> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/system-management.md).

# System Management

APIs for system management

## System Health Check

> Perform a health check of your Cortex XDR environment.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/healthcheck":{"get":{"summary":"System Health Check","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"operationId":"getHealthcheck","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","description":"The condition of your Cortex environment."}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"description":"Perform a health check of your Cortex XDR environment.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","tags":["System Management"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Tenant Info

> Get your tenant license information.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/system/get_tenant_info":{"post":{"summary":"Get Tenant Info","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"operationId":"getTenantInfo","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"List of available licenses, number of devices, and purchased add-ons on your tenant.","properties":{"pro_per_endpoint_expiration":{"type":"integer"},"purchased_pro_per_endpoint":{"type":"object","properties":{"agents":{"type":"integer"}}},"data_enabled_pro_per_endpoint":{"type":"integer"},"prevent_expiration":{"type":"integer"},"purchased_prevent":{"type":"integer"},"installed_prevent":{"type":"integer"},"pro_tb_expiration":{"type":"integer"},"purchased_pro_gb":{"type":"object","properties":{"gb":{"type":"integer"}}},"installed_pro_gb":{"type":"integer"},"compute_unit_expiration":{"type":"integer"},"purchased_compute_unit":{"type":"integer"},"host_insights_expiration":{"type":"integer"},"enabled_host_insights":{"type":"integer"},"purchased_host_insights":{"type":"integer"},"forensics_expiration":{"type":"integer"},"enabled_forensics":{"type":"integer"},"pro_cloud_expiration":{"type":"integer"},"purchased_pro_cloud":{"type":"object","properties":{"agents":{"type":"integer"}}},"installed_pro_cloud":{"type":"integer"},"data_enabled_pro_cloud":{"type":"integer"},"identity_threat_expiration":{"type":"integer"},"xth_expiration":{"type":"integer"},"purchased_xth":{"type":"integer"},"xdr_ep_hot_expiration":{"type":"string"},"purchased_xdr_ep_hot":{"type":"integer"},"xdr_ep_cold_expiration":{"type":"string"},"purchased_xdr_ep_cold":{"type":"integer"},"xdr_gb_hot_expiration":{"type":"string"},"purchased_xdr_gb_hot":{"type":"integer"},"xdr_gb_cold_expiration":{"type":"string"},"purchased_xdr_gb_cold":{"type":"integer"}}}}}}}}},"description":"Get your tenant license information.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{}}}}}}},"tags":["System Management"]}}}}
```

## Get Users

> Retrieve a list of the current users in your environment.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\*, \*\*Cortex XDR Pro\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/rbac/get_users":{"post":{"summary":"Get Users","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","description":"JSON object containing the query result.","items":{"type":"object","properties":{"user_email":{"type":"string","description":"Email address of the user."},"user_first_name":{"type":"string","description":"First name of the user."},"user_last_name":{"type":"string","description":"Last name of the user."},"role_name":{"type":"string","description":"Role name associated with the user."},"last_logged_in":{"type":"integer","description":"Timestamp of when the user last logged in.","nullable":true},"user_type":{"type":"string","description":"Type of user."},"groups":{"type":"array","description":"Name of user groups associated with the user, if applicable.","items":{"type":"object"}},"scope":{"type":"array","description":"Name of scope associated with the user, if applicable.","items":{"type":"object"}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-rbac-get_users","description":"Retrieve a list of the current users in your environment.\n\nRequired license: **Cortex XDR Pro per Endpoint**, **Cortex XDR Pro**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Roles

> Retrieve information about one or more roles created in your environment.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\*, \*\*Cortex XDR Pro\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/rbac/get_roles":{"post":{"summary":"Get Roles","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","description":"JSON object containing the query result.","items":{"type":"object","properties":{"pretty_name":{"type":"string","description":"Name of the role as it appears in the Management Console."},"permissions":{"type":"array","description":"List of permissions associated with this role.","items":{"type":"string"}},"insert_time":{"type":"integer","description":"Timestamp of when the Role was created."},"update_time":{"type":"integer","description":"Timestamp of when the Role was last updated."},"created_by":{"type":"string","description":"Email of the user who created the Role."},"description":{"type":"string","description":"Description of the Role, if available."},"groups":{"type":"array","description":"Group names associated with the Role.","items":{"type":"string"}},"users":{"type":"array","description":"Email address of users associated with the Role.","items":{"type":"string"}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.equired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-rbac-get_roles","description":"Retrieve information about one or more roles created in your environment.\n\nRequired license: **Cortex XDR Pro per Endpoint**, **Cortex XDR Pro**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"role_names":{"type":"array","description":"List of one or more role names in your environment for which you want detailed information.","items":{"type":"string"}}}}},"required":["request_data"]}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get User Groups

