> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-infrastructure-entitlement-management-ciem/ciem.md).

# CIEM

APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module.

## Least Privilege Access suggestion for an asset

> Returns least privilege access (LPA) recommendations based on the asset's existing IAM policies or roles. The recommendations preserve all actions performed by the asset during the specified lookback period while minimizing the number of existing policies or roles required. \
> \
> Use this endpoint to apply the returned configuration snippets to remediate over-privileged identities.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management  APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"CIEM","description":"APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"security":[],"paths":{"/public_api/ciem/v1/assets/{assetId}/least-privileged-access":{"get":{"operationId":"custom-least-privilege-access-by-uai","summary":"Least Privilege Access suggestion for an asset","description":"Returns least privilege access (LPA) recommendations based on the asset's existing IAM policies or roles. The recommendations preserve all actions performed by the asset during the specified lookback period while minimizing the number of existing policies or roles required. \n\nUse this endpoint to apply the returned configuration snippets to remediate over-privileged identities.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.","tags":["CIEM"],"parameters":[{"name":"assetId","in":"path","description":"Unique identifier of the asset.","required":true,"schema":{"type":"string"}},{"name":"output_format","in":"query","description":"Format of the remediation configuration snippets returned in `recommendationSnippets`. Supported values depend on the selected `cloud_type`:\n- `JSON` — Supported for AWS, Azure, and GCP\n- `TERRAFORM` — Supported for AWS, Azure, and GCP\n- `CF` — Supported only for AWS (CloudFormation)\n- `CLI` — Supported only for GCP\n- `ALL` — Returns all supported formats available for the asset's cloud provider (AWS, Azure, or GCP)","required":true,"schema":{"type":"string","enum":["JSON","TERRAFORM","CF","CLI","ALL"]}},{"name":"lookback_duration_days","in":"query","description":"Number of days to look back when evaluating actions performed by the asset. Only actions observed during this lookback period are used to generate the least-privilege configuration.","schema":{"type":"integer","minimum":1,"maximum":365},"required":true},{"name":"cloud_type","in":"query","description":"Cloud service provider associated with the asset. This value must match the asset's actual cloud provider. The supported `output_format` values depend on the selected cloud provider.","required":true,"schema":{"type":"string","enum":["AWS","AZURE","GCP"]}},{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK. Indicates that the Least Privilege Access suggestion generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CustomLeastPrivilegedAccessResponseDto"}}}},"400":{"description":"Bad Request — The request is malformed or contains invalid parameter values."},"401":{"description":"Unauthorized — The `Authorization` header is missing or contains an invalid API key."},"500":{"description":"Internal Server Error — The server encountered an unexpected error. This may occur if the specified `assetId` does not exist, or if the `output_format` and `cloud_type` combination is not supported for the asset's cloud provider."}}}}},"components":{"schemas":{"CustomLeastPrivilegedAccessResponseDto":{"type":"object","description":"Response containing the generated Least Privilege Access configuration for the asset.","properties":{"recommendationSnippets":{"$ref":"#/components/schemas/RecommendationSnippetsDto"},"verdicts":{"type":"array","description":"List of permission verdicts for each action associated with the asset. Each verdict indicates whether the action should be kept or removed based on usage during the lookback period.","items":{"$ref":"#/components/schemas/LeastPrivilegedPermissionVerdict"}},"recommendedActionType":{"type":"string","description":"The recommended remediation action based on the evaluation of the asset's permissions.\n- `applySnippets` — The asset has excess permissions. Apply the configuration snippets in `recommendationSnippets` to enforce least-privilege access.\n- `removeAllPolicies` — No actions were observed during the lookback period. Remove all policies or roles currently assigned to the asset.\n- `noActionRequired` — The asset's current permissions already satisfy least-privilege requirements. No remediation is needed.\n- `manuallyRemoveUnusedActions` — The asset has unused permissions that cannot be automatically remediated using configuration snippets. Review and remove the unused permissions manually.","enum":["applySnippets","removeAllPolicies","noActionRequired","manuallyRemoveUnusedActions"]}}},"RecommendationSnippetsDto":{"type":"object","description":"Remediation configuration snippets for applying the recommended least-privilege permissions. Depending on the requested `output_format`, one or more fields are populated.","properties":{"json":{"type":"array","description":"Remediation snippets in JSON format. Returned when `output_format=JSON` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A serialized JSON string representing a single cloud API call. Parse this string as JSON to access the `url` and `body` fields."