> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/manual-onboarding.md).

# Manual Onboarding

APIs for manually provisioning cloud instances without deploying a Cortex-generated template.

## Create a manually provisioned cloud integration instance

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Create a cloud integration instance from manually provisioned CSP resources. Use this endpoint after you have:\
> \
> 1\. Called \`POST /public\_api/v1/cloud\_onboarding/get\_manual\_connector\_identifiers\` to obtain the identifiers file.\
> 2\. Created all required CSP resources (IAM roles, service accounts, audit-log infrastructure) using the values in the \`identifiers\` section.\
> 3\. Populated the \`manual\_details\` section of the identifiers file with the values retrieved from your CSP environment.\
> \
> Provide the same \`cloud\_provider\`, \`scope\`, \`scan\_mode\`, and capability configuration used when generating the identifiers, together with the completed \`manual\_details\` object.\
> \
> \*\*CSP support:\*\* AWS, Azure, and GCP only.\
> \
> \*\*Scan modes:\*\* \`MANAGED\` (recommended) or \`OUTPOST\`. When \`scan\_mode\` is \`OUTPOST\`, \`outpost\_id\` is required — retrieve the outpost ID from \`POST /public\_api/v1/cloud\_onboarding/get\_outposts\`.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/create_instance":{"post":{"tags":["Manual onboarding"],"summary":"Create a manually provisioned cloud integration instance","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nCreate a cloud integration instance from manually provisioned CSP resources. Use this endpoint after you have:\n\n1. Called `POST /public_api/v1/cloud_onboarding/get_manual_connector_identifiers` to obtain the identifiers file.\n2. Created all required CSP resources (IAM roles, service accounts, audit-log infrastructure) using the values in the `identifiers` section.\n3. Populated the `manual_details` section of the identifiers file with the values retrieved from your CSP environment.\n\nProvide the same `cloud_provider`, `scope`, `scan_mode`, and capability configuration used when generating the identifiers, together with the completed `manual_details` object.\n\n**CSP support:** AWS, Azure, and GCP only.\n\n**Scan modes:** `MANAGED` (recommended) or `OUTPOST`. When `scan_mode` is `OUTPOST`, `outpost_id` is required — retrieve the outpost ID from `POST /public_api/v1/cloud_onboarding/get_outposts`.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInstanceResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"createInstance"}}},"components":{"schemas":{"CreateInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP"],"description":"The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`"},"scope":{"type":"string","enum":["ACCOUNT","ORGANIZATION","ACCOUNT_GROUP"],"description":"Define the scope for this integration instance. Valid values include:\n\n- `ACCOUNT`\n- `ORGANIZATION`\n- `ACCOUNT_GROUP`"},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"],"description":"Define the scan mode. Valid values include:\n\n- `MANAGED`: Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you. When set to `OUTPOST`, `outpost_id` is required."},"manual_details":{"type":"object","description":"The manually provisioned CSP resource details collected from your cloud environment. Fill in the `manual_details` section of the identifiers JSON file downloaded from the Cortex onboarding wizard (or returned by `get_manual_connector_identifiers`) with the values retrieved from your CSP — for example, Role ARN and External ID for AWS, or tenant ID and managed identity details for Azure — then pass the completed object here.","additionalProperties":true},"outpost_id":{"type":"string","description":"The ID of the outpost to use for scanning. Required when `scan_mode` is `OUTPOST`. Retrieve available outpost IDs from `POST /public_api/v1/cloud_onboarding/get_outposts`.","minLength":1},"instance_name":{"type":"string","description":"Optional display name for the integration instance. If omitted, Cortex auto-generates a name using the convention `<CSP>-<accountID>` or `<CSP>-<organizationID>`. Instance names are not required to be unique, but using a unique name per instance is strongly recommended."},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"}},"required":["cloud_provider","scope","scan_mode","manual_details"],"description":"Request body for creating a manually provisioned cloud integration instance. Provide the same `cloud_provider`, `scope`, `scan_mode`, and capability configuration used when calling `get_manual_connector_identifiers`, together with the completed `manual_details` object returned from your CSP environment."}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"CreateInstanceResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing instance information data. It includes a link to download the template file from your tenant.\nIf you use automated upload (only for AWS), the link will take you directly to AWS CloudFormation to create the stack.\nOtherwise, download the template and upload it in your CSP and follow the instructions to manually upload the template:\n- [AWS](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-cloudformation-template-in-aws)\n- [GCP](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform)\n- [Azure](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template)"}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Delete the specified integration instance template

