Paths Added
- GET /public\_api/appsec/v1/code-to-cloud/coverage: Retrieve the Code-to-Cloud coverage ratio — the percentage of assets with a traceable lineage between code and cloud. Use direction to select which way lineage is traced and type to select the asset kind.
- GET /public\_api/appsec/v1/package\_explorer/packages/{name}/versions/{version}: Retrieve details for a specific package version, including vulnerability counts and where the package is used.
- GET /public\_api/appsec/v1/application/{applicationId}/assets/addable: List assets that can be added to an application.
- GET /public\_api/appsec/v1/application/{applicationId}/assets/removable: List assets that can be removed from an application.
- POST /public\_api/appsec/v1/application/{applicationId}/assets/override: Add or remove assets, overriding the application's asset selection criteria.
- GET /public\_api/appsec/v1/application/{applicationId}/assets/overrides: List the override actions applied to an application.
- DELETE /public\_api/appsec/v1/application/{applicationId}/assets/overrides/{actionId}: Revert a single asset override action.
Updated Schemas
- CreateOrModifyCustomRuleRequestParams: Added category, subCategory, frameworks, cspmRuleId, and clonedFromRuleId.
- DetectionRule: Added complianceStandards, cspmRuleId, cspmTypeId, and findingTypeName.
- CustomRuleScanner: Added IAC and SECRETS scanner values.
- GetRulesResponseObject: Added nextOffset to support offset pagination.
Schemas Added
- CoveragePublicApiResponse, CodeToCloudDirection, CodeToCloudDashboardType: Code-to-Cloud coverage response and query enums.
- PackageExplorerResponse, PackageType, VulnerabilityCounts, UsedInCounts: Package Explorer response types.
- ManageableAsset, GetManageableAssetsResponse, AddableAssetFilter, OverrideAssetsRequest, OverrideAssetsResponse, ApplicationAssetOverrideResponse, RevertOverridesResponse, OperationType: Application asset management types.
- ComplianceStandard, Control: Compliance metadata attached to detection rules.
Schemas Removed
- IACSecurity and secretsSecurity were replaced by the CustomRuleScanner enum values.
New specs published
Broker VM endpoints are now documented in two specs, reflecting the two places a Broker VM is managed from:
- Cortex Broker Public API (tenant-side) (broker-papi.yaml): manage brokers from the Cortex tenant.
- Cortex Broker Direct Public API (on-appliance) (broker-direct-papi.yaml): configure an individual appliance directly.
Paths included (tenant-side)
- GET /public\_api/v1/brokers/: List brokers.
- GET /public\_api/v1/brokers/images/: List available broker images.
- GET /public\_api/v1/brokers/action\_status/{action\_id}/: Poll the status of an asynchronous broker action.
- POST /public\_api/v1/brokers/registration\_token/: Generate a registration token.
- POST /public\_api/v1/brokers/{device\_id}/: Update broker settings.
- POST /public\_api/v1/brokers/{device\_id}/delete/, /reboot/, /shutdown/, /upgrade/: Lifecycle actions.
- GET /public\_api/v1/brokers/{device\_id}/applets/{applet\_name}/, POST .../activate/, .../deactivate/, .../config/: Manage applets.
- POST /public\_api/v1/brokers/{device\_id}/applets/network\_mapper/scan\_now/: Trigger an on-demand network mapper scan.
- POST /public\_api/v1/brokers/{device\_id}/applets/wec/wef\_cert/: Upload a WEF certificate.
- POST /public\_api/v1/brokers/{device\_id}/logs/generate/, GET .../logs/status/, GET .../logs/download/: Generate and retrieve broker logs.
Paths included (on-appliance)
- POST /public\_api/v1/auth/token, POST /public\_api/v1/auth/reset-initial-password: Appliance authentication.
- POST /public\_api/v1/register: Register the appliance with a tenant.
- POST /public\_api/v1/network/interface, /internal\_subnet, /ntp, /proxy, /ssl\_certificate, /trusted\_ca: Appliance network configuration.
- POST /public\_api/v1/logs: Retrieve appliance logs.
Paths Added
- POST /public\_api/v1/case/timeline/{case-id}/: Retrieve the timeline for a case.
- POST /public\_api/v1/case/timeline/{case-id}/add\_record/: Add a record to a case timeline.
Updated Paths
- POST /public\_api/v1/case/search: Added modification\_time as a supported filter and sort field. last\_update\_time is still accepted for backward compatibility but is deprecated — use modification\_time instead.
