> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/endpoint-management.md).

# Endpoint Management

APIs for managing endpoints

## Get all Endpoints

> Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_endpoints":{"post":{"operationId":"postGetEndpoints","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get all Endpoints","description":"Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"agent_id":{"type":"string"},"agent_status":{"type":"string"},"operational_status":{"type":"string"},"host_name":{"type":"string"},"agent_type":{"type":"string"},"ip":{"type":"array","items":{"type":"string"}},"last_seen":{"type":"integer"},"tags":{"type":"object","properties":{"server_tags":{"type":"array","items":{"type":"object","properties":{}}},"endpoint_tags":{"type":"array","items":{"type":"object","properties":{}}}}},"users":{"type":"array","items":{"type":"string"}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Endpoint

> Gets a list of filtered endpoints.\
> \- The response is concatenated using AND condition (OR is not supported).\
> \- The maximum result set size is 100.\
> \- Offset is the zero-based number of endpoints from the start of the result set.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_endpoint":{"post":{"summary":"Get Endpoint","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Endpoint Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging."},"result_count":{"type":"integer","description":"Number of endpoints actually returned as result."},"endpoints":{"type":"array","description":"A list of endpoints.","items":{"type":"object","properties":{"endpoint_id":{"type":"string"},"endpoint_name":{"type":"string"},"endpointTags":{"type":"string"},"endpoint_type":{"type":"string"},"endpoint_status":{"type":"string"},"os_type":{"type":"string"},"os_version":{"type":"string"},"ip":{"type":"array","items":{"type":"string"}},"ipv6":{"type":"array","items":{"type":"object"}},"public_ip":{"type":"string"},"users":{"type":"array","items":{"type":"string"}},"domain":{"type":"string"},"alias":{"type":"string"},"first_seen":{"type":"integer"},"last_seen":{"type":"integer"},"content_version":{"type":"string"},"installation_package":{"type":"string"},"active_directory":{"nullable":true},"install_date":{"type":"integer"},"endpoint_version":{"type":"string"},"is_isolated":{"type":"string"},"isolated_date":{"nullable":true},"group_name":{"type":"array","items":{"type":"object"}},"operational_status":{"type":"string"},"operational_status_description":{"type":"string"},"scan_status":{"type":"string"},"content_release_timestamp":{"type":"integer"},"last_content_update_time":{"type":"integer"},"content_status":{"type":"string"},"operating_system":{"type":"string"},"mac_address":{"type":"array","items":{"type":"string"}},"assigned_prevention_policy":{"type":"string"},"assigned_extensions_policy":{"type":"string"}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-endpoints-get_endpoint","description":"Gets a list of filtered endpoints.\n- The response is concatenated using AND condition (OR is not supported).\n- The maximum result set size is 100.\n- Offset is the zero-based number of endpoints from the start of the result set.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\n\nAn empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"Identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `first_seen`: When the agent was first seen.\n- `last_seen`: When the agent was last seen.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Host name.\n- `public_ip_list`: Public IP addresses that correlate to the last IPv4 address from which the XDR agent connected (know as `Last Origin IP`).","enum":["endpoint_id_list","endpoint_status","dist_name","first_seen","last_seen","ip_list","group_name","platform","alias","isolate","hostname","public_ip_list"]},"operator":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `public_ip_list`: List of strings.\n- `endpoint_status`: `connected`, `disconnected`, `lost`, or `uninstalled`\n- `ip_list`: List of strings. For example: \"192.168.5.12\"\n- `platform`: `windows`, `linux`, `macos`, `android`\n- `isolate`: `isolated` or `unisolated`\n- `scan_status`: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`\n`gte` / `lte`\n- `first_seen` and `last_seen`: Timestamp epoch milliseconds.","enum":["in","gte","lte","eq"]},"value":{"type":["string","array"],"description":"Value that this filter must match. Valid keywords:\r\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `public_ip_list`: List of strings.\r\n- `endpoint_status`: String. Permitted values are: `connected`, `disconnected`, `lost`, or `uninstalled`\r\n- `ip_list`: List of strings.\r\n- `platform`: String. Permitted values are: `windows`, `linux`, `macos`, `android`.\r\n- `isolate`: String. Permitted values are: `isolated` or `unisolated`.\r\n- `scan_status`: String. Permitted values are: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\r\n- `first_seen` and `last_seen`: Integer. Timestamp epoch milliseconds.","items":{"type":"string"}}}}},"search_from":{"type":"integer","description":"Represents the start offset within the query result set from which you want endpoints returned.\n\nEndpoints are returned as a zero-based list. Any endpoint indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"Represents the end offset within the result set after which you do not want endpoints returned.\n\nEndpoint in the endpoint list that is indexed higher than this value is not returned in the final results set. Defaults to 100, which returns all endpoints to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["endpoint_id","first_seen","last_seen","scan_status"],"default":"first_seen","description":"Identifies the field you want to sort by. Case-sensitive."},"keyword":{"type":"string","enum":["ASC","DESC"],"default":"DESC","description":"Whether you want to sort in ascending (`ASC`) or descending (`DESC`) order. Case-sensitive."}}}}}}}}},"description":"You can send a request to retrieve either all or filtered results."}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Set an Endpoint Alias

> Set or modify an Alias field for your endpoints.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/update_agent_name":{"post":{"operationId":"postUpdateAgentName","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Set an Endpoint Alias","description":"Set or modify an Alias field for your endpoints.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Hostname","enum":["endpoint_id_list","endpoint_status","dist_name","ip_list","group_name","platform","alias","isolate","hostname"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings.\n- `endpoint_status`: Permitted values are `connected` or `disconnected`\n- `ip_list`: List of strings, for example 192.168.5.12.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["array","string"],"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `dist_name`, `hostname`, `alias`, `group_name`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected` or `disconnected`\n- `ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.","items":{"type":"string"}}},"required":["field","operator","value"]}},"alias":{"type":"string","description":"The alias name you want to set or modify.\n\nNote: If you send an empty field, the current alias name is deleted."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=The alias name was set or modified successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Policy