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Delete the specified integration instance template by its template ID. Templates are generated when you call the onboarding or edit endpoints and are used to deploy CSP resources. A single pending instance can produce multiple templates.\
> \
> Deleting a template does not delete the cloud instance itself, nor does it remove any resources already deployed in your CSP. To remove the cloud instance, use \`POST /public\_api/v1/cloud\_onboarding/delete\_instance\`.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/delete_instance_template":{"post":{"tags":["Manual onboarding"],"summary":"Delete the specified integration instance template","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nDelete the specified integration instance template by its template ID. Templates are generated when you call the onboarding or edit endpoints and are used to deploy CSP resources. A single pending instance can produce multiple templates.\n\nDeleting a template does not delete the cloud instance itself, nor does it remove any resources already deployed in your CSP. To remove the cloud instance, use `POST /public_api/v1/cloud_onboarding/delete_instance`.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteInstanceTemplateRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"deleteInstanceTemplate"}}},"components":{"schemas":{"DeleteInstanceTemplateRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"template_id":{"type":"string","description":"The ID of the integration instance template to delete.","minLength":1}},"required":["template_id"],"description":"Request body for deleting an integration instance template. Templates are generated when you call the onboarding or edit endpoints. Deleting a template does not delete the cloud instance or any deployed CSP resources."}}},"BaseResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Edit a manually provisioned cloud integration instance

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Edit an existing manually-onboarded cloud integration instance. Provide the connector ID together with the updated configuration and the refreshed \`manual\_details\`.\
> \
> \*\*Immutable fields:\*\* \`scope\`, \`scan\_mode\`, and \`manual\_details.account\_id\` (or equivalent root account identifier) cannot be changed after onboarding. To change these, delete the instance and create a new one.\
> \
> \*\*Mutable fields:\*\* security capabilities (\`additional\_capabilities\`), scope filters (\`scope\_modifications\`), audit log configuration (\`collection\_configuration\`), instance name, and custom resource tags.\
> \
> After editing, Cortex regenerates the authentication template. Re-deploy the updated template in your CSP to apply the changes. Until the template is re-deployed, the instance remains in a pending-update state.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/edit_manual_instance":{"post":{"tags":["Manual onboarding"],"summary":"Edit a manually provisioned cloud integration instance","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nEdit an existing manually-onboarded cloud integration instance. Provide the connector ID together with the updated configuration and the refreshed `manual_details`.\n\n**Immutable fields:** `scope`, `scan_mode`, and `manual_details.account_id` (or equivalent root account identifier) cannot be changed after onboarding. To change these, delete the instance and create a new one.\n\n**Mutable fields:** security capabilities (`additional_capabilities`), scope filters (`scope_modifications`), audit log configuration (`collection_configuration`), instance name, and custom resource tags.\n\nAfter editing, Cortex regenerates the authentication template. Re-deploy the updated template in your CSP to apply the changes. Until the template is re-deployed, the instance remains in a pending-update state.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EditManualConnectorInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"editManualInstance"}}},"components":{"schemas":{"EditManualConnectorInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"id":{"type":"string","description":"The ID of the connector instance to edit.","minLength":1},"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP"],"description":"The cloud service provider. Only AWS, AZURE, and GCP are supported."},"scope":{"type":"string","enum":["ACCOUNT","ORGANIZATION","ACCOUNT_GROUP"],"description":"The connector scope. Cannot be changed; must match the value used at creation."},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"],"description":"The scan mode. Cannot be changed; must match the value used at creation. When OUTPOST, outpost_id is required."},"manual_details":{"type":"object","description":"Updated provider-specific manual details. account_id cannot be changed and must be provided exactly as it was at creation.","additionalProperties":true},"outpost_id":{"type":"string","description":"The ID of the outpost. Required when scan_mode is OUTPOST.","minLength":1},"instance_name":{"type":"string","description":"Optional display name for the integration instance."},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"description":"The cloud partition. Defaults to COMMERCIAL.","default":"COMMERCIAL"},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"}},"required":["id","cloud_provider","scope","scan_mode","manual_details","additional_capabilities"]}},"description":"Request body for editing a manually-onboarded cloud integration instance. Immutable fields (`scope`, `scan_mode`, root account identifier) cannot be changed — delete and re-create the instance to change these. After editing, re-deploy the updated authentication template in your CSP to apply the changes."},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"BaseResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get the scanning scope of a cloud account