Updated Schemas
- Case: Added access\_mode, case\_team, asset\_group\_ids, and asset\_group\_names.
- UpdateCase: Added access\_mode and case\_team.
- Asset: Added asset\_tags and asset\_group\_names.
- Response wrapper: Corrected to return a reply object rather than the err\_code / err\_msg / err\_extra shape previously documented.
Paths Added
- GET /public\_api/ciem/v1/access/source/{source\_uai}: Retrieve the resources a source identity can access.
- GET /public\_api/ciem/v1/access/destination/{destination\_uai}: Retrieve the identities that can access a destination resource.
- GET /public\_api/ciem/v1/access/granter/{granter\_uai}: Retrieve the access conferred by a permission-granting entity.
- GET /public\_api/ciem/v1/assets/{assetId}/least-privileged-access: Retrieve a least-privilege access recommendation for an asset.
Deprecated Paths
- POST /public\_api/v1/ciem/access/search is deprecated. Use the three GET access endpoints above instead.
Note: The deprecated endpoint continues to function for backward compatibility but will not receive further enhancements.
Schemas Added
- CiemAccessGetRequest, CiemAccessGetResponse, CiemAccessGetEntry, GetFilterObject: Request/response types for the access GET endpoints.
- CustomLeastPrivilegedAccessResponseDto, LeastPrivilegedPermissionVerdict, RecommendationSnippetsDto: Least-privilege recommendation types.
Updated Schemas
- InstanceAdditionalCapabilities: Added upload\_files\_to\_wildfire to control whether scanned files are uploaded to WildFire.
- InstanceAuditLogsConfig: Added is\_control\_tower\_byob for AWS Control Tower bring-your-own-bucket audit log collection.
- InstanceScopeModifications: Added organizational\_units, folders, management\_groups, and onboard\_only\_mode for scoping onboarding across AWS OUs, GCP folders, and Azure management groups.
Schemas Added
- InstanceOUConfig: Organizational unit configuration for scoped onboarding.
Compliance v2 APIs
A v2 set of compliance endpoints has been added for managing custom standards, controls, and categories. The existing v1 compliance endpoints are unchanged and remain available.
Paths Added — Standards
- GET /public\_api/v2/compliance/standards, POST /public\_api/v2/compliance/standards: List and create standards.
- GET /public\_api/v2/compliance/standards/{standard\_id}, POST /public\_api/v2/compliance/standards/{standard\_id}, DELETE /public\_api/v2/compliance/standards/{standard\_id}: Retrieve, update, and delete a standard.
- POST /public\_api/v2/compliance/standards/{standard\_id}/clone: Clone an existing standard.
Paths Added — Import and export
- POST /public\_api/v2/compliance/standards/export, GET /public\_api/v2/compliance/standards/export/{job\_id}, GET /public\_api/v2/compliance/standards/export/{job\_id}/download: Start an export job, poll its status, and download the result.
- POST /public\_api/v2/compliance/standards/import, GET /public\_api/v2/compliance/standards/import/{job\_id}: Start an import job and poll its status.
Paths Added — Controls
- GET /public\_api/v2/compliance/controls, POST /public\_api/v2/compliance/controls: List and create controls.
- GET /public\_api/v2/compliance/controls/{control\_id}, POST /public\_api/v2/compliance/controls/{control\_id}, DELETE /public\_api/v2/compliance/controls/{control\_id}: Retrieve, update, and delete a control.
- POST /public\_api/v2/compliance/controls/bulk, POST /public\_api/v2/compliance/controls/bulk-update, POST /public\_api/v2/compliance/controls/delete: Bulk create, update, and delete controls.
Paths Added — Categories
- GET /public\_api/v2/compliance/categories, POST /public\_api/v2/compliance/categories: List and create categories.
- POST /public\_api/v2/compliance/categories/{category\_id}, DELETE /public\_api/v2/compliance/categories/{category\_id}: Update and delete a category.
Schemas Added
- PapiStandardCreate, PapiStandardUpdate, PapiStandardResponse, PapiControlCreate, PapiControlUpdate, PapiControlResponse, PapiCategoryCreate, PapiCategoryUpdate, PapiCategoryResponse, PapiPaginatedResponse, PapiBulkDeleteControls, BulkControlResult, BulkControlResultItem, BulkUpdateControlItem, CloneStandardRequest, CloneStandardResponse, CloneStandardCategoryResponse, CloneStandardSubcategoryResponse, CloneStandardControlResponse, ExportRequest, ExportJobResponse, ExportStatusResponse, ImportJobResponse, ImportStatusResponse, ImportStandardResult.