> Get the policy name for a specific endpoint.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_policy":{"post":{"operationId":"postGetPolicy","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get Policy","description":"Get the policy name for a specific endpoint.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID."}},"required":["endpoint_id"]}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"policy_name":{"type":"string","description":"Name of the policy allocated with the endpoint."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Delete Endpoints

> Delete selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.\
> \
> Note: Endpoints are deleted from the Cortex XDR app web interface, however they still exist in the database.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 1000.\
> \- Offset is the zero-based number of incidents from the start of the result set.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/delete":{"post":{"operationId":"postDelete","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Delete Endpoints","description":"Delete selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.\n\nNote: Endpoints are deleted from the Cortex XDR app web interface, however they still exist in the database.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 1000.\n- Offset is the zero-based number of incidents from the start of the result set.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs."},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings","enum":["in"]},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}},"required":["field","operator","value"]}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get endpoint security profiles

> Returns a list of endpoint security profiles of the requested type.\
> Optionally filters by a list of profile IDs.\
> \
> \*\*Required permission:\*\* \`profiles\_view\`\
> \
> \
> \*\*Notes\*\*: \
> \- File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.\
> \- \`is\_in\_user\_scope\` and \`at\_risk\` are removed from every profile object before the response is returned.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"},{"name":"Profiles","description":"APIs for managing profiles"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/get_profiles":{"post":{"summary":"Get endpoint security profiles","tags":["Endpoint Management","Profiles"],"responses":{"200":{"description":"OK. Profiles retrieved successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetProfilesResponse"}}}},"400":{"description":"Bad request. Possible causes:\n- `type` field is missing (`TypeIsMandatory`)\n- `type` value is not `prevention` or `extension` (`TypeNotSupported`)\n- `profile_ids` is provided but is not a list (`ProfileIDsMustBeAList`)\n- Any internal error during profile retrieval (`GeneralError`)\n","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"401":{"description":"Unauthorized – missing or invalid API-key headers","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"403":{"description":"Forbidden. Possible causes:\n\n- The API key does not have the `profiles_view` permission\n- The feature flag `ALPHAFEATURES_PUBLIC_API_GET_POLICIES` is disabled\n- The tenant is a secondary HA replica","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-equivalent error code"},"err_msg":{"type":"string","description":"Short error category string"},"err_extra":{"type":"string","description":"Human-readable detail explaining the specific error","nullable":true}}}}}}}},"500":{"description":"Internal Server Error"}},"operationId":"getProfiles","description":"Returns a list of endpoint security profiles of the requested type.\nOptionally filters by a list of profile IDs.\n\n**Required permission:** `profiles_view`\n\n\n**Notes**: \n- File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.\n- `is_in_user_scope` and `at_risk` are removed from every profile object before the response is returned.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetProfilesRequestData"}}}}}}}}},"components":{"schemas":{"GetProfilesResponse":{"title":"GetProfilesResponse","type":"object","description":"Successful response envelope","properties":{"reply":{"type":"array","description":"List of matching profile objects.","items":{"$ref":"#/components/schemas/ProfileObject"}}}},"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}},"GetProfilesRequestData":{"title":"GetProfilesRequestData","type":"object","description":"Parameters for the `get_profiles` call","required":["type"],"properties":{"type":{"type":"string","enum":["prevention","extension"],"description":"The category of profiles to retrieve.\n- `prevention` – standard endpoint prevention profiles managed by\n  `ProfilesService` (malware, exploit, restrictions, agent-settings,\n  exceptions, etc.)\n- `extension` – device-control and host-firewall profiles managed by\n  `DeviceControlProfilesService`\n"},"profile_ids":{"type":"array","description":"Optional list of profile IDs to filter by.\nWhen omitted or `null`, all profiles of the requested type are returned.\nWhen provided, only profiles whose `id` is in this list are returned.\nMust be a JSON array; passing a non-array value yields HTTP 400.\n","items":{"type":"integer","format":"int64","nullable":true}}}}}}}
```

## Get Legacy Exceptions Modules

> Get a list of supported legacy exception modules available in the tenant. Each module entry includes its \`module\_id\`, supported \`platforms\`, and the \`conditions\_definition\` schema that must be used when creating or editing a legacy exception rule for that module.\
> \
> \*\*Note\*\*: No request body required. Send an empty body.\ <br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/get_modules":{"post":{"summary":"Get Legacy Exceptions Modules","operationId":"get_legacy_exceptions_modules","tags":["Endpoint Management"],"description":"Get a list of supported legacy exception modules available in the tenant. Each module entry includes its `module_id`, supported `platforms`, and the `conditions_definition` schema that must be used when creating or editing a legacy exception rule for that module.\n\n**Note**: No request body required. Send an empty body.\n\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"description":"No request body required. Send an empty body."},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"module_id":{"type":"integer","description":"Unique numeric identifier for the module. Use as the `module` field in add/edit requests."},"pretty_name":{"type":"string","description":"Full display name including profile type category"},"title":{"type":"string","description":"Short title of the module."},"label":{"type":"string","description":"Label describing what the exception allow-lists (for example, \"Files / Folders in Allow List\")."},"profile_type":{"type":"string","description":"Category of the protection profile this module belongs to."},"platforms":{"type":"array","description":"List of platforms this module supports. Only use these platforms in add/edit requests for this module.","items":{"type":"string"}},"conditions_definition":{"type":"object","description":"Schema definition for the `conditions` object required when creating or editing a legacy exception rule for this module. Each key is a condition field name, and its value describes the expected schema and a human-readable description.","properties":{"remoteIpsWhitelist":{"type":"object","properties":{"schema":{"type":"object","properties":{"type":{"type":"string"},"items":{"type":"object","properties":{"type":{"type":"string"}}},"minItems":{"type":"integer"}}},"description":{"type":"string","description":"Human-readable description of the condition field."}}}}}}}}}}}}}}}}}}
```