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Retrieve the current per-account scanning scope for a single cloud account, along with the account's environment. The response returns the entire stored scanning scope object as-is.\
> \
> Per-account scanning scope controls which security capabilities are active for individual accounts within a cloud instance. Use \`POST /public\_api/v1/cloud\_onboarding/set\_account\_scanning\_scope\` to update the scope.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_account_scanning_configuration":{"post":{"tags":["Manual onboarding"],"summary":"Get the scanning scope of a cloud account","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nRetrieve the current per-account scanning scope for a single cloud account, along with the account's environment. The response returns the entire stored scanning scope object as-is.\n\nPer-account scanning scope controls which security capabilities are active for individual accounts within a cloud instance. Use `POST /public_api/v1/cloud_onboarding/set_account_scanning_scope` to update the scope.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAccountScanningConfigurationRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAccountScanningConfigurationResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"getAccountScanningConfiguration"}}},"components":{"schemas":{"GetAccountScanningConfigurationRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"account_id":{"type":"string","description":"The cloud account ID whose scanning scope should be retrieved."},"instance_id":{"type":"string","description":"The integration instance ID that owns the account."}},"description":"Identifies the cloud account whose scanning scope should be retrieved. Both `account_id` and `instance_id` are required."}}},"GetAccountScanningConfigurationResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The account's environment and its entire stored scanning scope object.","properties":{"environment":{"type":"string","description":"The environment of the cloud account."},"scanning_scope":{"type":"object","description":"The entire stored scanning scope object for the account, returned as-is. Empty when no scanning scope is set."}}}},"description":"Response containing the account's environment and its entire stored scanning scope object."},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get the specified integration instance edit details

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Retrieve the current editable configuration of the specified integration instance, including any pending (not-yet-applied) changes. Use this endpoint before calling \`POST /public\_api/v1/cloud\_onboarding/edit\_manual\_instance\` to inspect the current state and identify which fields can be modified.\
> \
> The response contains two objects:\
> \
> \- \`fields\` — the current live configuration of the instance.\
> \- \`pending\_changes\` — configuration changes that have been submitted but not yet applied (for example, because the updated authentication template has not been re-deployed in the CSP).\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_edit_instance_details":{"post":{"tags":["Manual onboarding"],"summary":"Get the specified integration instance edit details","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nRetrieve the current editable configuration of the specified integration instance, including any pending (not-yet-applied) changes. Use this endpoint before calling `POST /public_api/v1/cloud_onboarding/edit_manual_instance` to inspect the current state and identify which fields can be modified.\n\nThe response contains two objects:\n\n- `fields` — the current live configuration of the instance.\n- `pending_changes` — configuration changes that have been submitted but not yet applied (for example, because the updated authentication template has not been re-deployed in the CSP).\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetEditInstanceDetailsResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"getEditInstanceDetails"}}},"components":{"schemas":{"GetInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"The ID of the cloud instance of which you want to get the details."}}}}},"GetEditInstanceDetailsResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The editable configuration of the integration instance, containing the current fields and any pending changes.","properties":{"fields":{"type":"object","description":"The current editable configuration fields of the integration instance."},"pending_changes":{"type":"object","description":"Pending (not-yet-applied) configuration changes for the integration instance."}}}},"description":"Response containing the current editable configuration of the integration instance and any pending (not-yet-applied) changes."},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get identifiers for manual integration instance provisioning