Paths Added
- POST /public\_api/v1/tags/agents/create: Create an endpoint tag.
New spec published
Cortex XDR Forensics REST API (forensics-papi.json) supports forensic investigations and evidence collection.
Paths Added
- POST /public\_api/v1/forensics/investigations: Create or retrieve forensic investigations.
- POST /public\_api/v1/forensics/investigations/collections: Manage collections within an investigation.
- POST /public\_api/v1/forensics/investigations/collections/get\_data: Retrieve collected data.
- POST /public\_api/v1/forensics/investigations/collections/hunt: Run a hunt across collected data.
- POST /public\_api/v1/forensics/investigations/collections/triage: Trigger triage collection.
- POST /public\_api/v1/forensics/investigations/collections/triage/get\_files: Retrieve triage files.
- POST /public\_api/v1/forensics/investigations/collections/triage/host\_timeline: Retrieve a host timeline from triage data.
Updated Paths
- GET /platform/iam/v1/role: Clarified the response description; 403 responses now include named examples for insufficient-permissions and Instance Administrator privilege-escalation errors.
- PUT /platform/iam/v1/scope/{entity\_type}/{entity\_id}: Documented that datasets\_rows is available only on XSIAM tenants with the feature explicitly enabled — contact your account team to enable it. When enabled, this field is mandatory in every scope edit request; omitting it returns a 400 error.
Updated Schemas
- DatasetsRowsScope: Clarified that dataset row-level scoping is an XSIAM-only feature. When enabled, this field is required in all scope edit requests.
Updated Paths
- POST /public\_api/v1/issue/search: Added include\_evidences and include\_actions boolean request fields to control whether evidence and action objects are included in search results. Added compliance filter fields: xdm.compliance.standard\_id, xdm.compliance.category\_id, xdm.compliance.control\_id, xdm.policy\_id, asset\_group\_names, and asset\_tags.
- POST /public\_api/v1/issue\_exceptions/: Clarified exception creation behavior.
Updated Schemas
- CreateIssueException: Corrected field definitions for creating issue exceptions.
Spec reorganization
The Managed Services (MTH) endpoints moved from managed-threat-detection-papi.yaml to managed-threat-detection-papi.json. Existing operations are unchanged.
Paths Added
- POST /public\_api/v1/mth/child/get\_all\_reports: Retrieve all reports for a child tenant.
- POST /public\_api/v1/mth/child/get\_reports\_by\_statuses: Retrieve reports filtered by status.
Paths included
- POST /public\_api/v1/mth/child/add\_comment, /get\_comments, /get\_reports\_by\_source\_id, /get\_reports\_by\_incident\_id, /report/update/assign, /report/update/status.
New spec published
Restore Distributions Public API (restore-distributions-papi.json).
Paths Added
- POST /public\_api/v1/distributions/restore: Restore a previously deleted agent installation package.
New spec published
Unified Rules API (unified-rules-papi.json) lets you manage linked Cloud Security and AppSec rule pairs through a single unified endpoint.
Paths Added
- GET /public\_api/appsec/v1/unified-rules: Returns a paginated list of all unified rule pairs.
- POST /public\_api/appsec/v1/unified-rules: Creates a linked Cloud Security (CSPM) and AppSec rule pair in a single operation.
- GET /public\_api/appsec/v1/unified-rules/{ruleId}: Returns the full details of a specific unified rule pair, including both the linked AppSec and Cloud Security (CSPM) rule objects.
- PUT /public\_api/appsec/v1/unified-rules/{ruleId}: Updates one or both rules in a unified rule pair in a single request.
- DELETE /public\_api/appsec/v1/unified-rules/{ruleId}: Deletes both the AppSec and Cloud Security rules in a unified rule pair in a single operation.
Updated Paths
- POST /vulnerability-management/v1/vulnerability-finding/search and POST /vulnerability-management/v1/vulnerability-finding/snapshot: Corrected the documented paths to remove the trailing slash, matching live API behavior.
- Documented the CVSS\_SEVERITY and EXPLOIT\_LEVEL filter values available on vulnerability finding searches.