}},"terraform":{"type":"array","description":"Remediation snippets in Terraform format. Returned when `output_format=TERRAFORM` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A Terraform HCL resource block string defining the least-privilege role or policy."}},"cloudFormation":{"type":"array","description":"Remediation snippets in AWS CloudFormation format. Returned when `output_format=CF` or `output_format=ALL`. Supported for AWS only.","items":{"type":"string","description":"An AWS CloudFormation template fragment string defining the least-privilege IAM policy or role."}},"cli":{"type":"array","description":"Remediation snippets as Google Cloud CLI (gcloud) commands. Returned when `output_format=CLI` or `output_format=ALL`. Supported for GCP only.","items":{"type":"string"}}}},"LeastPrivilegedPermissionVerdict":{"type":"object","description":"List of permission verdicts for actions associated with the asset. Each verdict indicates whether an action should be retained or removed based on its usage during the specified lookback period.","properties":{"actionName":{"type":"string","description":"The cloud permission action that was evaluated. The format varies by cloud provider (for example, `s3:PutObject` for AWS, `Microsoft.Compute/disks/write` for Azure, or `compute.instances.get` for GCP)."},"policyName":{"type":"string","description":"Name of the policy or role that grants the evaluated action."},"recommendation":{"type":"string","description":"Recommended action for the evaluated permission.\n- `Keep` — The action was used during the lookback period and should be retained.\n- `Remove` — The action was not used during the lookback period and should be removed to enforce least privilege.","enum":["Keep","Remove"]},"source":{"type":"string","description":"Source of the access data used to determine the recommendation.\n- `CIEM_LAST_ACCESS` — Based on last-access activity collected by CIEM.\n- `ACCESS_ADVISOR` — Based on access advisor data provided by the cloud provider (for example, AWS IAM Access Advisor), which reports the last time a service was accessed.","enum":["CIEM_LAST_ACCESS","ACCESS_ADVISOR"]}}}}}}
```

## Retrieve the resources a source identity can access

> Retrieves access data for a specific source identity or cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this asset is the source of permissions, mapping out every resource it can reach.\
> \
> Use this endpoint to answer "what can this identity access?". Typical source assets are human identities and non-human identities such as compute instances (for example, \`AWS::EC2::Instance\`), service accounts, and serverless functions.\
> \
> Supports optional filtering, sorting, and pagination via an optional request body and query parameter.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management  APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"CIEM","description":"APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/ciem/v1/access/source/{source_uai}":{"get":{"summary":"Retrieve the resources a source identity can access","operationId":"ciemAccessGetBySource","description":"Retrieves access data for a specific source identity or cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this asset is the source of permissions, mapping out every resource it can reach.\n\nUse this endpoint to answer \"what can this identity access?\". Typical source assets are human identities and non-human identities such as compute instances (for example, `AWS::EC2::Instance`), service accounts, and serverless functions.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.","tags":["CIEM"],"parameters":[{"name":"source_uai","in":"path","description":"The Unique Asset Identifier (UAI) of the source identity or cloud resource whose outbound access you want to retrieve.","required":true,"schema":{"type":"string"}},{"name":"next_page_token","in":"query","description":"Base64-encoded pagination token from a previous response to fetch the next page of results.","required":false,"schema":{"type":"string"}},{"in":"header","name":"x-xdr-auth-id","schema":{"type":"string"},"required":true,"description":"{api_key_id}"},{"in":"header","name":"Authorization","schema":{"type":"string"},"required":true,"description":"{api_key}"},{"in":"header","name":"Content-Type","schema":{"type":"string","enum":["application/json"]},"required":true,"description":"Specifies the request body format."}],"requestBody":{"required":false,"description":"Optional request body for filtering and sorting results.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetRequest"}}}},"responses":{"200":{"description":"Successful response with access details for the specified source.