## Fetch Legacy Exception Rules

> Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \- Retrieve all rules or filter by specific criteria\
> \- Sort results by any field in ascending or descending order\
> \- Paginate through large result sets\
> \- Get total count and filtered count of rules<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/fetch":{"post":{"summary":"Fetch Legacy Exception Rules","operationId":"get_legacy_exceptions","tags":["Endpoint Management"],"description":"Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n- Retrieve all rules or filter by specific criteria\n- Sort results by any field in ascending or descending order\n- Paginate through large result sets\n- Get total count and filtered count of rules\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetLegacyExceptionDataRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetPublicLegacyExceptionResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP error code."},"err_msg":{"type":"string","description":"High-level error message"},"err_extra":{"type":"string","description":"Detailed error information describing the specific validation failures."}}}}}}}}}}}},"components":{"schemas":{"GetLegacyExceptionDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters for fetching legacy exception rules.","required":["request_data"],"properties":{"request_data":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from).","minimum":1,"default":100},"sort":{"type":"object","description":"Defines sorting criteria for query results.","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Field name to sort by. For example, `id`, `rule_name`, `platform`, `modification_time`, `status`, and `user_email`."},"keyword":{"type":"string","description":"Determines the sort order.","enum":["asc","desc"]}}},"filters":{"type":"array","description":"List of filter conditions. Multiple filters are combined with AND logic.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. For example, `id`, `rule_name`, `platform`, `status`, `created_by`, `user_email`, `module` and `profile_ids`."},"operator":{"type":"string","description":"The comparison operator. Most fields support `eq` operator. The `module` and `profile_ids` fields support `in` operator."},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `ENABLED` or `DISABLED`\n* If the `field` is `platform`, the `value` can be a string such as `Windows`, `macOS`, or `Linux`","oneOf":[{"type":"string"},{"type":"integer"}]}}}}}}}},"GetPublicLegacyExceptionResponse":{"type":"object","title":"Get Legacy Exception Response","description":"A legacy exception record as returned by the fetch API.","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the legacy exception rule."},"rule_name":{"type":"string","description":"Name of the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception rule."},"conditions":{"type":"string","description":"Human-readable string representation of the exception conditions. This is a display string only."},"module":{"type":"integer","description":"Numeric ID of the protection module this exception applies to."},"module_name":{"type":"string","description":"Name of the protection module."},"description":{"type":"string","description":"Optional description of the exception rule."},"generating_alert_id":{"description":"ID of the alert that generated this exception, if applicable.","nullable":true},"created_by":{"type":"string","description":"Name of the user or API key that created the legacy exception rule. **Note**: API-created exception rules show as \"Public API - <key_id>\"."},"modification_time":{"type":"integer","description":"Unix timestamp in milliseconds of the last modification."},"user_email":{"type":"string","description":"Email of the user who created the exception. **Note**: API-created exceptions show `n/a`."},"status":{"type":"string","description":"Indicates the current status of the rule."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception is scoped to. Empty array `[]` indicates a GLOBAL scope exception.","items":{"type":"integer"}},"associated_targets":{"type":"array","description":"Describes the endpoint targeting scope of the exception.","items":{"type":"string"}},"is_in_user_scope":{"type":"boolean","description":"Whether the exception is within the current user's RBAC scope."}}}},"FILTER_COUNT":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"TOTAL_COUNT":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}}}}}
```

## Add Legacy Exception Rule

> Create a new legacy exception rule.\
> \
> \*\*Prerequisites:\*\*\
> \- Use \[Get Legacy Exceptions Modules]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-get\\_modules>) API to find available \`module\` IDs, supported \`platforms\`, and the required \`conditions\` structure.\
> \- Use \[Get endpoint security profiles]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-endpoints-get\\_profiles>) API to find existing profile IDs to pass as \`profile\_ids\`.\
> \- New profiles can be created via \`/public\_api/v1/profiles/prevention/add\`.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/add":{"post":{"summary":"Add Legacy Exception Rule","operationId":"add_legacy_exception","tags":["Endpoint Management"],"description":"Create a new legacy exception rule.\n\n**Prerequisites:**\n- Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) API to find available `module` IDs, supported `platforms`, and the required `conditions` structure.\n- Use [Get endpoint security profiles](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-endpoints-get_profiles) API to find existing profile IDs to pass as `profile_ids`.\n- New profiles can be created via `/public_api/v1/profiles/prevention/add`.","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/AddLegacyExceptionDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string","description":"The ID of the newly created legacy exception rule."}}}}}}}}}},"components":{"schemas":{"AddLegacyExceptionDataRequest":{"type":"object","description":"Request body for creating a legacy exception rule.","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule.","minLength":1,"maxLength":128},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint.","minimum":1},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [/public_api/v1/endpoints/get_profiles](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule.","nullable":true},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}
```

