> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/script-execution.md).

# Script Execution

APIs executing script

## Run Snippet Code Script

> Initiate a new endpoint script execution action using provided snippet code. Cortex XDR supports sending your request in Base64.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/run_snippet_code_script":{"post":{"operationId":"postRunSnippetCodeScript","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Run Snippet Code Script","description":"Initiate a new endpoint script execution action using provided snippet code. Cortex XDR supports sending your request in Base64.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters","snippet_code"],"properties":{"filters":{"type":"array","description":"An array of filter fields for running the script on a number of endpoints at once.","items":{"type":"object","properties":{"field":{"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.","enum":["endpoint_id_list"]},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings"},"value":{"type":"array","description":"Value that this filter must match.","items":{"type":"string"}}},"required":["field","operator","value"]}},"timeout":{"type":"integer","description":"The timeout in seconds for this execution. Default value is 600.","default":600},"snippet_code":{"type":"string","description":"Section of a script you want to initiate on an endpoint."},"incident_id":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Run Snippet Code Script** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":" ID of the action initiated. ID will be used as a reference to track in the action center."},"endpoints_count":{"type":"integer","description":"Number of endpoints the action was initiated on."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Run Script

> Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/run_script":{"post":{"operationId":"postRunScript","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Run Script","description":"Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters","script_uid"],"properties":{"filters":{"type":"array","description":"Array of filter fields for running the script on a number of endpoints at once.","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.","enum":["endpoint_id_list"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings","enum":["in"],"default":"in"},"value":{"type":"array","description":"Value that this filter must match.","items":{"type":"string"}}},"required":["field","operator","value"]}},"script_uid":{"type":"string","description":"GUID, unique identifier of the script, returned by the [Get Scripts](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/script-execution#post-public_api-v1-scripts-get_scripts) API per script."},"parameters_values":{"type":"object","description":"Dictionary containing the parameter name, `key`, and its value for this execution, `value`.\n\nYou can obtain these values by running [Get Script Metadata](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/script-execution#post-public_api-v1-scripts-get_script_metadata) API.","properties":{"x":{"type":"string"},"y":{"type":"integer"}},"required":["x","y"]},"timeout":{"type":"integer","description":"Timeout in seconds for this execution. Default value is 600.","default":600},"incident_id":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Run Script** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"integer","description":"ID of the action initiated. ID will be used as a reference to track in the action center."},"endpoints_count":{"type":"integer","description":"Number of endpoints the action was initiated on."},"status":{"type":"integer","description":"Integer representing whether the action:\n- `1`: succeeded\n- `0`: failed"}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Script Metadata

> Get the full definitions of a specific script in the scripts library.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_script_metadata":{"post":{"operationId":"postGetScriptMetadata","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Script Metadata","description":"Get the full definitions of a specific script in the scripts library.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["script_uid"],"description":"A dictionary containing the API request fields.","properties":{"script_uid":{"type":"string","description":"Unique identifier of the script, returned by the [Get Scripts](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/script-execution#post-public_api-v1-scripts-get_scripts) API per script."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"script_id":{"type":"string","description":"Script ID."},"name":{"type":"string","description":"Name of script."},"description":{"type":"string","description":"Description of script."},"modification_date":{"type":"integer","description":"Timestamp of when the script was last modified."},"created_by":{"type":"string","description":"Name of the user who created the script."},"is_high_risk":{"type":"boolean","description":"Whether the script has a high-risk outcome."},"windows_supported":{"type":"boolean","description":"Whether the script can be executed on Windows OS."},"linux_supported":{"type":"boolean","description":"Whether the script can be executed on Linux OS."},"macos_supported":{"type":"boolean","description":"Whether the script can be executed on macOS."},"script_uid":{"type":"string","description":"GUID, global ID of the script, used toidentify the script when executing."},"entry_point":{"type":"string","description":"name of the entry point selected for the script defined as `run`."},"script_input":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"friendly_name":{"type":"string"}}}},"script_output_type":{"type":"string","description":"Type of output.","enum":["auto_detect","dictionary","number_list","number","string","string_list","boolean_list","ip","ip_list","boolean"]},"script_output_dictionary_definitions":{"type":"array","description":"When the `script_output_type` is a dictionary an array with `friendly_name`, `name`, and `type` for each output is returned.\nThe field is empty in all other cases.","items":{"type":"object","properties":{"friendly_name":{"type":"string"},"name":{"type":"string"},"type":{"type":"string"}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Scripts

> Get a list of scripts available in the scripts library.\
> \
> Required licence: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_scripts":{"post":{"operationId":"postGetScripts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Scripts","description":"Get a list of scripts available in the scripts library.\n\nRequired licence: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\nAn empty dictionary returns all results.","required":["filters"],"properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","description":"Identifies a list the filters match. Filters are based on the following keywords:\n- `name`: String of the script name.\n- `description`: String of the script description.\n- `created_by`: String of the user name of who created the script.\n- `script_uid`: GUID, global ID of the script, used to identify the script when executing.\n- `modification_date`: Timestamp of when the script was last modified.\n- `windows_supported`: Whether the script can be executed on Windows operating system.\n- `linux_supported`: Whether the script can be executed on Linux operating system.\n- `macos_supported`: Whether the script can be executed on Mac operating system.\n- `is_high_risk`: Whether the script has a high-risk outcome.","enum":["name","description","created_by","script_uid","modification_date","windows_supported","linux_supported","macos_supported","is_high_risk"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `name`, `description`, `created_by`, `script_uid`, `windows_supported`, `linux_supported`, `macos_supported`, `is_high_risk`: List of strings.\n`gte` / `lte`\n- `modification_date`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["array","boolean","integer"],"description":"Value that this filter must match.","items":{"type":"string"}}},"required":["field","operator","value"]}}}}},"required":["request_data"]}}},"description":"You can send a request to retrieve either **all** or **filtered** results."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging."},"result_count":{"type":"integer","description":"Number of scripts returned as result."},"scripts":{"type":"array","description":"An array of scripts.","items":{"type":"object","properties":{"script_id":{"type":"string","description":"Script ID."},"name":{"type":"string","description":"Name of script."},"description":{"type":"string","description":"Descrption of script."},"modification_date":{"type":"integer","description":"Timestamp of when the script was last modified."},"created_by":{"type":"string","description":"Name of the user who created the script."},"is_high_risk":{"type":"boolean","description":"Whether the script has a high-risk outcome."},"windows_supported":{"type":"boolean","description":"Whether the script can be executed on Windows OS."},"linux_supported":{"type":"boolean","description":"Whether the script can be executed on Linux OS."},"macos_supported":{"type":"boolean","description":"Whether the script can be executed on macOS."},"script_uid":{"type":"string","description":"GUID, global ID of the script, used to identify the script when executing."}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Script Execution Status

