolved server-side. Must be unique within the list.\n","items":{"type":"string","minLength":1}},"ports":{"type":"string","nullable":true,"pattern":"^\\d{1,5}(-\\d{1,5})?(,\\d{1,5}(-\\d{1,5})?)*$","description":"Comma-separated ports / port-ranges (e.g., `\"22,80-81,8000\"`).\n**Required** when `scan_method=TCP_SYN`; **must not** be set\nwhen `scan_method=ICMP`.\n"}}},"NetworkMapperScanningScheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"description":"Scanning scheduler — three discriminated cases driven by\n`method`. `daily` permits only `time`; `weekly` requires\n`day_of_week`; `monthly` requires both `day_of_week` and `week`.\n","properties":{"method":{"type":"string","enum":["daily","weekly","monthly"]},"time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}}}}}
```

## The NetworkMapperConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetworkMapperConfig":{"description":"Request body for the `network_mapper` applet — wraps the single scanner configuration block.\n","type":"object","additionalProperties":false,"required":["network_mapper_parameters"],"properties":{"network_mapper_parameters":{"$ref":"#/components/schemas/NetworkMapperParameters"}}},"NetworkMapperParameters":{"description":"Single-scanner configuration for the `network_mapper` applet. `TCP_SYN` requires `ports`; `ICMP` rejects `ports`.\n","type":"object","additionalProperties":false,"required":["scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"],"default":"ICMP"},"scan_requests_per_second":{"oneOf":[{"type":"integer","minimum":1,"maximum":1000000},{"type":"string","pattern":"^[1-9][0-9]*$"}],"default":1000},"scanning_scheduler":{"$ref":"#/components/schemas/NetworkMapperScanningScheduler"},"scanned_ranges":{"type":"array","description":"List of IP-range names defined in the platform's IP Ranges.\nNames are resolved server-side. Must be unique within the list.\n","items":{"type":"string","minLength":1}},"ports":{"type":"string","nullable":true,"pattern":"^\\d{1,5}(-\\d{1,5})?(,\\d{1,5}(-\\d{1,5})?)*$","description":"Comma-separated ports / port-ranges (e.g., `\"22,80-81,8000\"`).\n**Required** when `scan_method=TCP_SYN`; **must not** be set\nwhen `scan_method=ICMP`.\n"}}},"NetworkMapperScanningScheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"description":"Scanning scheduler — three discriminated cases driven by\n`method`. `daily` permits only `time`; `weekly` requires\n`day_of_week`; `monthly` requires both `day_of_week` and `week`.\n","properties":{"method":{"type":"string","enum":["daily","weekly","monthly"]},"time":{"type":"string","pattern":"^([01]\\d|2[0-3]):[0-5]\\d$"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}}}}}
```

## The NetworkMapperGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"NetworkMapperGetConfigResponse":{"type":"object","additionalProperties":false,"required":["device_id","applet","network_mapper_parameters"],"description":"GET-config response for the `network_mapper` applet. The scheduler\n`method` is rendered in the user-friendly form\n(`Run daily` / `Run weekly` / `Run monthly`).\n","properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["network_mapper"]},"network_mapper_parameters":{"type":"object","additionalProperties":false,"required":["scan_method","scan_requests_per_second","scanning_scheduler"],"properties":{"scan_method":{"type":"string","enum":["ICMP","TCP_SYN"]},"scan_requests_per_second":{"type":"integer"},"scanning_scheduler":{"type":"object","additionalProperties":false,"required":["method","time"],"properties":{"method":{"type":"string","enum":["Run daily","Run weekly","Run monthly"]},"time":{"type":"string"},"day_of_week":{"type":"string","enum":["sun","mon","tue","wed","thu","fri","sat"],"nullable":true},"week":{"type":"string","enum":["1st","2nd","3rd","4th","last"],"nullable":true}}},"scanned_ranges":{"type":"array","items":{"type":"string"}},"ports":{"type":"string","nullable":true}}}}}}}}
```

## The LocalAgentProxy object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LocalAgentProxy":{"type":"object","additionalProperties":false,"required":["enabled"],"description":"Local-agent proxy sub-configuration. When `enabled=true`, `port`\nis required. When `enabled=false`, `port` and `listening_interface`\nmust be omitted (or left as defaults).\n","properties":{"enabled":{"type":"boolean"},"port":{"type":"string","default":"","description":"Numeric string in `[1, 65535]`. Empty when proxy disabled."},"listening_interface":{"type":"string","default":"all","description":"`\"all\"`, a valid IPv4/IPv6 address, or an interface name\n(letters, digits, `.`, `:`, `_`, `-`; up to 64 chars).\n"}}}}}}
```

## The LocalAgentSettingsConfig object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LocalAgentSettingsConfig":{"type":"object","additionalProperties":false,"description":"At least one of `proxy.enabled` or `caching` must be `true`,\notherwise the activation request is rejected.\n","properties":{"proxy":{"$ref":"#/components/schemas/LocalAgentProxy"},"caching":{"type":"boolean","default":false}}},"LocalAgentProxy":{"type":"object","additionalProperties":false,"required":["enabled"],"description":"Local-agent proxy sub-configuration. When `enabled=true`, `port`\nis required. When `enabled=false`, `port` and `listening_interface`\nmust be omitted (or left as defaults).\n","properties":{"enabled":{"type":"boolean"},"port":{"type":"string","default":"","description":"Numeric string in `[1, 65535]`. Empty when proxy disabled."},"listening_interface":{"type":"string","default":"all","description":"`\"all\"`, a valid IPv4/IPv6 address, or an interface name\n(letters, digits, `.`, `:`, `_`, `-`; up to 64 chars).\n"}}}}}}
```

## The LocalAgentSettingsGetConfigResponse object

```json
{"openapi":"3.0.3","info":{"title":"Cortex Broker Public API (tenant-side)","version":"1.0.0"},"components":{"schemas":{"LocalAgentSettingsGetConfigResponse":{"description":"GET-config response for the `local_agent_settings` applet.\n","type":"object","additionalProperties":false,"required":["device_id","applet","proxy","caching"],"properties":{"device_id":{"type":"string"},"applet":{"type":"string","enum":["local_agent_settings"]},"proxy":{"type":"object","additionalProperties":false,"required":["enabled","port"],"properties":{"enabled":{"type":"boolean"},"port":{"type":"string"},"listening_interface":{"type":"string","default":"all"}}},"caching":{"type":"boolean","default":false}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.