- Clarified the Bring Your Own Scanner (BYOS) import and job status endpoint descriptions.
Updated Schemas
- FilterTriplet: Renamed field, operator, and value to SEARCH\_FIELD, SEARCH\_TYPE, and SEARCH\_VALUE to match the live API.
- FindingsSortObject: Renamed field and keyword to FIELD and ORDER to match the live API.
Updated Schemas
- AppsecPolicyTriggersandActions: Added ciImage and imageRegistry trigger configurations.
- ConditionOperators: Added CONTAINS\_IN\_LIST, JSON\_WILDCARD, RANGE, and RELATIVE\_TIMESTAMP.
- CreateRequest: Added enabled, suggestionId, and userSbac.
- FindingType: Updated enum values (e.g., VULNERABILITY, CODE\_WEAKNESS).
- Integration: Added scanTypes, statusDetails, and tenantId.
- Policy: Added overrideIssueSeverity, scopeFields, suggestionHash, and suggestionId.
Schemas Added
- BillingErrorResponse: Error schema for billing-related endpoints.
- ConditionValue: Structured value for range and key-value matching.
- EmailOrigin: Enum for user email sources (API, GIT).
- IntegrationStatusDetails: Detailed status for data source components.
- RepositoryUser: Detailed schema for repository contributors.
- Transporter: Configuration for secure communication with private data sources.
- UnifiedAction: Consolidated enum for all possible policy actions.
Paths Added
- GET /public\_api/appsec/v1/billing/contributors: Retrieve active contributors for billing.
- POST /public\_api/appsec/v1/collectors/{collectorId}: Upload 3rd party SARIF findings.
Updated Paths
- POST /public\_api/appsec/v1/policies: Detailed rules for finding types.
Deprecated Paths
The following Integrations API endpoints are deprecated:
- GET /public\_api/appsec/v1/integrations
- POST /public\_api/appsec/v1/integrations
- GET /public\_api/appsec/v1/integrations/{integrationId}
- PUT /public\_api/appsec/v1/integrations/{integrationId}
- DELETE /public\_api/appsec/v1/integrations/{integrationId}
Note: The deprecated endpoints will continue to function temporarily for backward compatibility. However, they will not receive further enhancements or updates. A formal sunset date will be announced in a future release.
Replacement Paths
The Integrations APIs are replaced with the following Data Source Instances API endpoints:
- GET /public\_api/appsec/v1/data\_source\_instances
- POST /public\_api/appsec/v1/data\_source\_instances
- GET /public\_api/appsec/v1/data\_source\_instances/{id}
- PUT /public\_api/appsec/v1/data\_source\_instances/{id}
- DELETE /public\_api/appsec/v1/data\_source\_instances/{id}
Updated Schemas
- CreateInstanceTemplateRequestData: Added ALIBABA\_CLOUD and gcp\_workspace.
- EditInstanceRequestData: Added ALIBABA\_CLOUD, connector\_name, and gcp\_workspace.
- InstanceAdditionalCapabilities: Added automation, automation\_log\_level, and kubernetes\_security.
Schemas Added
- AccountItem: Added schema for cloud account items.
- EditOutpostRequest: Added schema for outpost edit requests.
- EditOutpostRequestData: Added schema for outpost edit request data.
- InstanceListItem: Added schema for cloud instance list items.
Updated Paths
- Terminology shift from "integration instance" to "cloud instance" across all endpoints.
- POST /public\_api/v1/cloud\_onboarding/edit\_outpost: Updated request/response schemas.
Updated Schemas
- ErrorResponse: Standardized error structure.
Schemas Added
- CreateIssueException: Schema for creating issue exceptions.
- IssueException: Full object representation for issue exceptions.
- EditPreventionPolicyRequest: Wrapper for prevention policy edit requests.
- EditPreventionPolicyRequestData: List of rule edits to apply.
- PreventionPolicyEditParameters: Parameters for editing prevention rules.
- TargetFilter: Structured condition tree for targeting endpoints.
- SearchCondition: Individual filter criteria.
- SuccessResponse: Simple boolean success indicator.
Paths Added
- POST /public\_api/v1/issue\_exceptions/: Create issue exceptions.
- POST /public\_api/v1/issue\_exceptions/disable/: Disable exceptions.
- POST /public\_api/v1/issue\_exceptions/search/: Search exceptions.
- POST /public\_api/v1/policies/prevention/edit: Atomic prevention rule edits.
