> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/models.md).

# Models

## The AccountItem object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"AccountItem":{"type":"object","description":"A single cloud account in the list response.","properties":{"account_name":{"type":"string"},"cloud_account_id":{"type":"string","description":"The cloud service provider account identifier"},"account_type":{"type":"string","description":"Type of the account","enum":["ACCOUNT","ORGANIZATION","MANAGEMENT_GROUP","TENANT","WORKSPACE_DOMAIN","PROJECT","ORGANIZATIONAL_UNIT"]},"status":{"type":"string","enum":["ENABLED","DISABLED","DELETED"]},"environment":{"type":"string","enum":["NONE","DEVELOPMENT","STAGING","TESTING","PRODUCTION"]},"created_at":{"type":"integer","format":"int64","description":"Account creation timestamp"}}}}}}
```

## The GetIdentifiersRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetIdentifiersRequestData":{"type":"object","required":["instance_id","cloud_provider"],"properties":{"instance_id":{"type":"string","description":"The cloud instance ID for which you want to list the authorization details."},"cloud_provider":{"type":"string","enum":["GCP"],"description":"The cloud service provider for which you want to list the authorization details."}}}}}}
```

## The GetIdentifiersResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetIdentifiersResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"cortex_discovery_role":{"type":"string","description":"The Cortex discovery role identifier"},"cortex_scan_platform_role":{"type":"string","description":"The Cortex scan platform role identifier"},"cortex_log_collection_role":{"type":"string","description":"The Cortex log collection role identifier"},"cortex_outpost_role":{"type":"string","description":"The Cortex outpost role identifier"}}}}}}}}
```

## The ListCloudProviderRegionsRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"ListCloudProviderRegionsRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider for which you want to list the regions."},"cloud_partition":{"description":"Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants.","default":"COMMERCIAL","enum":["COMMERCIAL","GOV"]}}}}}}}}
```

## The ListCloudProviderRegionsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"ListCloudProviderRegionsResponse":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the CSP region."},"value":{"type":"string"},"type":{"type":"string"}}}}}}}}}
```

## The EnableDisableInstanceRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EnableDisableInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["ids","enable"],"properties":{"ids":{"type":"array","description":"List of cloud instance IDs to enable/disable/","items":{"type":"string"}},"enable":{"type":"boolean","description":"Whether to enable the cloud instances (`true`) or disable (`false`)."}}}}}}}}
```

## The EnableDisableInstancesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EnableDisableInstancesResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}}}}}
```

## The DeleteInstanceRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"DeleteInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["ids"],"properties":{"ids":{"type":"array","description":"List of cloud instance IDs to delete.","items":{"type":"string"}}}}}}}}}
```

## The EditOutpostRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EditOutpostRequestData":{"type":"object","properties":{"request_data":{"type":"object","properties":{"id":{"type":"string","description":"The outpost ID to edit.","minLength":1},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}}},"required":["id","custom_resources_tags"]}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}}}}}
```

## The BaseResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"BaseResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}}}}}
```

## The CreateInstanceTemplateRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"CreateInstanceTemplateRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["scope","scan_mode","cloud_provider","custom_resources_tags","collection_configuration","scope_modifications","additional_capabilities"],"properties":{"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"],"description":"Define the scope for this cloud instance. Valid values include:\n\n- `ORGANIZATION`: Use this to indicate an AWS organization, GCP organization, or Azure tenant.\n- `ACCOUNT_GROUP`: Use this to indicate an AWS account group, GCP folder, or Azure management group.\n- `ACCOUNT`: Use this to indicate an AWS account, GCP project, or Azure subscription."},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"],"description":"Define the scan mode. Valid values include:\n\n- `MANAGED`: (Recommended) Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you.\n\n**Note: ** Scanning with an outpost may require additional CSP permissions and may incur additional CSP costs."},"scan_env_id":{"type":"string","minLength":1,"description":"When the scan mode is `OUTPOST`, you must include the `scan_env_id` field with the outpost ID as the value.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID."},"account_details":{"$ref":"#/components/schemas/AccountDetails"},"instance_name":{"type":"string"},"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`"},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"cloud_partition":{"description":"Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants.","enum":["COMMERCIAL","GOV"]},"gcp_workspace":{"type":"object","description":"GCP Workspace configuration (GCP only).","properties":{"customer_ids":{"type":"array","items":{"type":"string"},"nullable":true},"enabled":{"type":"boolean","default":false}}}}}}},"AccountDetails":{"type":"object","description":"`account_details` is required for onboarding Azure and is not used for onboarding AWS or GCP.","properties":{"organization_id":{"type":"string","description":"Azure tenant ID","minLength":1}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}}}}}
```

## The AccountDetails object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"AccountDetails":{"type":"object","description":"`account_details` is required for onboarding Azure and is not used for onboarding AWS or GCP.","properties":{"organization_id":{"type":"string","description":"Azure tenant ID","minLength":1}}}}}}
```