## Edit Legacy Exception Rule

> Update an existing legacy exception rule.\
> \
> \*\*Prerequisites:\*\*\
> \
> To get the required fields:\
> \- Use \[Get Legacy Exceptions Modules]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-get\\_modules>) API to retrieve existing exception details.\
> \- The \`id\` field in the fetch API response corresponds to \`exception\_id\` in this request.\
> \- The \`rule\_name\` field in the fetch API response corresponds to \`name\` in this request.\
> \- The \`scope\` field is not returned by the fetch API. Use \`"PROFILE"\` if \`profile\_ids\` is non-empty in the fetch response; use \`"GLOBAL"\` if \`profile\_ids\` is \`\[]\`.<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/edit":{"post":{"summary":"Edit Legacy Exception Rule","operationId":"edit_legacy_exception","tags":["Endpoint Management"],"description":"Update an existing legacy exception rule.\n\n**Prerequisites:**\n\nTo get the required fields:\n- Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) API to retrieve existing exception details.\n- The `id` field in the fetch API response corresponds to `exception_id` in this request.\n- The `rule_name` field in the fetch API response corresponds to `name` in this request.\n- The `scope` field is not returned by the fetch API. Use `\"PROFILE\"` if `profile_ids` is non-empty in the fetch response; use `\"GLOBAL\"` if `profile_ids` is `[]`.\n","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/EditLegacyExceptionDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string","description":"The ID of the edited legacy exception rule."}}}}}}}}}},"components":{"schemas":{"EditLegacyExceptionDataRequest":{"type":"object","description":"Request body for editing or updating an existing legacy exception rule.","required":["exception_id","update_data"],"properties":{"exception_id":{"type":"string","description":"The ID of the legacy exception to edit. Corresponds to the `id` field returned by the fetch API."},"update_data":{"type":"object","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [/public_api/v1/endpoints/get_profiles](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule."},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}}}
```

## Delete Legacy Exception Rules

> Deletes one or more legacy exception rules by their IDs.\
> \
> Use \[fetch]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-legacy\\_exceptions-fetch>) endpoint to retrieve the \`id\` values of the exceptions you want to delete.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/legacy_exceptions/delete":{"post":{"summary":"Delete Legacy Exception Rules","operationId":"delete_legacy_exceptions","tags":["Endpoint Management"],"description":"Deletes one or more legacy exception rules by their IDs.\n\nUse [fetch](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-fetch) endpoint to retrieve the `id` values of the exceptions you want to delete.","parameters":[{"name":"Authorization","in":"header","required":true,"description":"{api_key}","schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","required":true,"description":"{api_key_id}","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["exception_ids"],"properties":{"exception_ids":{"type":"array","description":"List of legacy exception IDs to delete. Corresponds to the `id` field returned by the [Fetch Legacy Exception Rules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-fetch) API.","minItems":1,"items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"integer","description":"The number of successfully deleted legacy exception rules."}}}}}}}}}}}
```

## Get Disable Injection and Prevention rules

> Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \- Retrieve all rules or filter by specific criteria\
> \- Sort results by any field in ascending or descending order\
> \- Paginate through large result sets\
> \- Get total count and filtered count of rules<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/fetch":{"post":{"summary":"Get Disable Injection and Prevention rules","description":"Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n- Retrieve all rules or filter by specific criteria\n- Sort results by any field in ascending or descending order\n- Paginate through large result sets\n- Get total count and filtered count of rules\n","operationId":"fetchDisableInjectionPreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetInjectionDataRequest"}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicGetInjectionDataResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"GetInjectionDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from)."},"sort":{"$ref":"#/components/schemas/SortingInjectionRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterInjectionRequest"}}}},"SortingInjectionRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."},"FilterInjectionRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`                \n"}}},"PublicGetInjectionDataResponse":{"type":"object","properties":{"reply":{"type":"object","description":"Container object for the response data and metadata","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisableInjectionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```

## Add Disable Injection and Prevention rule

> Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.\
> \
> This endpoint allows you to:\
> \- Define a new rule with a unique name and description\
> \- Specify the target platform (Windows, Linux, or macOS)\
> \- Set the process name and path to be protected\
> \- Configure expiration time\
> \- Apply the rule globally or to specific profiles<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/add":{"post":{"summary":"Add Disable Injection and Prevention rule","description":"Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.\n\nThis endpoint allows you to:\n- Define a new rule with a unique name and description\n- Specify the target platform (Windows, Linux, or macOS)\n- Set the process name and path to be protected\n- Configure expiration time\n- Apply the rule globally or to specific profiles\n","operationId":"addDisableInjectionPreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisableInjectionAddRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InjectionResponseString"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","required":true,"description":"{api_key_id}"}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisableInjectionAddRulePAPIRequest":{"type":"object","description":"Request schema for creating a new Disable Injection and Prevention rule. All required fields must be provided to successfully create a rule.","required":["rule_name","description","platform","process_name","path","hours_to_expiration","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":100,"description":"Unique name for the new rule. Must be between 1-100 characters and should be descriptive of the rule's purpose."},"description":{"type":"string","maxLength":500,"description":"Description explaining the purpose and context of this rule. Maximum 500 characters."},"platform":{"type":"string","enum":["windows","linux","macos"],"description":"Target operating system to which the rule applies. "},"process_name":{"type":"string","minLength":1,"maxLength":100,"description":"Name of the process executable to protect. Must match the exact process name (1-100 characters)."},"path":{"type":"string","minLength":1,"maxLength":1000,"description":"Full file system path to the process executable. Must be a valid path for the specified platform (1-1000 characters)."},"hours_to_expiration":{"type":"integer","enum":[24,48],"description":"Number of hours until the rule expires. After expiration, the rule will no longer be applied. For example, 24 hours."},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule should apply. \nRequired when `scope` is `profile`. Must be `null` or omitted when scope is `global`.","nullable":true,"items":{"type":"integer","default":96}},"scope":{"type":"string","enum":["global","profile"],"description":"Defines the application scope of the rule.\n- `global`: Rule applies to all endpoints all matching endpoints (by platform and agent version >= 7.9)\n- `profile`: Rule applies only to endpoints in the specified `profile_ids`"}}},"InjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Injection and Prevention Rule ID."}}}}}}
```

## Disable Disable Injection and Prevention Rules

> Disables one or more existing Disable Injection and Prevention rules by their IDs.\
> \
> This endpoint allows you to:\
> \- Disable multiple rules in a single request\
> \- Immediately stop rules from being applied        <br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_injection_prevention_rules/disable":{"post":{"summary":"Disable Disable Injection and Prevention Rules","description":"Disables one or more existing Disable Injection and Prevention rules by their IDs.\n\nThis endpoint allows you to:\n- Disable multiple rules in a single request\n- Immediately stop rules from being applied        \n","operationId":"disableDisableInjectionPreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisableInjectionDisableRulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisableInjectionResponseString"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisableInjectionDisableRulesPAPIRequest":{"type":"object","description":"Request schema for disabling one or more existing Disable Injection Prevention rules. Requires at least one valid rule ID.","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"Array of rule IDs to disable. Must contain at least one valid rule ID.","items":{"type":"string"}}}},"DisableInjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the success message."}}}}}}
```