> Retrieve the status of a script execution action.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_script_execution_status":{"post":{"operationId":"postGetScriptExecutionStatus","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Script Execution Status","description":"Retrieve the status of a script execution action.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["action_id"],"description":"A dictionary containing the API request fields.","properties":{"action_id":{"type":"string","description":"Identifier of the action, can be found in Cortex XDR console **Response** > **Action Center** > **Action ID** field."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"general_status":{"type":"string","description":"General status of the action, considering the status of all the endpoints."},"endpoints_pending":{"type":"integer","description":"Number of endpoints in pending status."},"endpoints_canceled":{"type":"integer","description":"Number of endpoints in “canceled” status."},"endpoints_in_progress":{"type":"integer","description":"Number of endpoints in “in progress” status."},"endpoints_timeout":{"type":"integer","description":"Number of endpoints in “timeout” status."},"endpoints_failed":{"type":"integer","description":"Number of endpoints in “failed” status."},"endpoints_completed_successfully":{"type":"integer","description":"Number of endpoints in “completed successfully” status."},"endpoints_pending_abort":{"type":"integer","description":"Number of endpoints in “pending abort” status."},"endpoints_aborted":{"type":"integer","description":"Number of endpoints in “aborted” status."},"endpoints_expired":{"type":"integer","description":"Number of endpoints in “expired” status."},"error_message":{"type":"string","description":"Error message regarding permissions for running APIs or stating that the action doesn’t exist."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Script Execution Results

> Retrieve the results of a script execution action.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_script_execution_results":{"post":{"operationId":"postGetScriptExecutionResults","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Script Execution Results","description":"Retrieve the results of a script execution action.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["action_id"],"description":"A dictionary containing the API request fields.","properties":{"action_id":{"type":"string","description":"Action ID. This can be found in the Cortex XDR console **Response** > **Action Center** > **Action ID** field."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"script_name":{"type":"string","description":"Name of the script executed."},"script_description":{"type":"string","description":"Description of the script executed."},"script_parameters":{"type":"array","description":"For each input parameter used in this execution, an array of `name` and `value`.","items":{"type":"object"}},"date_created":{"type":"string","description":"Timestamp in which the action was initiated."},"scope":{"type":"string","description":"Number of endpoints included in this action according to the filter used to select them."},"error_message":{"type":"string","description":"Error message regarding permissions for running APIs."},"results":{"type":"array","description":"For each endpoint Cortex XDR displays any returned value by the script. The number of the results and their name are dynamic per script.","items":{"type":"object","properties":{"endpoint_name":{"type":"string","description":"Endpoint name."},"endpoint_ip_address":{"type":"array","description":"Endpoint IP address.","items":{"type":"string"}},"endpoint_status":{"type":"string","description":"Endpoint status."},"domain":{"type":"string","description":"Domain to which the endpoint belongs."},"endpoint_id":{"type":"string","description":"Endpoint ID."},"execution_status":{"type":"string","description":"Execution status of this endpoint."},"standard_output":{"description":"The STDOUT + STDERR logged by the script during this execution."},"retrieved_files":{"type":"integer","description":"Number of successfully retrieved files."},"failed_files":{"type":"integer","description":"Number of files failed to retrieve."},"retention_date":{"description":"Timestamp of when the retrieved files will be deleted from the server."}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Script Execution Result Files

> Get the files retrieved from a specific endpoint during a script execution.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_script_execution_results_files":{"post":{"operationId":"postGetScriptExecutionResultsFiles","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Script Execution Result Files","description":"Get the files retrieved from a specific endpoint during a script execution.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["action_id","endpoint_id"],"description":"A dictionary containing the API request fields.","properties":{"action_id":{"type":"string","description":"Identifier of the action, can be found in Cortex XDR console **Response** > **Action Center** > **Action ID** field."},"endpoint_id":{"type":"string","description":"Endpoint ID."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"data":{"type":"string","description":"A signed public link to a zip file containing the retrieved files. Link expires after 10 minutes."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Script Code

> Get the code of a specific script in the script library.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Script Execution","description":"APIs executing script"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/scripts/get_script_code":{"post":{"operationId":"postGetScriptCode","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Script Execution"],"summary":"Get Script Code","description":"Get the code of a specific script in the script library.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["script_uid"],"description":"A dictionary containing the API request fields.","properties":{"script_uid":{"type":"string","description":"Unique identifier of the script, returned by the [Get Scripts](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/script-execution#post-public_api-v1-scripts-get_scripts) API per script."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string","description":"JSON object containing the query result."}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/script-execution.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.