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetResponse"}}}},"400":{"description":"Bad Request. Invalid parameters or pagination token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found. The specified source UAI does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"Too Many Requests. The request rate limit has been exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"502":{"description":"Bad Gateway. The server received an invalid response from an upstream server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"503":{"description":"Service Unavailable. The service is temporarily unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"CiemAccessGetRequest":{"type":"object","description":"Optional request body for CIEM access GET endpoints, supporting filtering and sorting.","properties":{"filter":{"type":"object","description":"Optional filters to apply to the results.","properties":{"AND":{"type":"array","description":"A list of filter conditions combined with AND logic.","items":{"$ref":"#/components/schemas/GetFilterObject"}}}},"sort":{"type":"array","description":"Optional sorting criteria for the results. The sort array is passed through as-is to the underlying Cortex Platform data endpoint.","items":{"$ref":"#/components/schemas/SortObject"},"minItems":1,"maxItems":1}}},"GetFilterObject":{"type":"object","description":"Filter object for the CIEM access GET endpoints.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Identifies the field to filter.","enum":["access_levels","account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_region","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","destCategory","destination_access_labels","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","granterCategory","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_region","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","sourceCategory","sourceVendorName","unused_actions_count"]},"SEARCH_TYPE":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`","enum":["EQ"]},"SEARCH_VALUE":{"type":"string","description":"Value that this filter must match."}}},"SortObject":{"type":"object","required":["field","order"],"properties":{"field":{"type":"string","description":"The field to sort by.","enum":["account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","is_last_access_supported","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","unused_actions_count"]},"order":{"type":"string","description":"The sort order.","enum":["ASC","DESC"]}}},"CiemAccessGetResponse":{"type":"object","description":"Response object for CIEM access GET endpoints.","properties":{"FILTER_COUNT":{"type":"integer","description":"The number of results matching the applied filters.","format":"int32"},"TOTAL_COUNT":{"type":"integer","description":"The total number of available access records.","format":"int32"},"DATA":{"type":"array","description":"An array of access entries matching the specified UAI.","items":{"$ref":"#/components/schemas/CiemAccessGetEntry"}},"metadata":{"type":"object","description":"Pagination metadata. The `next_page_token` field is present only when additional pages are available.","properties":{"next_page_token":{"type":"string","description":"A base64-encoded token to retrieve the next page of results. Absent on the last page."}}}}},"CiemAccessGetEntry":{"type":"object","description":"Represents a single access entry returned by the CIEM access GET endpoints.","properties":{"source_cloud_resource_name":{"type":"string","description":"Name of the source cloud resource"},"source_cloud_resource_id":{"type":"string","description":"Source cloud resource ID"},"source_cloud_resource_uai":{"type":"string","description":"Source cloud resource UAI"},"source_cloud_resource_type":{"type":"string","description":"Type of the source cloud resource"},"source_cloud_service_name":{"type":"string","description":"Name of the source cloud service"},"source_cloud_region":{"type":"string","description":"Source cloud region"},"sourceCategory":{"type":"string","description":"Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"source_grouping_value":{"type":"string","description":"Grouping value for the source entity. For internal use; not intended for external consumption."},"source_cloud_account_id":{"type":"string","description":"Source cloud account ID"},"source_cloud_account_name":{"type":"string","description":"Name of the source cloud account"},"source_cloud_account_is_vendor":{"type":"boolean","description":"Indicates if the source account is a known vendor"},"sourceVendorName":{"type":"string","description":"Name of the source vendor"},"dest_cloud_account_id":{"type":"string","description":"Destination cloud account ID"},"dest_cloud_account_name":{"type":"string","description":"Name of the destination cloud account"},"dest_cloud_resource_name":{"type":"string","description":"Name of the destination cloud resource"},"dest_cloud_resource_id":{"type":"string","description":"Destination cloud resource ID"},"dest_cloud_resource_uai":{"type":"string","description":"Destination cloud resource UAI"},"dest_cloud_resource_type":{"type":"string","description":"Type of the destination cloud resource"},"dest_cloud_service_name":{"type":"string","description":"Name of the destination cloud service"},"dest_cloud_region":{"type":"string","description":"Destination cloud region"},"destCategory":{"type":"string","description":"Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"dest_grouping_value":{"type":"string","description":"Grouping value for the destination entity. For internal use; not intended for external consumption."},"destination_access_labels":{"type":"array","description":"Labels describing access to data","items":{"type":"string"}},"grantedby_cloud_entity_name":{"type":"string","description":"Name of the cloud entity that granted access"},"grantedby_cloud_entity_id":{"type":"string","description":"Granted by cloud entity ID"},"grantedby_cloud_entity_uai":{"type":"string","description":"Granted by cloud entity UAI"},"grantedby_cloud_entity_type":{"type":"string","description":"Type of the cloud entity that granted access"},"granterCategory":{"type":"string","description":"Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"granter_grouping_value":{"type":"string","description":"Grouping value for the granter entity. For internal use; not intended for external consumption."