## Get Disable Prevention Rules

> Returns a list of Disable Prevention rules based on filters, sorting, and pagination.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/fetch":{"post":{"summary":"Get Disable Prevention Rules","description":"Returns a list of Disable Prevention rules based on filters, sorting, and pagination.","operationId":"fetchDisablePreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/GetDataRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicGetDataResponse"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"GetDataRequest":{"type":"object","properties":{"search_from":{"type":"integer","default":0,"description":"Zero-based index of the first Disable Prevention rule to return. Used for pagination.","minimum":0},"search_to":{"type":"integer","minimum":1,"maximum":100,"default":100,"description":"Index number of Disable Prevention rules to return starting from `search_from`."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}},"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## Get Disable Prevention Modules

> Returns a list of available modules for a specific platform.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/get_modules":{"post":{"summary":"Get Disable Prevention Modules","description":"Returns a list of available modules for a specific platform.","operationId":"getDisablePreventionModules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionGetModulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseArrayModules"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisablePreventionGetModulesPAPIRequest":{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`."}}},"BaseResponseArrayModules":{"type":"object","properties":{"reply":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionModulePAPIObject"}}}},"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## Add Disable Prevention Rule

> Creates a new Disable Prevention rule.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/add":{"post":{"summary":"Add Disable Prevention Rule","description":"Creates a new Disable Prevention rule.","operationId":"addDisablePreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionAddRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisablePreventionAddRulePAPIRequest":{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}},"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## Edit Disable Prevention Rule

> Updates an existing Disable Prevention rule.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/edit":{"post":{"summary":"Edit Disable Prevention Rule","description":"Updates an existing Disable Prevention rule.","operationId":"editDisablePreventionRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionEditRulePAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","required":true,"description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisablePreventionEditRulePAPIRequest":{"allOf":[{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},{"type":"object","required":["rule_id"],"properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."}}}]},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}},"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## Delete Disable Prevention Rules