Updated Paths
- POST /public\_api/v1/distributions/create: Added caas\_embedded package type.
Spec reorganization
The Issues, Cases, and Issue Exceptions endpoint groups have been relocated out of the platform spec into dedicated standalone specs (issues-papi.json, cases-papi.json). Operations and contracts are unchanged. See the new "Issues APIs" and "Cases APIs" entries above.
Standalone spec published
Cases endpoints now live in a dedicated standalone spec (cases-papi.json), separated from the platform spec for cleaner navigation. No contract changes — same operations, schemas, and components.
Paths included
- POST /public\_api/v1/case/search: Search and filter cases.
- POST /public\_api/v1/case/update/{case-id}: Update an existing case.
- POST /public\_api/v1/case/artifacts/{case-id}/: Retrieve case artifacts.
- POST /public\_api/v1/case/schema: Retrieve the case field schema.
- POST /public\_api/v1/entries/get: Retrieve case entries.
- POST /public\_api/v1/entries/insert: Add an entry to a case or alert War Room.
Schema and description alignments
- Case: Updated field types, descriptions, and required-field lists to align with current API behavior.
- CaseArtifact: Updated to reflect the current artifact structure.
- UpdateCase: Updated request schema for case updates.
Standalone spec published
Issues endpoints now live in a dedicated standalone spec (issues-papi.json), separated from the platform spec for cleaner navigation. No contract changes for the relocated endpoints.
Paths included
- POST /public\_api/v1/issue: Create a new issue.
- POST /public\_api/v1/issue/{issue-id}: Update an existing issue.
- POST /public\_api/v1/issue/search: Search and filter issues.
- POST /public\_api/v1/issue/schema/: Retrieve the dynamic issue field schema (trailing slash; aligned with current API behavior).
- POST /public\_api/v1/issue\_exceptions/: Create an issue exception.
- POST /public\_api/v1/issue\_exceptions/disable/: Disable an issue exception.
- POST /public\_api/v1/issue\_exceptions/search/: Search issue exceptions.
Schema and description alignments
The Issue schema and issue/search response wrapper have been updated to reflect current API behavior:
- Issue: Added 11 fields previously missing from the documented schema: action\_status, agentic\_assistant\_id, agentic\_response\_conversation\_id, agentic\_response\_status, asset\_cloud\_account\_names, asset\_external\_provider\_ids, case\_ids, exception\_expiration, exception\_ids, initial\_evidence, is\_excepted.
- issue/search response wrapper: Renamed total\_count → TOTAL\_COUNT, result\_count → FILTER\_COUNT, and issues → DATA to match current API behavior.
- issue/schema/ response wrapper: Updated from reply.data to reply.DATA.
- IssueSchemaField.data\_type example: Expanded to include TEXT, BIGINT, INT, FLOAT, BOOLEAN, TIMESTAMP, ENUM, JSON, COMPLEX, and ARRAY representative values returned by the API.
Bring Your Own Scanner (BYOS)
Import vulnerability findings from external scanners into Cortex vulnerability management.
Paths Added
- POST /public\_api/vulnerability-management/v1/external-scans/assets: Submit assets and CVE findings from a third-party scanner; returns a job\_id for async status polling.
- GET /public\_api/vulnerability-management/v1/external-scans/assets/jobs/{job\_id}: Poll the status of a BYOS import job.
Schemas Added
- VulnerableAssetImportRequest, VulnerableAssetImportResponse, ImportJobResponse.
Updated Schemas
- VulnerabilityFinding: Comprehensive schema for CVE/asset records.
Schemas Added
- FilterBlock: Logical filter block supporting AND/OR connectors.
- FilterTriplet: Individual filter condition.
- FindingsErrorResponse: Standardized error response.
- FindingsSortObject: Sort criteria for findings.
- GetVulnerabilityFindingByIdResponse: Response for single finding lookups.
- GetVulnerabilityFindingsRequest: Request for paginated searches.
- GetVulnerabilityFindingsResponse: Response for paginated searches.
- GetVulnerabilityFindingsSnapshotRequest: Parameters for bulk snapshot exports.
- TimeframeAbsolute: Absolute time range schema.
Paths Added
- POST /vulnerability-management/v1/vulnerability-finding/search/: Paginated search.
- POST /vulnerability-management/v1/vulnerability-finding/snapshot/: Bulk export (NDJSON).
- POST /vulnerability-management/v1/vulnerability-finding/{platform\_id}: Get finding by ID.