},"access_levels":{"type":"array","description":"Access levels granted","items":{"type":"string"}},"actions":{"type":"object","description":"Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.","additionalProperties":{"type":"array","items":{"type":"string"}}},"actions_count":{"type":"integer","description":"Total number of actions"},"last_used":{"type":"string","format":"date-time","description":"Timestamp of when access was last used"},"account_access_transformed":{"type":"string","description":"Transformed account access details"},"permission_scope":{"type":"string","description":"Scope of the permission"},"excessive_policies_count":{"type":"integer","description":"Number of excessive policies"},"unused_actions_count":{"type":"integer","description":"Number of unused actions"},"is_last_access_supported":{"type":"boolean","description":"Indicates if last access tracking is supported"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"object","properties":{"err_msg":{"type":"string"}}}}}}}}}}
```

## Retrieve the access conferred by a permission-granting entity

> Retrieves access data for a specific granter entity, identified by its Unique Asset Identifier (UAI). A granter is the entity that confers permissions rather than the identity using them or the resource being reached. Returns all access entries mediated by this entity.\
> \
> Use this endpoint to answer "what access does this permission grant confer, and to whom?". Typical granter entities are permission constructs such as IAM roles, IAM groups, and IAM policies.\
> \
> Supports optional filtering, sorting, and pagination via an optional request body and query parameter.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management  APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"CIEM","description":"APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/ciem/v1/access/granter/{granter_uai}":{"get":{"summary":"Retrieve the access conferred by a permission-granting entity","operationId":"ciemAccessGetByGranter","description":"Retrieves access data for a specific granter entity, identified by its Unique Asset Identifier (UAI). A granter is the entity that confers permissions rather than the identity using them or the resource being reached. Returns all access entries mediated by this entity.\n\nUse this endpoint to answer \"what access does this permission grant confer, and to whom?\". Typical granter entities are permission constructs such as IAM roles, IAM groups, and IAM policies.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.","tags":["CIEM"],"parameters":[{"name":"granter_uai","in":"path","description":"The Unique Asset Identifier (UAI) of the granter entity whose conferred access you want to retrieve.","required":true,"schema":{"type":"string"}},{"name":"next_page_token","in":"query","description":"Base64-encoded pagination token from a previous response to fetch the next page of results.","required":false,"schema":{"type":"string"}},{"in":"header","name":"x-xdr-auth-id","schema":{"type":"string"},"required":true,"description":"{api_key_id}"},{"in":"header","name":"Authorization","schema":{"type":"string"},"required":true,"description":"{api_key}"},{"in":"header","name":"Content-Type","schema":{"type":"string","enum":["application/json"]},"required":true,"description":"Specifies the request body format."}],"requestBody":{"required":false,"description":"Optional request body for filtering and sorting results.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetRequest"}}}},"responses":{"200":{"description":"Successful response with access details for the specified granter.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetResponse"}}}},"400":{"description":"Bad Request. Invalid parameters or pagination token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found. The specified granter UAI does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"Too Many Requests. The request rate limit has been exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"502":{"description":"Bad Gateway. The server received an invalid response from an upstream server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"503":{"description":"Service Unavailable. The service is temporarily unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"CiemAccessGetRequest":{"type":"object","description":"Optional request body for CIEM access GET endpoints, supporting filtering and sorting.","properties":{"filter":{"type":"object","description":"Optional filters to apply to the results.","properties":{"AND":{"type":"array","description":"A list of filter conditions combined with AND logic.","items":{"$ref":"#/components/schemas/GetFilterObject"}}}},"sort":{"type":"array","description":"Optional sorting criteria for the results. The sort array is passed through as-is to the underlying Cortex Platform data endpoint.","items":{"$ref":"#/components/schemas/SortObject"},"minItems":1,"maxItems":1}}},"GetFilterObject":{"type":"object","description":"Filter object for the CIEM access GET endpoints.