> Deletes one or more Disable Prevention rules based on the provided rule ID.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/disable_prevention/delete":{"post":{"summary":"Delete Disable Prevention Rules","description":"Deletes one or more Disable Prevention rules based on the provided rule ID.","operationId":"deleteDisablePreventionRules","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/DisablePreventionDeleteRulesPAPIRequest"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteResponseString"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"tags":["Endpoint Management"]}}},"components":{"schemas":{"DisablePreventionDeleteRulesPAPIRequest":{"type":"object","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"The unique identifier of the Disable Prevention rule.","items":{"type":"string"}}}},"DeleteResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the result of the API operation."}}}}}}
```

## Get Distribution version

> Get a list of all the agent versions to use for creating a distribution list.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_versions":{"post":{"operationId":"postGetVersions","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get Distribution version","description":"Get a list of all the agent versions to use for creating a distribution list.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"windows":{"type":"array","description":"List of Windows agent versions.","items":{"type":"string"}},"linux":{"type":"array","description":"List of Linux agent versions.","items":{"type":"string"}},"macos":{"type":"array","description":"List of Mac agent versions.","items":{"type":"string"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Create distributions

> Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the \[Get Distribution Status]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-distributions-get\\_status>) API.
> \\
>
> \
> \>Required license:&#x20;
> \
> \>
> \
> \>\*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/create":{"post":{"operationId":"postCreate","summary":"Create distributions","description":"Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the [Get Distribution Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-distributions-get_status) API.\r\n\r\n>Required license: \r\n>\r\n>**Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","package_type","agent_version","deployment_platform","default_namespace","run_on_master_node","run_on_all_nodes"],"properties":{"name":{"type":"string","description":"The name of the installation package."},"platform":{"type":"string","description":"The installation platform.","enum":["windows","linux","macos","android"]},"package_type":{"type":"string","description":"A string representing the type of package to create. Each JSON object must contain *one* of the following keywords:\n- `standalone`: Installation for a new agent. When using this, you must include the `platform` field with one of the following values: `windows`, `linux`, `macos`, `android`, `kubernetes`, `helm`.\n- `upgrade`: Upgrade of an agent from ESM. When using this, you must include the `agent_version` field with  one of the following values: `windows_version`, `linux_version`, or `macos_version`.\n- `caas_embedded`: Container-embedded XDR agent installation using the CaaS Generic Installer (Linux dockerfile-based deployment)."},"agent_version":{"type":"string","description":"Use `agent_version` when creating a standalone installer. The value should be the agent version number.\n"},"windows_version":{"type":"string","description":"Use `windows_version` when creating an upgrade package. The value is the relevant version number."},"linux_version":{"type":"string","description":"Use `linux_version` when creating an upgrade package. The value is the relevant version number."},"macos_version":{"type":"string","description":"Use `macos_version` when creating an upgrade package. The value is the relevant version number."},"deployment_platform":{"type":"string","description":"When the `package_type` is `kubernetes` or `helm`, use the `deployment_platform` to indicate the type of platform. Valid values include:\n- `standard`\n- `openshift`\n- `gcos`\n- `bottlerocket`\n- `gke_autopilot`"},"default_namespace":{"type":"string","description":"The default namespace"},"node_selector":{"type":"object","description":"The node selector in the following format:\n`\"node_selector\": {\"key\": \"val\"}'","additionalProperties":{}},"proxy":{"type":"array","items":{"type":"string"}},"cluster_name":{"type":"string","description":"Cluster name"},"run_on_master_node":{"type":"boolean","description":"Whether or not to run on the master node."},"run_on_all_nodes":{"type":"boolean","description":"Whether or not to run on all nodes."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"distribution_id":{"type":"string","description":"Installation package ID."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distribution status

> Check the status of the installation package.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_status":{"post":{"operationId":"postGetStatus","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get Distribution status","description":"Check the status of the installation package.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["distribution_id"],"properties":{"distribution_id":{"type":"string","description":"The installation package ID."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"status":{"type":"string","description":"The status of the installation package."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distribution URL

> Get the distribution URL for downloading the installation package.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_dist_url":{"post":{"operationId":"postGetDistUrl","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get Distribution URL","description":"Get the distribution URL for downloading the installation package.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["distribution_id","package_type"],"properties":{"distribution_id":{"type":"string","description":"Installation package ID."},"package_type":{"type":"string","description":"A string representing the type of installation package. Select *one* of the following valid keywords and values:\n- `upgrade`\nPackage type should match the distribution type or platform:\n- `sh`: x86_64 Linux SH installer\n- `rpm`: x86_64 Linux RPM installer\n- `deb`: x86_64 Linux DEB installer\n- `aarch64_sh`: aarch64 Linux SH installer\n- `aarch64_rpm`: aarch64 Linux RPM installer\n- `aarch64_deb`: aarch64 Linux DEB installer\n- `pkg`: Mac\n- `x86`: Windows\n- `x64`: Windows\n- `arm`: Windows ARM64"}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"distribution_url":{"type":"string","description":"URL for downloading the installation package."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Distributions

> Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.\
> \
> This endpoint allows you to:\
> \
> \- Retrieve existing agent installations or filter by specific criteria\
> \- Paginate through large result sets\
> \- Sort results by any field in ascending or descending order\
> \- Get total count and filtered count of agent installations\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/get_distributions":{"post":{"summary":"Get Distributions","description":"Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.\n\nThis endpoint allows you to:\n\n- Retrieve existing agent installations or filter by specific criteria\n- Paginate through large result sets\n- Sort results by any field in ascending or descending order\n- Get total count and filtered count of agent installations\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**\n","operationId":"get_distributions","tags":["Endpoint Management"],"requestBody":{"required":true,"description":"Request body containing pagination, sorting, and filtering criteria for agent distributions","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/GetDistributionDataRequest"}}}}}},"responses":{"200":{"description":"Successful response containing the list of distributions matching the criteria","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetDistributionDataResponse"}}}},"400":{"description":"Bad Request - Invalid request parameters or malformed JSON","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}},"500":{"description":"Internal Server Error - An unexpected error occurred on the server","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code returned by the API."},"err_msg":{"type":"string","description":"Human-readable summary of the error."},"err_extra":{"type":"string","description":"Detailed description of the error, including the cause and how to resolve it when applicable."}}}}}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","required":true,"name":"Authorization","description":"{api_key}"},{"schema":{"type":"string"},"in":"header","required":true,"name":"x-xdr-auth-id","description":"{api_key_id}"}]}}},"components":{"schemas":{"GetDistributionDataRequest":{"title":"GetDistributionDataRequest","type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","minimum":0,"default":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (`search_to` - `search_from`). The maximum allowed value is <=100. Requests exceeding this limit will return a 400 error.","minimum":1,"maximum":100,"default":100},"sort":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"description":"Determines the sort order.","enum":["asc","desc"]}}},"filters":{"type":"array","description":"Filter condition to apply to the query","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n","minLength":1},"operator":{"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` "}}}}}},"GetDistributionDataResponse":{"type":"object","description":"Response object containing the list of distributions and metadata","required":["reply"],"properties":{"reply":{"type":"object","description":"Container object for the response data","properties":{"data":{"type":"array","description":"Array of distribution objects matching the filter criteria","items":{"$ref":"#/components/schemas/Distribution"}},"filter_count":{"type":"integer","description":"Number of distributions returned in the current response after applying filters."},"total_count":{"type":"integer","description":"Total number of distributions available in the system without filters."}}}}},"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## Delete agent installation packages

> Delete an agent installation package. The distribution ID is required and can be found in the \[Create distributions]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public\\_api-v1-distributions-create>) API response or in the \*\*Agent Installations\*\* screen in the Cortex Console.\
> \
> \> \*\*Note:\*\*\
> \> Once you delete an installation package, it prevents new agents using the package, including VDI, from registering. \
> \
> \>\*\*Required license:\*\* \
> \>\
> \>Cortex XDR Prevent or Cortex XDR Pro per Endpoint

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/distributions/delete":{"post":{"summary":"Delete agent installation packages","tags":["Endpoint Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"boolean","description":"Whether the deletion was successful."}}}}}}},"operationId":"post-public_api-v1-distributions-delete","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"distribution_id":{"type":"string","description":"Installation package distribution ID."}}}}}}}},"description":"Delete an agent installation package. The distribution ID is required and can be found in the [Create distributions](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-distributions-create) API response or in the **Agent Installations** screen in the Cortex Console.\n\n> **Note:**\n> Once you delete an installation package, it prevents new agents using the package, including VDI, from registering. \n\n>**Required license:** \n>\n>Cortex XDR Prevent or Cortex XDR Pro per Endpoint"}}}}
```