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Generate the cloud service provider identifiers and \`manual\_details\` template needed to manually provision a cloud integration instance. This call does not persist any data — it returns a customized identifiers JSON file based on the scope, scan mode, and security capabilities you specify.\
> \
> \*\*Manual onboarding workflow\*\*\
> \
> 1\. Call this endpoint to obtain the identifiers file.\
> 2\. Use the \`identifiers\` section as a reference when creating CSP resources (IAM roles, service accounts, audit-log infrastructure, etc.).\
> 3\. Fill in the \`manual\_details\` section with the values retrieved from your CSP environment (for example, Role ARN, External ID, SQS URL for AWS; tenant ID and managed identity details for Azure).\
> 4\. Call \`POST /public\_api/v1/cloud\_onboarding/create\_instance\` with the completed \`manual\_details\` to finalize onboarding.\
> \
> \*\*CSP support:\*\* AWS, Azure, and GCP only. OCI and Alibaba Cloud do not support manual provisioning.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_manual_connector_identifiers":{"post":{"tags":["Manual onboarding"],"summary":"Get identifiers for manual integration instance provisioning","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nGenerate the cloud service provider identifiers and `manual_details` template needed to manually provision a cloud integration instance. This call does not persist any data — it returns a customized identifiers JSON file based on the scope, scan mode, and security capabilities you specify.\n\n**Manual onboarding workflow**\n\n1. Call this endpoint to obtain the identifiers file.\n2. Use the `identifiers` section as a reference when creating CSP resources (IAM roles, service accounts, audit-log infrastructure, etc.).\n3. Fill in the `manual_details` section with the values retrieved from your CSP environment (for example, Role ARN, External ID, SQS URL for AWS; tenant ID and managed identity details for Azure).\n4. Call `POST /public_api/v1/cloud_onboarding/create_instance` with the completed `manual_details` to finalize onboarding.\n\n**CSP support:** AWS, Azure, and GCP only. OCI and Alibaba Cloud do not support manual provisioning.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetManualConnectorIdentifiersRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetManualConnectorIdentifiersResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"getManualConnectorIdentifiers"}}},"components":{"schemas":{"GetManualConnectorIdentifiersRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP"],"description":"The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`"},"scope":{"type":"string","enum":["ACCOUNT","ORGANIZATION","ACCOUNT_GROUP"],"description":"Define the scope for this integration instance. Valid values include:\n\n- `ACCOUNT`\n- `ORGANIZATION`\n- `ACCOUNT_GROUP`"},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"],"description":"Define the scan mode. Valid values include:\n\n- `MANAGED`: Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you. When set to `OUTPOST`, `outpost_id` is required."},"outpost_id":{"type":"string","description":"The ID of the outpost. Required when scan_mode is OUTPOST.","minLength":1},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"account_details":{"allOf":[{"$ref":"#/components/schemas/AccountDetails"}],"description":"Required for Azure only. Provide the Azure tenant ID as organization_id (for example {\"organization_id\": \"<tenant_id>\"}). The Service Principal (SP) must already exist in the tenant before calling this endpoint. Must not be sent for non-Azure providers."}},"required":["cloud_provider","scope","scan_mode"],"description":"Parameters that define the identifiers to generate. Must match the `cloud_provider`, `scope`, `scan_mode`, and capability configuration you intend to use when calling `create_instance`. Only AWS, Azure, and GCP are supported."}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"AccountDetails":{"type":"object","description":"`account_details` is required for onboarding Azure and is not used for onboarding AWS or GCP.","properties":{"organization_id":{"type":"string","description":"Azure tenant ID","minLength":1}}},"GetManualConnectorIdentifiersResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The cloud service provider identifiers and manual_details template used to manually provision the integration instance.","additionalProperties":true}},"description":"Response containing the generated identifiers file. The `reply` object has two sections:\n\n- `identifiers` — pre-populated CSP-specific values (role names, external IDs, OIDC audience, etc.) to reference when creating CSP resources.\n- `manual_details` — initially empty fields that you populate with values retrieved from your CSP environment, then pass to `create_instance`."},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Mark a manual connector as updated/resolved