Schemas Added
- ApplicationAssetSelectionFilter: Defines filter criteria to dynamically select application assets.
- ApplicationAssetSelectionFilterValues: Container for filter values used to match application assets (orgUrl, repositoryId, projectUrl, etc.).
- ManualAndRunCriteriaApplicationAssetSelectionFilter: Specific filter for manual and run criteria.
- ApplicationMetadataCode: Metadata for code-based assets, including business owner and criticality.
- BusinessOwnerMetaData: Enum for business owner types (organizationOwner, projectOwner, etc.).
- CodeCriteriaConfig: Configuration for code-based criteria, including unification settings.
- CriteriaDTOCode: Detailed data transfer object for code criteria.
- IACSecurity: Configuration for Infrastructure as Code (IaC) security scanners.
- secretsSecurity: Configuration for secrets security scanners.
- CriteriaType.Code: Enum for criteria types.
Updated Schemas
- ApplicationAssetSelection: Updated description and properties.
- ApplicationConfigurationSettings: Added sla (Service Level Agreement) configurations for different severity levels (CRITICAL, HIGH, MEDIUM, LOW).
- CreateApplicationRequest: Updated required fields and added detailed descriptions for owners (DevOps, Dev, Product Manager).
- DetectionRule: Extensive updates to properties including detectionMethod, frameworks, and scanner.
- ExtendedFields: Added unifyAcrossProviders and unifyWithinProvider flags.
- FrameworkName: Expanded enum with many new values (e.g., CI\_CD\_GITHUB\_REPO, TERRAFORMPLAN, OPENAPI).
Paths Added
- None
Updated Paths
- GET /public\_api/appsec/v1/application: Updated descriptions and added mandatory Authorization and x-xdr-auth-id headers.
- POST /public\_api/appsec/v1/application: Updated descriptions and added mandatory Authorization and x-xdr-auth-id headers.
Updated Schemas
- CreateInstanceTemplateRequestData: Added cloud\_partition field (COMMERCIAL/GOV) to request\_data.
- CreateOutpostTemplateRequestData: Added cloud\_partition field (COMMERCIAL/GOV) to request\_data.
- EditInstanceRequestData: Added cloud\_partition field (COMMERCIAL/GOV) to request\_data.
- ListCloudProviderRegionsRequestData: Added cloud\_partition field (COMMERCIAL/GOV) to request\_data.
- ListCloudProviderRegionsResponse: Changed reply type from object to array and updated its items to include name, value, and type.
Schemas Added
- None
Paths Added
- None
Updated Paths
- POST /public\_api/v1/cloud\_onboarding/create\_instance\_template: Updated request body examples to include cloud\_partition.
- POST /public\_api/v1/cloud\_onboarding/edit\_instance: Updated request body examples to include cloud\_partition.
- POST /public\_api/v1/cloud\_onboarding/get\_azure\_approved\_tenants: Added cloud\_parition to the request body schema.
- POST /public\_api/v1/cloud\_onboarding/get\_instance\_details: Updated summary from "Get integration instance details" to "Get cloud instance details" and updated response examples to include cloud\_partition.
Note: The primary change in this version is the introduction of the cloud\_partition parameter across onboarding APIs to support both COMMERCIAL and GOV (government) cloud environments.