> Retrieve a list of the current user emails associated with one or more user groups in your environment.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\*, \*\*Cortex XDR Pro\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/rbac/get_user_group":{"post":{"summary":"Get User Groups","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","description":"JSON object containing the query result.","items":{"type":"object","properties":{"group_name":{"type":"string","description":"Name of the User Group."},"description":{"description":"Description of the User Group, if available.","nullable":true},"pretty_name":{"type":"string","description":"Name of the User Group as it appears in the Management Console."},"insert_time":{"type":"integer","description":"Timestamp of when the User Group was created."},"update_time":{"type":"integer","description":"Timestamp of when the User Group was last updated."},"user_email":{"type":"array","description":"List of email addresses belonging to the users associated with the User Group.","items":{"type":"string"}},"source":{"type":"string","description":"Type of User Group."}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-rbac-get_user_group","description":"Retrieve a list of the current user emails associated with one or more user groups in your environment.\n\nRequired license: **Cortex XDR Pro per Endpoint**, **Cortex XDR Pro**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"group_names":{"type":"array","description":"List of one or more user group names for which you want the associated users.","items":{"type":"string"}}}}},"required":["request_data"]}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Set a User Role

> Add or remove one or more users from a role.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\*, \*\*Cortex XDR Pro\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/rbac/set_user_role":{"post":{"summary":"Set a User Role","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"update_count":{"type":"string","description":"Number of updated users."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-rbac-set_user_role","description":"Add or remove one or more users from a role.\n\nRequired license: **Cortex XDR Pro per Endpoint**, **Cortex XDR Pro**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"user_emails":{"type":"array","description":"List of one or more user emails of users you want to add to or remove from a role.","items":{"type":"string"}},"role_name":{"type":"string","description":"Name of the role you want to add a user to. Send an empty field to remove the user."}}}},"required":["request_data"]}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Risk Score

> Retrieve the risk score of a specific user or endpoint in your environment, along with the reason for the score.\
> \
> Required license: \*\*Identity Threat Module\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_risk_score":{"post":{"summary":"Get Risk Score","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"type":{"type":"string","description":"Form of identification element."},"id":{"type":"string","description":"Identification value of the type field."},"score":{"type":"integer","description":"The score assigned to the type."},"norm_risk_score":{"type":"integer","description":"Normalization of the risk score.","minimum":0,"maximum":1000},"risk_level":{"type":"string","enum":["LOW","MED","HIGH"],"description":"The risk level."},"reasons":{"type":"array","description":"Details describing when and which incident name affected the score.","items":{"type":"object","properties":{"date created":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"status":{"type":"string"},"points":{"type":"integer"}}}},"email":{"type":"string","description":"Email address."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-get_risk_score","description":"Retrieve the risk score of a specific user or endpoint in your environment, along with the reason for the score.\n\nRequired license: **Identity Threat Module**","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["id"],"properties":{"id":{"type":"string","description":"Unique ID of a specific user or endpoint.\n\n- User ID should be in the following format: `netBIOS/samAccount`\n- Endpoint ID is the Cortex Agent ID.\n\nYou can only request one ID at a time."}}}}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Risky Users

> Retrieve a list of users with the highest risk score in your environment along with the reason affecting each score.\
> \
> Required license: \*\*Identity Threat Module\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_risky_users":{"post":{"summary":"Get Risky Users","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","description":"JSON object containing the query result.","items":{"type":"object","properties":{"type":{"type":"string","description":"Form of identification element."},"id":{"type":"string","description":"Identification value of the type field."},"score":{"type":"integer","description":"The score assigned to the user."},"norm_risk_score":{"type":"integer","minimum":0,"maximum":1000,"description":"Normalization of the risk score."},"risk_level":{"type":"string","enum":["LOW","MED","HIGH"],"description":"The risk level."},"reasons":{"type":"array","description":"Details describing when and which incident name affected the user score.","items":{"type":"object","properties":{"date created":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"status":{"type":"string"},"points":{"type":"integer"}}}},"email":{"type":"string","description":"Email address."}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-get_risky_users","description":"Retrieve a list of users with the highest risk score in your environment along with the reason affecting each score.\n\nRequired license: **Identity Threat Module**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Risky Hosts

> Retrieve a list of endpoints with the highest risk score in your environment along with the reason for each score.\
> \
> Required license: \*\*Identity Threat Module\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"System Management","description":"APIs for system management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_risky_hosts":{"post":{"summary":"Get Risky Hosts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["System Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","description":"JSON object containing the query result.","items":{"type":"object","properties":{"type":{"type":"string","description":"Form of identification element."},"id":{"type":"string","description":"Identification value of the type field."},"score":{"type":"integer","description":"The score assigned to the endpoint."},"norm_risk_score":{"type":"integer","minimum":0,"maximum":1000,"description":"Normalization of the risk score."},"risk_level":{"type":"string","enum":["LOW","MED","HIGH"],"description":"The risk level."},"reasons":{"type":"array","description":"Details describing when and which incident name affected the endpoint score.","items":{"type":"object","properties":{"date created":{"type":"string"},"description":{"type":"string"},"severity":{"type":"string"},"status":{"type":"string"},"points":{"type":"integer"}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-get_risky_hosts","description":"Retrieve a list of endpoints with the highest risk score in your environment along with the reason for each score.\n\nRequired license: **Identity Threat Module**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/system-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.