## Get Violations

> Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 100.\
> \- Offset is the zero-based number of incidents from the start of the result set.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/device_control/get_violations":{"post":{"operationId":"postGetViolations","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Get Violations","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"An empty object returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies the violation field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `type`: Type of violation.\n- `timestamp`: Timestamp of the violation.\n- `ip_list`: List of IP addresses.\n- `vendor`: Name of vendor.\n- `vendor_id`: Vendor ID.\n- `product`: Name of product.\n- `product_id`: Product ID.\n- `serial`: Serial number.\n- `hostname`: Hostname.\n- `violation_id_list`: List of violation IDs.\n- `username`: Username.","enum":["endpoint_id_list","type","timestamp","ip_list","vendor","vendor_id","product","product_id","serial","hostname","violation_id_list","username"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords are:\n`in`\n— Permitted for all fields except `timestamp`.\n`gte` / `lte`\n— Permitted only for `timestamp`.","enum":["in","gte","lte"]},"value":{"type":["array","integer","string"],"description":"Value that this filter must match. The contents of this field will differ depending on the violation field that you specified for this filter:\n- `timestamp`: Integer, in UTC timezone epoch milliseconds\n- `violation_id_list`: List of integers\n- `ip_list`: Must contain an IP string\n- `type`: Must be either `cd-rom`, `disk drive`, `floppy disk`, `portable device`\n- All other fields need to be list of strings.","items":{"type":["integer","string"]}}},"required":["field","operator","value"]}},"search_from":{"type":"integer","description":"Integer representing the starting offset within the query result set from which you want violations returned.\nViolations are returned as a zero-based list. Any violation indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"An integer representing the end of offset within the result set after which you do not want violations returned.\nViolations in the violation list that are indexed higher than this value are not returned in the final results set. Defaults to zero, which returns all alerts to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["endpoint_id_list","type","timestamp","ip_list","vendor","vendor_id","product","product_id","serial","hostname","violation_id_list","username"],"description":"The field you want to sort by."},"value":{"type":"string","description":"Can be either `asc` (ascending) or `desc` (descending).","enum":["asc","desc"],"default":"desc"}},"required":["field","value"]}}}}}}},"description":"You can send a request to retrieve either *all* or *filtered* results."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging."},"result_count":{"type":"integer","description":"Number of alerts actually returned as a result."},"violations":{"type":"array","items":{"$ref":"#/components/schemas/violation"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"description":"Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of incidents from the start of the result set.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","tags":["Endpoint Management"]}}},"components":{"schemas":{"violation":{"title":"violation","type":"object","properties":{"hostname":{"type":"string"},"username":{"type":"string"},"ip":{"type":"string"},"timestamp":{"type":"integer"},"violation_id":{"type":"integer"},"type":{"type":"string"},"vendor_id":{"type":"string"},"vendor":{"type":"string"},"product_id":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"},"endpoint_id":{"type":"string"}}},"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Assign Tags

> Assign one or more tags to one or more endpoints.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/assign":{"post":{"operationId":"postAssign","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Assign Tags","description":"Assign one or more tags to one or more endpoints.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `last_seen`: When an endpoint was last seen.\n- `first_seen`: When an endpoint was first seen.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `hostname`: Hostname.\n- `isolate`: If the endpoint was isolated.\n- `username`: Name of user.\n- `scan_status`: Status of the scan.\n- `group_name`: Group name the agent belongs to.\n- `endpoint_status`: Status of the endpoint ID.\n- `operational_status`: Operational status.\n- `public_ip_list`: List of public IP addresses.","enum":["endpoint_id_list","endpoint_status","dist_name","ip_list","group_name","platform","alias","isolate","hostname"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `operational_status`: List of strings.\n- `endpoint_status`: Permitted values are `connected`, `lost`, `disconnected`, `uninstalled`.\n- `ip_list`, `public_ip_list`: List of strings, for example \"192.168.5.12\".\n- `platform`: Permitted values are `windows`, `linux`, `macos`, `android`, `ios`.\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n- `operational_status`: Permitted values are `protected`, `partially_protected`, `unprotected`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["array","string","integer"],"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`, `operational_status`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected`, `disconnected`, `lost`, or `uninstalled`.\n- `operational_status`: Must contain only the following valid values: `protected`, `partially_protected`, `unprotected`.\n- `ip_list`, `public_ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, `android`, or `ios`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.\n- `scan_status`: Must contain only the following valid values: `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","items":{"type":"string"}}},"required":["field","operator","value"]}},"tag":{"type":"string","description":"The tag you want to assign."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=The tag name was assigned successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"x  Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Create Tag

> Create a new agent tag in the \`endpoint\_tags\` family.\
> \
> The tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, \`\*\`). If a tag with the same name already exists, the request fails with a 409 error.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/create":{"post":{"operationId":"postCreateTag","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Create Tag","description":"Create a new agent tag in the `endpoint_tags` family.\n\nThe tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, `*`). If a tag with the same name already exists, the request fails with a 409 error.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"tag":{"type":"string","maxLength":64,"description":"The name of the tag to create. Maximum 64 characters. Wildcard characters (for example, `*`) are not allowed."}},"required":["tag"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"string","description":"Confirmation message, for example: \"Successfully created a new tag - my-tag\"."}}}},"400":{"description":"Bad Request. The tag is missing, not a string, exceeds 64 characters, or contains invalid characters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"409":{"description":"Conflict. A tag with the same name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Remove Tags