The following new APIs have been added under Endpoint Management:
- POST /public\_api/v1/distributions/get\_distributions
- POST /public\_api/v1/endpoints/get\_profiles
- POST /public\_api/v1/legacy\_exceptions/get\_modules
- POST /public\_api/v1/legacy\_exceptions/fetch
- POST /public\_api/v1/legacy\_exceptions/add
- POST /public\_api/v1/legacy\_exceptions/edit
- POST /public\_api/v1/legacy\_exceptions/delete
Updated Paths
- POST /public\_api/v1/distributions/create: Updated serverless support
The following new APIs have been added:
- POST /public\_api/v1/cwp/registry\_onboarding/instances
- GET /public\_api/v1/cwp/registry\_onboarding/instances/{connectorID}
- PUT /public\_api/v1/cwp/registry\_onboarding/instances/{connectorID}
- DELETE /public\_api/v1/cwp/registry\_onboarding/instances/{connectorID}
The following new APIs have been added:
- POST /public\_api/v1/rule
- POST /public\_api/v1/rule/search
- GET /public\_api/v1/rule/{id}
- PATCH /public\_api/v1/rule/{id}
- DELETE /public\_api/v1/rule/{id}
The following new APIs have been added:
- POST /public\_api/v1/disable\_prevention/get\_modules
- POST /public\_api/v1/disable\_prevention/fetch
- POST /public\_api/v1/disable\_prevention/edit
- POST /public\_api/v1/disable\_prevention/add
- POST /public\_api/v1/disable\_prevention/delete
The following new APIs have been added:
- POST /public\_api/v1/disable\_injection\_prevention\_rules/fetch
- POST /public\_api/v1/disable\_injection\_prevention\_rules/add
- POST /public\_api/v1/disable\_injection\_prevention\_rules/disable
Schemas Added
- AssetGroup
- AssetsScope
- AssetsScopeRequest
- CasesIssuesScope
- CasesIssuesScopeRequest
- DatasetFilter
- DatasetsRowsScope
- EndpointGroupsScope
- EndpointGroupsScopeRequest
- EndpointTagsScope
- EndpointTagsScopeRequest
- EndpointsScope
- EndpointsScopeRequest
- Role
- Tag
Updated Schemas
- UnauthorizedImproperPermissions: Updated example and properties for the reply object; added data and reply to required fields.
- ApiKeyEditRequest: Updated descriptions for comment, roles, and security\_level.
- RoleCreateRequest: Updated description for request\_data.
- ScopeEditRequest: Added request\_data properties including assets, cases\_issues, datasets\_rows, endpoints, tagless\_scope, and tags\_scope.
- UserEditRequest: Updated descriptions for is\_hidden, phone\_number, role\_id, status, user\_first\_name, user\_groups, and user\_last\_name.
- UserGroupCreateRequest: Updated descriptions for description, group\_name, idp\_groups, nested\_group\_ids, role\_id, and users.
- UserGroupEditRequest: Updated descriptions for description, group\_name, idp\_groups, nested\_group\_ids, role\_id, and users.
Paths Added
- None
Updated Paths
- /platform/iam/v1/api-key/{api\_key\_id}: Updated GET response schema and PUT request body description.
- /platform/iam/v1/role: Updated GET response schema (now uses Role schema) and POST request body description.
- /platform/iam/v1/role/permission-config: Updated GET response schema.
- /platform/iam/v1/scope/{entity\_type}/{entity\_id}: Updated GET response schema and PUT request body description.
- /platform/iam/v1/user: Updated GET response schema.
- /platform/iam/v1/user-group: Updated GET response schema and POST request body description.
- /platform/iam/v1/user-group/{group\_id}: Updated GET response schema and PUT request body description.
The following new APIs have been added:
- POST /public\_api/v1/mth/child/add\_comment
- POST /public\_api/v1/mth/child/get\_comments
- POST /public\_api/v1/mth/child/report/update/assign
- POST /public\_api/v1/mth/child/get\_reports\_by\_source\_id
- POST /public\_api/v1/mth/child/get\_reports\_by\_incident\_id
The following new APIs have been added:
- GET /platform/integration/v1/external-application
- GET /platform/integration/v1/external-application/{application\_id}
- DELETE /platform/integration/v1/external-application/{application\_type}/id/{application\_id}
The following new APIs have been added:
- GET /platform/notifications/v1/list-rules
- POST /platform/notifications/v1/rule
- GET /platform/notifications/v1/rule/{rule\_uuid}
- PUT /platform/notifications/v1/update-rule-status/{rule\_uuid}
Schemas Added
- ScanRequest: Request model for triggering a vulnerability scan.
- ScanResponse: Response model for scan trigger operation.
- ScannerType: Enum for vulnerability scanner types (CORTEX\_NETWORK\_SCANNER, CORTEX\_XDR\_AGENT, CORTEX\_XDR\_AGENTLESS).
Updated Schemas
- CreatePolicy: Refined property definitions for policy\_type, severity, and status using allOf.
- Filter-Input: Refined paging property definition using allOf.
- PolicyView: Refined POLICY\_TYPE and SEVERITY property definitions using allOf.
Paths Added
- POST /public\_api/vulnerability-management/v1/scan
Updated Paths
- /public\_api/uvm\_public/v1/create\_policy: Added description to requestBody.
- /public\_api/uvm\_public/v1/list\_policies: Added description to requestBody.
- /public\_api/uvm\_public/v1/update\_policy/{id}: Added description to requestBody.