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Identifies the field to filter.","enum":["access_levels","account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_region","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","destCategory","destination_access_labels","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","granterCategory","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_region","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","sourceCategory","sourceVendorName","unused_actions_count"]},"SEARCH_TYPE":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`","enum":["EQ"]},"SEARCH_VALUE":{"type":"string","description":"Value that this filter must match."}}},"SortObject":{"type":"object","required":["field","order"],"properties":{"field":{"type":"string","description":"The field to sort by.","enum":["account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","is_last_access_supported","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","unused_actions_count"]},"order":{"type":"string","description":"The sort order.","enum":["ASC","DESC"]}}},"CiemAccessGetResponse":{"type":"object","description":"Response object for CIEM access GET endpoints.","properties":{"FILTER_COUNT":{"type":"integer","description":"The number of results matching the applied filters.","format":"int32"},"TOTAL_COUNT":{"type":"integer","description":"The total number of available access records.","format":"int32"},"DATA":{"type":"array","description":"An array of access entries matching the specified UAI.","items":{"$ref":"#/components/schemas/CiemAccessGetEntry"}},"metadata":{"type":"object","description":"Pagination metadata. The `next_page_token` field is present only when additional pages are available.","properties":{"next_page_token":{"type":"string","description":"A base64-encoded token to retrieve the next page of results. Absent on the last page."}}}}},"CiemAccessGetEntry":{"type":"object","description":"Represents a single access entry returned by the CIEM access GET endpoints.","properties":{"source_cloud_resource_name":{"type":"string","description":"Name of the source cloud resource"},"source_cloud_resource_id":{"type":"string","description":"Source cloud resource ID"},"source_cloud_resource_uai":{"type":"string","description":"Source cloud resource UAI"},"source_cloud_resource_type":{"type":"string","description":"Type of the source cloud resource"},"source_cloud_service_name":{"type":"string","description":"Name of the source cloud service"},"source_cloud_region":{"type":"string","description":"Source cloud region"},"sourceCategory":{"type":"string","description":"Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"source_grouping_value":{"type":"string","description":"Grouping value for the source entity. For internal use; not intended for external consumption."},"source_cloud_account_id":{"type":"string","description":"Source cloud account ID"},"source_cloud_account_name":{"type":"string","description":"Name of the source cloud account"},"source_cloud_account_is_vendor":{"type":"boolean","description":"Indicates if the source account is a known vendor"},"sourceVendorName":{"type":"string","description":"Name of the source vendor"},"dest_cloud_account_id":{"type":"string","description":"Destination cloud account ID"},"dest_cloud_account_name":{"type":"string","description":"Name of the destination cloud account"},"dest_cloud_resource_name":{"type":"string","description":"Name of the destination cloud resource"},"dest_cloud_resource_id":{"type":"string","description":"Destination cloud resource ID"},"dest_cloud_resource_uai":{"type":"string","description":"Destination cloud resource UAI"},"dest_cloud_resource_type":{"type":"string","description":"Type of the destination cloud resource"},"dest_cloud_service_name":{"type":"string","description":"Name of the destination cloud service"},"dest_cloud_region":{"type":"string","description":"Destination cloud region"},"destCategory":{"type":"string","description":"Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"dest_grouping_value":{"type":"string","description":"Grouping value for the destination entity. For internal use; not intended for external consumption."},"destination_access_labels":{"type":"array","description":"Labels describing access to data","items":{"type":"string"}},"grantedby_cloud_entity_name":{"type":"string","description":"Name of the cloud entity that granted access"},"grantedby_cloud_entity_id":{"type":"string","description":"Granted by cloud entity ID"},"grantedby_cloud_entity_uai":{"type":"string","description":"Granted by cloud entity UAI"},"grantedby_cloud_entity_type":{"type":"string","description":"Type of the cloud entity that granted access"},"granterCategory":{"type":"string","description":"Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"granter_grouping_value":{"type":"string","description":"Grouping value for the granter entity. For internal use; not intended for external consumption."},"access_levels":{"type":"array","description":"Access levels granted","items":{"type":"string"}},"actions":{"type":"object","description":"Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.","additionalProperties":{"type":"array","items":{"type":"string"}}},"actions_count":{"type":"integer","description":"Total number of actions"},"last_used":{"type":"string","format":"date-time","description":"Timestamp of when access was last used"},"account_access_transformed":{"type":"string","description":"Transformed account access details"},"permission_scope":{"type":"string","description":"Scope of the permission"},"excessive_policies_count":{"type":"integer","description":"Number of excessive policies"},"unused_actions_count":{"type":"integer","description":"Number of unused actions"},"is_last_access_supported":{"type":"boolean","description":"Indicates if last access tracking is supported"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"object","properties":{"err_msg":{"type":"string"}}}}}}}}}}