> Remove one or more tags from one or more endpoints.\
> \
> Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/remove":{"post":{"operationId":"postRemove","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"summary":"Remove Tags","description":"Remove one or more tags from one or more endpoints.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the following API request fields.","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies the field the filter is matching. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `endpoint_status`: Status of the endpoint ID.\n- `dist_name`: Distribution / Installation Package name.\n- `ip_list`: List of IP addresses.\n- `group_name`: Group name the agent belongs to.\n- `platform`: Platform name.\n- `alias`: Alias name.\n- `isolate`: If the endpoint was isolated.\n- `hostname`: Hostname","enum":["endpoint_id_list","endpoint_status","dist_name","ip_list","group_name","platform","alias","isolate","hostname"]},"operator":{"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings.\n- `endpoint_status`: Permitted values are `connected` or `disconnected`.\n- `ip_list`: List of strings, for example 192.168.5.12.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`.\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["array","string","integer"],"description":"Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:\n- `endpoint_id_list`, `distribution_name`, `hostname`, `alias`, `group_name`: List of strings.\n- `endpoint_status`: Must contain only the following valid values: `connected` or `disconnected`\n- `ip_list`: String list of IP addresses.\n- `platform`: Must contain only the following valid values: `windows`, `linux`, `macos`, or `android`.\n- `isolate`: Must contain only the following valid values: `isolated` or `unisolated`.","items":{"type":"string"}}},"required":["field","operator","value"]}},"tag":{"type":"string","description":"The tag you want to remove."}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=tag name removed successfully."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Endpoint Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Add Prevention Profile

> Create a new prevention profile with specified configuration.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/add":{"post":{"summary":"Add Prevention Profile","description":"Create a new prevention profile with specified configuration.","operationId":"add_prevention_profile","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["name","profile_type","platform","modules"],"properties":{"name":{"type":"string","minLength":1,"maxLength":600,"description":"Name of the profile."},"profile_type":{"type":"string","description":"Type of the prevention profile."},"platform":{"type":"string","description":"Platform (OS) for the profile."},"description":{"type":"string","nullable":true,"description":"Optional description of the profile."},"modules":{"type":"object","description":"Configuration modules for the profile.","additionalProperties":{"type":"object"}}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"integer","description":"The ID of the newly created profile."}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Add Signer CN to Allowlist

> Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/add_signer_cn_to_allowlist":{"post":{"summary":"Add Signer CN to Allowlist","description":"Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.","operationId":"add_signer_cn_to_allowlist","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_name","signers"],"properties":{"profile_name":{"type":"string","maxLength":600,"description":"The name of the Windows malware prevention profile. Cannot be 'Default'."},"signers":{"oneOf":[{"type":"string","maxLength":600},{"type":"array","items":{"type":"string","maxLength":600},"maxItems":1000}],"description":"A single signer CN string or a list of signer CN strings to add. Total signers cap is 1000."}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","nullable":true}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Edit Prevention Profile

> Update an existing prevention profile with new configuration. At least one field in update\_data (name, description, or modules) must be provided. \
> \
> Note: Default profiles cannot be edited.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/edit":{"post":{"summary":"Edit Prevention Profile","description":"Update an existing prevention profile with new configuration. At least one field in update_data (name, description, or modules) must be provided. \n\nNote: Default profiles cannot be edited.","operationId":"edit_prevention_profile","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_id","update_data"],"properties":{"profile_id":{"type":"integer","description":"The ID of the profile to edit."},"update_data":{"type":"object","minProperties":1,"properties":{"name":{"type":"string","minLength":1,"maxLength":600,"nullable":true},"description":{"type":"string","nullable":true},"modules":{"type":"object","nullable":true,"additionalProperties":{"type":"object"},"description":"Updated configuration modules for the profile."}}}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"boolean","description":"True if the profile was successfully updated."}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Get Prevention Profile Modules

> Get a list of modules for a specific prevention profile type and platform.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/profiles/prevention/get_modules":{"post":{"summary":"Get Prevention Profile Modules","description":"Get a list of modules for a specific prevention profile type and platform.","operationId":"get_prevention_modules","tags":["Endpoint Management"],"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["profile_type","platform"],"properties":{"profile_type":{"type":"string","description":"The type of prevention profile."},"platform":{"type":"string","description":"The platform (OS) for the profile."}},"additionalProperties":false}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","description":"Module definition object."}}}}}}},"400":{"description":"Bad Request. Invalid Input."},"401":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal Server Error."}}}}}}
```

## Delete Tags Permanently

> Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.\
> \
> \*\*Required role:\*\* Admin\
> \
> \*\*Required license:\*\* Cortex XDR.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Endpoint Management","description":"APIs for managing endpoints"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/tags/agents/delete_permanently":{"post":{"tags":["Endpoint Management"],"summary":"Delete Tags Permanently","operationId":"postDeletePermanently","description":"Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.\n\n**Required role:** Admin\n\n**Required license:** Cortex XDR.","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["tags"],"properties":{"tags":{"type":"array","description":"List of tag names to permanently delete from the system.","maxItems":10,"items":{"type":"string"}},"reason":{"type":"string","description":"Reason for deleting the tags.","minLength":20,"maxLength":200}}}}}}}},"responses":{"200":{"description":"Successful response — tags were permanently deleted from the system.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"message":{"type":"string","description":"Success message confirming the tags were deleted."}}}}}}}},"400":{"description":"Bad Request. The request failed validation or the specified tags could not be deleted.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string","description":"Error message describing why the tags could not be deleted."},"err_extra":{"type":"string","description":"Additional error context."}}}}}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/endpoint-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.