## The CustomResourceTag object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}}}}}
```

## The InstanceCollectionConfiguration object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}}}}}
```

## The InstanceAuditLogsConfig object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}}}}}
```

## The InstanceScopeModifications object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}}}}}
```

## The InstanceOUConfig object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]}}}}
```

## The InstanceAccountsConfig object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}}}}}
```

## The InstanceRegionsConfig object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}}}}}
```

## The InstanceAdditionalCapabilities object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}}}}}
```

## The RegistryScanningOptions object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}}}}}
```

## The CreateInstanceResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"CreateInstanceResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing instance information data. It includes a link to download the template file from your tenant.\nIf you use automated upload (only for AWS), the link will take you directly to AWS CloudFormation to create the stack.\nOtherwise, download the template and upload it in your CSP and follow the instructions to manually upload the template:\n- [AWS](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-cloudformation-template-in-aws)\n- [GCP](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform)\n- [Azure](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template)"}}}}}}
```

## The EditInstanceRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EditInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["id","scan_env_id","instance_name","cloud_provider","custom_resources_tags","scope_modifications"],"properties":{"id":{"type":"string","description":"The ID of the cloud instance to edit. To obtain instance IDs, use [Get Instances](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances).","minLength":1},"scan_env_id":{"type":"string","description":"The outpost ID to use for security scanning. Required even when the scan mode is `MANAGED` — pass the current outpost ID or an empty string if no outpost is configured.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID.","minLength":1},"instance_name":{"type":"string","description":"The display name of the cloud instance."},"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider of the instance being edited. Must match the provider used when the instance was created. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`"},"custom_resources_tags":{"type":"array","description":"A list of key-value tags applied to the cloud resources that Cortex creates in your CSP account (such as IAM roles and CloudFormation stacks). Updating these tags requires re-executing the authentication template in the CSP.","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"gcp_workspace":{"type":"object","description":"GCP Workspace configuration. Use this to connect a Google Workspace domain to the GCP cloud instance, enabling Cortex to collect Workspace audit logs and assess Workspace security posture. Only applicable when `cloud_provider` is `GCP`.","properties":{"customer_ids":{"type":"array","nullable":true,"description":"A list of Google Workspace customer IDs to associate with this GCP cloud instance.","items":{"type":"string"}},"enabled":{"type":"boolean","default":false,"description":"Whether to enable Google Workspace integration for this GCP cloud instance."}}}}}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}}}}}
```

## The EditInstanceResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EditInstanceResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"automated":{"type":"object","properties":{"link":{"type":"string"},"tracking_guid":{"type":"string"}}},"manual":{"type":"object","properties":{"TF/ARM":{"type":"string"}}}}}}}}}}
```

## The EnableDisableAccountRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EnableDisableAccountRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["ids","instance_id","enable"],"properties":{"ids":{"type":"array","description":"List of account IDs to enable or disable.","items":{"type":"string"}},"instance_id":{"type":"string","description":"The cloud instance ID where the cloud accounts should be disabled."},"enable":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`) to specified accounts."}}}}}}}}
```

## The EnableDisableAccountResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EnableDisableAccountResponse":{"type":"object","properties":{"reply":{"type":"object"}}}}}}
```

## The GetAzureApprovedTenantsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetAzureApprovedTenantsResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing the Azure tenant ID and whether the tenant is approved."}}}}}}
```

## The CreateOutpostTemplateRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"CreateOutpostTemplateRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["cloud_provider","custom_resources_tags"],"properties":{"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI"],"description":"The cloud service provider for which to create the outpost template. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`"},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"default":"COMMERCIAL","description":"Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants."},"custom_resources_tags":{"type":"array","description":"A list of key-value tags applied to the cloud resources that Cortex creates in your CSP account as part of the outpost deployment (such as IAM roles and storage resources). These tags help you identify and manage Cortex-managed resources in your cloud environment.","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"instance_name":{"type":"string","maxLength":255,"default":"","description":"An optional display name for the outpost. If not provided, Cortex auto-generates a name based on the account details. Maximum 255 characters."},"app_registration_mode":{"type":"string","enum":["cortex_managed","customer_managed"],"default":"cortex_managed","description":"Controls whether Cortex creates and manages the Azure AD app registration used by the outpost, or whether you provide your own. Only applicable when `cloud_provider` is `AZURE`.\n\n- `cortex_managed`: (Default) Cortex automatically creates and manages the Azure AD app registration required for the outpost to authenticate with Azure.\n- `customer_managed`: You provide an existing Azure AD app registration. Use this when your organization's security policies require you to control app registrations. When set to `customer_managed`, you must also provide `customer_app_client_id` and `customer_sp_object_id`."},"customer_app_client_id":{"type":"string","default":"","description":"The client ID (application ID) of your existing Azure AD app registration to use for the outpost. Required when `app_registration_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"customer_sp_object_id":{"type":"string","default":"","description":"The object ID of the service principal associated with your Azure AD app registration. Required when `app_registration_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"uami_mode":{"type":"string","enum":["cortex_managed","customer_managed"],"default":"cortex_managed","description":"Controls whether Cortex creates and manages the User-Assigned Managed Identities (UAMIs) used by the outpost for each security capability, or whether you provide your own. Only applicable when `cloud_provider` is `AZURE`.\n\n- `cortex_managed`: (Default) Cortex automatically creates and manages the UAMIs required for each enabled security capability.\n- `customer_managed`: You provide existing UAMIs for each capability. Use this when your organization requires control over managed identity assignments. When set to `customer_managed`, provide the relevant `customer_uami_*` fields for each capability you want to enable."},"customer_uami_agentless_id":{"type":"string","default":"","description":"The resource ID of your existing Azure User-Assigned Managed Identity to use for agentless disk scanning. Required when `uami_mode` is `customer_managed` and agentless disk scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"customer_uami_dspm_id":{"type":"string","default":"","description":"The resource ID of your existing Azure User-Assigned Managed Identity to use for Data Security Posture Management (DSPM) scanning. Required when `uami_mode` is `customer_managed` and DSPM is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"customer_uami_registry_id":{"type":"string","default":"","description":"The resource ID of your existing Azure User-Assigned Managed Identity to use for container registry scanning. Required when `uami_mode` is `customer_managed` and registry scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"customer_uami_serverless_id":{"type":"string","default":"","description":"The resource ID of your existing Azure User-Assigned Managed Identity to use for serverless function scanning. Required when `uami_mode` is `customer_managed` and serverless scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."},"customer_uami_proxy_id":{"type":"string","default":"","description":"The resource ID of your existing Azure User-Assigned Managed Identity to use for the outpost proxy component, which handles secure communication between the outpost and Cortex. Required when `uami_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`."}}}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}}}}}
```

## The CreateOutpostResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"CreateOutpostResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing a link to download the outpost template"}}}}}}
```

## The EditOutpostRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EditOutpostRequest":{"type":"object","properties":{"request_data":{"type":"object","properties":{"id":{"type":"string"},"custom_resources_tags":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}}}}}}}}}
```

## The GetInstanceRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"The ID of the cloud instance of which you want to get the details."}}}}}}}}
```

## The GetInstanceDetailsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetInstanceDetailsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"id":{"type":"string"},"collector":{"type":"string"},"instance_name":{"type":"string"},"scope":{"type":"string"},"tags":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"status":{"type":"string","description":"Overall status of the cloud instance.","enum":["CONNECTED","WARNING","ERROR","DISABLED","PENDING"]},"cloud_provider":{"type":"string","description":"The cloud service provider.","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"]},"scan":{"type":"object","properties":{"scan_method":{"type":"string","description":"The scan method used.","enum":["MANAGED","OUTPOST"]},"outpost_id":{"type":"string","description":"The outpost ID. Only present when `scan_method` is `OUTPOST`."}}},"security_capabilities":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"integer","description":"Status of the security capability. One of: `0` (CONNECTED), `1` (WARNING), `2` (DISABLED), `3` (ERROR), `4` (NA).","enum":[0,1,2,3,4]}}}},"upgrade_available":{"type":"boolean"},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"]},"collection_configuration":{"type":"string","description":"JSON-encoded string of the collection configuration for this cloud instance."},"additional_capabilities":{"type":"string","description":"JSON-encoded string of the additional capabilities enabled for this cloud instance."}}}}}}}}
```