```

## Retrieve the identities that can access a destination resource

> Retrieves access data for a specific destination cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this resource is the target, mapping out every identity that holds access to it.\
> \
> Use this endpoint to answer "who has access to this resource?". Typical destination assets are storage, data, and compute resources (for example, \`AWS::S3::Bucket\`), and the identities returned include both human users and non-human identities such as service accounts.\
> \
> Supports optional filtering, sorting, and pagination via an optional request body and query parameter.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management  APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"CIEM","description":"APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/ciem/v1/access/destination/{destination_uai}":{"get":{"summary":"Retrieve the identities that can access a destination resource","operationId":"ciemAccessGetByDestination","description":"Retrieves access data for a specific destination cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this resource is the target, mapping out every identity that holds access to it.\n\nUse this endpoint to answer \"who has access to this resource?\". Typical destination assets are storage, data, and compute resources (for example, `AWS::S3::Bucket`), and the identities returned include both human users and non-human identities such as service accounts.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security add-ons.","tags":["CIEM"],"parameters":[{"name":"destination_uai","in":"path","description":"The Unique Asset Identifier (UAI) of the destination cloud resource whose inbound access you want to retrieve.","required":true,"schema":{"type":"string"}},{"name":"next_page_token","in":"query","description":"Base64-encoded pagination token from a previous response to fetch the next page of results.","required":false,"schema":{"type":"string"}},{"in":"header","name":"x-xdr-auth-id","schema":{"type":"string"},"required":true,"description":"{api_key_id}"},{"in":"header","name":"Authorization","schema":{"type":"string"},"required":true,"description":"{api_key}"},{"in":"header","name":"Content-Type","schema":{"type":"string","enum":["application/json"]},"required":true,"description":"Specifies the request body format."}],"requestBody":{"required":false,"description":"Optional request body for filtering and sorting results.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetRequest"}}}},"responses":{"200":{"description":"Successful response with access details for the specified destination.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CiemAccessGetResponse"}}}},"400":{"description":"Bad Request. Invalid parameters or pagination token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found. The specified destination UAI does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"Too Many Requests. The request rate limit has been exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"502":{"description":"Bad Gateway. The server received an invalid response from an upstream server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"503":{"description":"Service Unavailable. The service is temporarily unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"CiemAccessGetRequest":{"type":"object","description":"Optional request body for CIEM access GET endpoints, supporting filtering and sorting.","properties":{"filter":{"type":"object","description":"Optional filters to apply to the results.","properties":{"AND":{"type":"array","description":"A list of filter conditions combined with AND logic.","items":{"$ref":"#/components/schemas/GetFilterObject"}}}},"sort":{"type":"array","description":"Optional sorting criteria for the results. The sort array is passed through as-is to the underlying Cortex Platform data endpoint.","items":{"$ref":"#/components/schemas/SortObject"},"minItems":1,"maxItems":1}}},"GetFilterObject":{"type":"object","description":"Filter object for the CIEM access GET endpoints.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Identifies the field to filter.","enum":["access_levels","account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_region","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","destCategory","destination_access_labels","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","granterCategory","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_region","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","sourceCategory","sourceVendorName","unused_actions_count"]},"SEARCH_TYPE":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`","enum":["EQ"]},"SEARCH_VALUE":{"type":"string","description":"Value that this filter must match."