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Mark a manually-onboarded connector as updated and resolved by its connector ID. Call this endpoint after you have re-deployed the updated authentication template in your CSP following an edit operation. This signals to Cortex that the manual changes have been applied and clears the pending-update state on the connector.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/manual_update_and_resolve":{"post":{"tags":["Manual onboarding"],"summary":"Mark a manual connector as updated/resolved","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nMark a manually-onboarded connector as updated and resolved by its connector ID. Call this endpoint after you have re-deployed the updated authentication template in your CSP following an edit operation. This signals to Cortex that the manual changes have been applied and clears the pending-update state on the connector.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManualUpdateAndResolveRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"manualUpdateAndResolve"}}},"components":{"schemas":{"ManualUpdateAndResolveRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"instance_id":{"type":"string","description":"The connector GUID. Must be exactly 32 characters.","minLength":32,"maxLength":32}},"required":["instance_id"],"description":"Identifies the manually-onboarded connector to mark as updated/resolved. Call this after re-deploying the updated authentication template in your CSP."}}},"BaseResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Resolve the relevant additional security capabilities for a connector

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Resolve the additional security capabilities available for a given cloud provider, scope, and partition combination, based on your tenant's license. Use this endpoint before onboarding to determine which \`additional\_capabilities\` fields are valid for your configuration.\
> \
> The response returns two lists:\
> \
> \- \`additional\_capabilities\` — capability keys you can set to \`true\` in \`InstanceAdditionalCapabilities\` (for example \`agentless\_disk\_scanning\`, \`registry\_scanning\`).\
> \- \`collection\_configuration\` — collection-configuration keys available for the connector (for example \`audit\_logs\`).\
> \
> \*\*CSP and license constraints apply.\*\* For example, DSPM is not available in GOV partitions; OCI Standard license restricts which capabilities are allowed. See the overview for the full capability matrix.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/resolve_connector_security_capabilities":{"post":{"tags":["Manual onboarding"],"summary":"Resolve the relevant additional security capabilities for a connector","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nResolve the additional security capabilities available for a given cloud provider, scope, and partition combination, based on your tenant's license. Use this endpoint before onboarding to determine which `additional_capabilities` fields are valid for your configuration.\n\nThe response returns two lists:\n\n- `additional_capabilities` — capability keys you can set to `true` in `InstanceAdditionalCapabilities` (for example `agentless_disk_scanning`, `registry_scanning`).\n- `collection_configuration` — collection-configuration keys available for the connector (for example `audit_logs`).\n\n**CSP and license constraints apply.** For example, DSPM is not available in GOV partitions; OCI Standard license restricts which capabilities are allowed. See the overview for the full capability matrix.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetRelevantAdditionalCapabilitiesRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetRelevantAdditionalCapabilitiesResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"resolveConnectorSecurityCapabilities"}}},"components":{"schemas":{"GetRelevantAdditionalCapabilitiesRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"cloud_provider":{"type":"string","enum":["AWS","GCP","AZURE","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider."},"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"],"description":"The connector scope."},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"description":"The cloud partition. Defaults to COMMERCIAL.","default":"COMMERCIAL"}},"required":["cloud_provider","scope"],"description":"Parameters that define the connector configuration to resolve capabilities for. The returned capability list is filtered by your tenant's license and the CSP/partition/scope combination."}}},"GetRelevantAdditionalCapabilitiesResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The available additional capabilities and collection-configuration keys for the given provider/scope, based on the tenant's license.","properties":{"additional_capabilities":{"type":"array","description":"List of available capability keys.","items":{"type":"string"}},"collection_configuration":{"type":"array","description":"List of available collection-configuration keys (for example audit_logs). Omitted when none are available.","items":{"type":"string"}}}}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Set the scanning scope of a cloud account