## The InstanceListItem object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"InstanceListItem":{"type":"object","description":"A single cloud instance in the list response.","properties":{"instance_id":{"type":"string","description":"Unique identifier of the cloud instance"},"cloud_provider":{"type":"string","enum":["AWS","GCP","AZURE","OCI","ALIBABA_CLOUD"]},"instance_name":{"type":"string","description":"Display name of the cloud instance"},"account_name":{"type":"string","nullable":true,"description":"The display name of the primary account associated with this cloud instance. For organization and organizational unit scopes, this field may be empty if no account name association is found."},"accounts":{"type":"integer","nullable":true,"description":"Count of non-deleted accounts (integer, not an object)"},"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"]},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"]},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"nullable":true},"creation_time":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"custom_resources_tags":{"type":"string","description":"JSON-encoded string of custom resource tags"},"provisioning_method":{"type":"string","nullable":true,"enum":["TF","TF_M","CF","CF_M","GCDM","ARM","BICEP_M","MANUAL"]},"additional_capabilities":{"type":"string","description":"JSON-encoded string of additional capabilities"},"update_status":{"type":"string","nullable":true,"enum":["UP_TO_DATE","UPDATE_AVAILABLE"]},"is_pending_changes":{"type":"integer","nullable":true,"description":"0 (no pending changes) or 1 (has pending changes)"},"status":{"type":"string","enum":["CONNECTED","WARNING","ERROR","DISABLED","PENDING"]},"outpost_id":{"type":"string","nullable":true,"description":"ID of the associated outpost"}}}}}}
```

## The ListInstancesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"ListInstancesRequestData":{"type":"object","properties":{"request_data":{"type":"object","description":"Valid values for the sort field `FIELD` the filter field `SEARCH_FIELD` include:\n\n- `STATUS` \n- `PROVIDER` \n- `INSTANCE_NAME` \n- `SCOPE` \n- `SCAN_MODE` \n- `CREATION_TIME` \n- `OUTPOST_ID` \n- `AUTHENTICATION_METHOD` \n- `ID`","properties":{"filter_data":{"$ref":"#/components/schemas/FilterData"}}}}},"FilterData":{"type":"object","properties":{"sort":{"type":"array","description":"Sorting criteria for the results","items":{"$ref":"#/components/schemas/SortCriteria"}},"paging":{"$ref":"#/components/schemas/Paging"},"filter":{"description":"Filter criteria for the results.","oneOf":[{"$ref":"#/components/schemas/AndPredicate"},{"$ref":"#/components/schemas/OrPredicate"},{"type":"object"}]}}},"SortCriteria":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field to sort by."},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Whether to sort in ascending (`ASC`) order or descending (`DESC`) order."}}},"Paging":{"type":"object","properties":{"from":{"type":"integer","description":"The starting index for pagination.","minimum":0},"to":{"type":"integer","description":"The ending index for pagination.","minimum":1}}},"AndPredicate":{"type":"object","properties":{"AND":{"type":"array","description":"A list of filter criteria to be combined with AND logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"OrPredicate":{"type":"object","properties":{"OR":{"type":"array","description":"A list of filter criteria to be combined with OR logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}}}}}
```

## The FilterData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"FilterData":{"type":"object","properties":{"sort":{"type":"array","description":"Sorting criteria for the results","items":{"$ref":"#/components/schemas/SortCriteria"}},"paging":{"$ref":"#/components/schemas/Paging"},"filter":{"description":"Filter criteria for the results.","oneOf":[{"$ref":"#/components/schemas/AndPredicate"},{"$ref":"#/components/schemas/OrPredicate"},{"type":"object"}]}}},"SortCriteria":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field to sort by."},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Whether to sort in ascending (`ASC`) order or descending (`DESC`) order."}}},"Paging":{"type":"object","properties":{"from":{"type":"integer","description":"The starting index for pagination.","minimum":0},"to":{"type":"integer","description":"The ending index for pagination.","minimum":1}}},"AndPredicate":{"type":"object","properties":{"AND":{"type":"array","description":"A list of filter criteria to be combined with AND logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"OrPredicate":{"type":"object","properties":{"OR":{"type":"array","description":"A list of filter criteria to be combined with OR logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}}}}}
```

## The SortCriteria object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"SortCriteria":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field to sort by."},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Whether to sort in ascending (`ASC`) order or descending (`DESC`) order."}}}}}}
```