}}},"SortObject":{"type":"object","required":["field","order"],"properties":{"field":{"type":"string","description":"The field to sort by.","enum":["account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","is_last_access_supported","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","unused_actions_count"]},"order":{"type":"string","description":"The sort order.","enum":["ASC","DESC"]}}},"CiemAccessGetResponse":{"type":"object","description":"Response object for CIEM access GET endpoints.","properties":{"FILTER_COUNT":{"type":"integer","description":"The number of results matching the applied filters.","format":"int32"},"TOTAL_COUNT":{"type":"integer","description":"The total number of available access records.","format":"int32"},"DATA":{"type":"array","description":"An array of access entries matching the specified UAI.","items":{"$ref":"#/components/schemas/CiemAccessGetEntry"}},"metadata":{"type":"object","description":"Pagination metadata. The `next_page_token` field is present only when additional pages are available.","properties":{"next_page_token":{"type":"string","description":"A base64-encoded token to retrieve the next page of results. Absent on the last page."}}}}},"CiemAccessGetEntry":{"type":"object","description":"Represents a single access entry returned by the CIEM access GET endpoints.","properties":{"source_cloud_resource_name":{"type":"string","description":"Name of the source cloud resource"},"source_cloud_resource_id":{"type":"string","description":"Source cloud resource ID"},"source_cloud_resource_uai":{"type":"string","description":"Source cloud resource UAI"},"source_cloud_resource_type":{"type":"string","description":"Type of the source cloud resource"},"source_cloud_service_name":{"type":"string","description":"Name of the source cloud service"},"source_cloud_region":{"type":"string","description":"Source cloud region"},"sourceCategory":{"type":"string","description":"Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"source_grouping_value":{"type":"string","description":"Grouping value for the source entity. For internal use; not intended for external consumption."},"source_cloud_account_id":{"type":"string","description":"Source cloud account ID"},"source_cloud_account_name":{"type":"string","description":"Name of the source cloud account"},"source_cloud_account_is_vendor":{"type":"boolean","description":"Indicates if the source account is a known vendor"},"sourceVendorName":{"type":"string","description":"Name of the source vendor"},"dest_cloud_account_id":{"type":"string","description":"Destination cloud account ID"},"dest_cloud_account_name":{"type":"string","description":"Name of the destination cloud account"},"dest_cloud_resource_name":{"type":"string","description":"Name of the destination cloud resource"},"dest_cloud_resource_id":{"type":"string","description":"Destination cloud resource ID"},"dest_cloud_resource_uai":{"type":"string","description":"Destination cloud resource UAI"},"dest_cloud_resource_type":{"type":"string","description":"Type of the destination cloud resource"},"dest_cloud_service_name":{"type":"string","description":"Name of the destination cloud service"},"dest_cloud_region":{"type":"string","description":"Destination cloud region"},"destCategory":{"type":"string","description":"Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"dest_grouping_value":{"type":"string","description":"Grouping value for the destination entity. For internal use; not intended for external consumption."},"destination_access_labels":{"type":"array","description":"Labels describing access to data","items":{"type":"string"}},"grantedby_cloud_entity_name":{"type":"string","description":"Name of the cloud entity that granted access"},"grantedby_cloud_entity_id":{"type":"string","description":"Granted by cloud entity ID"},"grantedby_cloud_entity_uai":{"type":"string","description":"Granted by cloud entity UAI"},"grantedby_cloud_entity_type":{"type":"string","description":"Type of the cloud entity that granted access"},"granterCategory":{"type":"string","description":"Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"granter_grouping_value":{"type":"string","description":"Grouping value for the granter entity. For internal use; not intended for external consumption."},"access_levels":{"type":"array","description":"Access levels granted","items":{"type":"string"}},"actions":{"type":"object","description":"Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.","additionalProperties":{"type":"array","items":{"type":"string"}}},"actions_count":{"type":"integer","description":"Total number of actions"},"last_used":{"type":"string","format":"date-time","description":"Timestamp of when access was last used"},"account_access_transformed":{"type":"string","description":"Transformed account access details"},"permission_scope":{"type":"string","description":"Scope of the permission"},"excessive_policies_count":{"type":"integer","description":"Number of excessive policies"},"unused_actions_count":{"type":"integer","description":"Number of unused actions"},"is_last_access_supported":{"type":"boolean","description":"Indicates if last access tracking is supported"}}},"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"object","properties":{"err_msg":{"type":"string"}}}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-infrastructure-entitlement-management-ciem/ciem.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.