> {% hint style="info" %}\
> This endpoint is currently available as a hotfix and will be generally available in the next release.\
> {% endhint %}\
> \
> Update the per-account scanning scope for a single cloud account. Provided keys are deep-merged (RFC 7386) onto the stored scanning scope — keys that are not provided are preserved. Only ADS and DSPM scan gates and the ADS tag-based host filter are currently supported.\
> \
> \*\*ADS (\`ads\_scan\_enabled\`):\*\* Enable or disable Agentless Disk Scanning for this account. Enabling requires the \`agentless\_disk\_scanning\` capability to be active on the parent connector.\
> \
> \*\*DSPM (\`dspm\_scan\_enabled\`):\*\* Enable or disable Data Security Posture Management scanning for this account. Enabling requires the \`data\_security\_posture\_management\` capability to be active on the parent connector.\
> \
> \*\*ADS tag filter (\`agentless\_disk\_scanning\_scope\`):\*\* Narrow which hosts ADS scans using INCLUDE or EXCLUDE tag rules. When \`enabled: true\`, both \`type\` and \`tags\` are required.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"tags":[{"name":"Manual onboarding","description":"APIs for manually provisioning cloud instances without deploying a Cortex-generated template."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/set_account_scanning_scope":{"post":{"tags":["Manual onboarding"],"summary":"Set the scanning scope of a cloud account","description":"{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nUpdate the per-account scanning scope for a single cloud account. Provided keys are deep-merged (RFC 7386) onto the stored scanning scope — keys that are not provided are preserved. Only ADS and DSPM scan gates and the ADS tag-based host filter are currently supported.\n\n**ADS (`ads_scan_enabled`):** Enable or disable Agentless Disk Scanning for this account. Enabling requires the `agentless_disk_scanning` capability to be active on the parent connector.\n\n**DSPM (`dspm_scan_enabled`):** Enable or disable Data Security Posture Management scanning for this account. Enabling requires the `data_security_posture_management` capability to be active on the parent connector.\n\n**ADS tag filter (`agentless_disk_scanning_scope`):** Narrow which hosts ADS scans using INCLUDE or EXCLUDE tag rules. When `enabled: true`, both `type` and `tags` are required.\n\n**Required license:** Cortex Cloud Posture Management.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetAccountScanningScopeRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetAccountScanningScopeResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"operationId":"setAccountScanningScope"}}},"components":{"schemas":{"SetAccountScanningScopeRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"account_id":{"type":"string","description":"The cloud account ID whose scanning scope should be updated."},"instance_id":{"type":"string","description":"The integration instance ID that owns the account."},"ads_scan_enabled":{"type":"boolean","description":"Enable (`true`) or disable (`false`) Agentless Disk Scanning for this account. Enabling requires the ADS capability to be active on the connector."},"dspm_scan_enabled":{"type":"boolean","description":"Enable (`true`) or disable (`false`) Data Security Posture Management scanning for this account. Enabling requires the DSPM capability to be active on the connector."},"agentless_disk_scanning_scope":{"type":"object","description":"The ADS tag-based host filter. When enabled, both type and tags are required.","properties":{"enabled":{"type":"boolean"},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true},"tags":{"type":"array","nullable":true,"items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}}}}},"description":"Per-account scanning scope update. Provided keys are deep-merged onto the stored scope; omitted keys are preserved. Only ADS and DSPM scan gates and the ADS tag-based host filter are currently supported."}}},"SetAccountScanningScopeResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/manual-onboarding.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.