## The Paging object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"Paging":{"type":"object","properties":{"from":{"type":"integer","description":"The starting index for pagination.","minimum":0},"to":{"type":"integer","description":"The ending index for pagination.","minimum":1}}}}}}
```

## The AndPredicate object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"AndPredicate":{"type":"object","properties":{"AND":{"type":"array","description":"A list of filter criteria to be combined with AND logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The FilterCriteria object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The OrPredicate object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"OrPredicate":{"type":"object","properties":{"OR":{"type":"array","description":"A list of filter criteria to be combined with OR logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The GetInstancesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetInstancesResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/InstanceListItem"}},"FILTER_COUNT":{"type":"integer"},"TOTAL_COUNT":{"type":"integer"}}}}},"InstanceListItem":{"type":"object","description":"A single cloud instance in the list response.","properties":{"instance_id":{"type":"string","description":"Unique identifier of the cloud instance"},"cloud_provider":{"type":"string","enum":["AWS","GCP","AZURE","OCI","ALIBABA_CLOUD"]},"instance_name":{"type":"string","description":"Display name of the cloud instance"},"account_name":{"type":"string","nullable":true,"description":"The display name of the primary account associated with this cloud instance. For organization and organizational unit scopes, this field may be empty if no account name association is found."},"accounts":{"type":"integer","nullable":true,"description":"Count of non-deleted accounts (integer, not an object)"},"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"]},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"]},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"nullable":true},"creation_time":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"custom_resources_tags":{"type":"string","description":"JSON-encoded string of custom resource tags"},"provisioning_method":{"type":"string","nullable":true,"enum":["TF","TF_M","CF","CF_M","GCDM","ARM","BICEP_M","MANUAL"]},"additional_capabilities":{"type":"string","description":"JSON-encoded string of additional capabilities"},"update_status":{"type":"string","nullable":true,"enum":["UP_TO_DATE","UPDATE_AVAILABLE"]},"is_pending_changes":{"type":"integer","nullable":true,"description":"0 (no pending changes) or 1 (has pending changes)"},"status":{"type":"string","enum":["CONNECTED","WARNING","ERROR","DISABLED","PENDING"]},"outpost_id":{"type":"string","nullable":true,"description":"ID of the associated outpost"}}}}}}
```

## The GetAccountsRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetAccountsRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["instance_id"],"description":"Valid values for the filter field `SEARCH_FIELD` include:\n\n- `STATUS`\n- `ACCOUNT_NAME`\n- `CLOUD_ACCOUNT_ID`\n- `ENVIRONMENT`\n- `TYPE`\n- `CREATED_AT`","properties":{"instance_id":{"type":"string","description":"The ID of the cloud instance for which to list accounts. To obtain instance IDs, use [Get Instances](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances)."},"filter_data":{"$ref":"#/components/schemas/FilterData"}}}}},"FilterData":{"type":"object","properties":{"sort":{"type":"array","description":"Sorting criteria for the results","items":{"$ref":"#/components/schemas/SortCriteria"}},"paging":{"$ref":"#/components/schemas/Paging"},"filter":{"description":"Filter criteria for the results.","oneOf":[{"$ref":"#/components/schemas/AndPredicate"},{"$ref":"#/components/schemas/OrPredicate"},{"type":"object"}]}}},"SortCriteria":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field to sort by."},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Whether to sort in ascending (`ASC`) order or descending (`DESC`) order."}}},"Paging":{"type":"object","properties":{"from":{"type":"integer","description":"The starting index for pagination.","minimum":0},"to":{"type":"integer","description":"The ending index for pagination.","minimum":1}}},"AndPredicate":{"type":"object","properties":{"AND":{"type":"array","description":"A list of filter criteria to be combined with AND logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"OrPredicate":{"type":"object","properties":{"OR":{"type":"array","description":"A list of filter criteria to be combined with OR logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}}}}}
```

## The GetAccountsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"GetAccountsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/AccountItem"}},"FILTER_COUNT":{"type":"integer"},"TOTAL_COUNT":{"type":"integer"}}}}},"AccountItem":{"type":"object","description":"A single cloud account in the list response.","properties":{"account_name":{"type":"string"},"cloud_account_id":{"type":"string","description":"The cloud service provider account identifier"},"account_type":{"type":"string","description":"Type of the account","enum":["ACCOUNT","ORGANIZATION","MANAGEMENT_GROUP","TENANT","WORKSPACE_DOMAIN","PROJECT","ORGANIZATIONAL_UNIT"]},"status":{"type":"string","enum":["ENABLED","DISABLED","DELETED"]},"environment":{"type":"string","enum":["NONE","DEVELOPMENT","STAGING","TESTING","PRODUCTION"]},"created_at":{"type":"integer","format":"int64","description":"Account creation timestamp"}}}}}}
```

## The BaseError object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}}}}
```

## The EditOutpostResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XDR 5.x"},"components":{"schemas":{"EditOutpostResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"automated":{"type":"object","properties":{"link":{"type":"string"},"tracking_guid":{"type":"string"}}},"manual":{"type":"object","properties":{"TF/ARM":{"type":"string"}}}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.