> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/policies/models.md).

# Models

## The AndPredicate-Input object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The AndPredicate-Output object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"AndPredicate-Output":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Output":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The AssetMatchingType-Output object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"AssetMatchingType-Output":{"type":"string","enum":["ASSET_GROUPS","ALL_ASSETS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The ErrorExtra object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"ErrorExtra":{"properties":{"field":{"type":"string","title":"Field"},"message":{"type":"string","title":"Message"}},"type":"object","required":["field","message"],"title":"ErrorExtra"}}}}
```

## The ErrorMetadata object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"ErrorMetadata":{"properties":{"err_extra":{"anyOf":[{"items":{"$ref":"#/components/schemas/ErrorExtra"},"type":"array"},{"type":"null"}],"title":"Err Extra"}},"type":"object","title":"ErrorMetadata"},"ErrorExtra":{"properties":{"field":{"type":"string","title":"Field"},"message":{"type":"string","title":"Message"}},"type":"object","required":["field","message"],"title":"ErrorExtra"}}}}
```

## The Filter object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The KeyValue object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The Metadata object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"Metadata":{"properties":{"total_count":{"type":"integer","minimum":0,"title":"Total Count"},"filter_count":{"type":"integer","minimum":0,"title":"Filter Count"}},"type":"object","required":["total_count","filter_count"],"title":"Metadata"}}}}
```

## The OrPredicate-Input object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The OrPredicate-Output object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"OrPredicate-Output":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"AndPredicate-Output":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"}}}}
```

## The Order object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"Order":{"type":"string","enum":["ASC","DESC"],"title":"Order"}}}}
```

## The PolicyListRequest object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyListRequest":{"properties":{"filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"type":"null"}],"title":"Filter","description":"Filter for policies"},"search_from":{"type":"integer","title":"Search From","description":"Start index for pagination","default":0},"search_to":{"type":"integer","title":"Search To","description":"End index for pagination","default":50},"sort":{"items":{"$ref":"#/components/schemas/Sort"},"type":"array","title":"Sort"}},"type":"object","title":"PolicyListRequest"},"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"Sort":{"properties":{"FIELD":{"type":"string","title":"Field"},"ORDER":{"$ref":"#/components/schemas/Order"}},"type":"object","required":["FIELD","ORDER"],"title":"Sort"},"Order":{"type":"string","enum":["ASC","DESC"],"title":"Order"}}}}
```

## The PolicyMode object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyMode":{"type":"string","enum":["DEFAULT","CUSTOM"],"title":"PolicyMode"}}}}
```

## The PolicyModifyRequest object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyModifyRequest":{"properties":{"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"labels":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Labels"},"rule_matching_type":{"anyOf":[{"$ref":"#/components/schemas/InternalRuleMatchingType"},{"type":"null"}],"description":"method of selecting the applicable rules for this policy"},"associated_rule_filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"type":"null"}],"title":"Associated Rule Filter","description":"required if Rule Matching Type is `RULE_FILTER`"},"associated_rule_ids":{"anyOf":[{"items":{"type":"string","format":"uuid"},"type":"array","maxItems":500,"uniqueItems":true},{"type":"null"}],"title":"Associated Rule Ids","description":"required if Rule Matching Type is `RULES`"},"asset_matching_type":{"anyOf":[{"$ref":"#/components/schemas/InternalAssetMatchingType"},{"type":"null"}],"description":"method of selecting the assets in scope for this policy"},"associated_asset_group_ids":{"anyOf":[{"items":{"type":"integer"},"type":"array","maxItems":10,"uniqueItems":true},{"type":"null"}],"title":"Associated Asset Group Ids","description":"required if Asset Matching Type is `ASSET_GROUPS`"},"associated_cloud_account_ids":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Cloud Account Ids","description":"required if Asset Matching Type is `CLOUD_ACCOUNTS`"},"enabled":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Enabled"}},"additionalProperties":false,"type":"object","title":"PolicyModifyRequest"},"InternalRuleMatchingType":{"type":"string","enum":["RULE_FILTER","RULES","ALL_RULES"],"title":"RuleMatchingType"},"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"InternalAssetMatchingType":{"type":"string","enum":["ASSET_GROUPS","ALL_ASSETS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The PolicyResponse object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyResponse":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"name":{"type":"string","title":"Name"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"labels":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Labels"},"rule_matching_type":{"$ref":"#/components/schemas/RuleMatchingType-Output","description":"method of selecting the applicable rules for this policy"},"associated_rule_filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"type":"null"}],"title":"Associated Rule Filter","description":"present if Rule Matching Type is `RULE_FILTER`"},"associated_rule_ids":{"anyOf":[{"items":{"type":"string","format":"uuid"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Rule Ids","description":"present if Rule Matching Type is `RULES`"},"asset_matching_type":{"$ref":"#/components/schemas/AssetMatchingType-Output","description":"method of selecting the assets in scope for this policy"},"associated_asset_group_ids":{"anyOf":[{"items":{"type":"integer"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Asset Group Ids","description":"present if Asset Matching Type is `ASSET_GROUPS`"},"associated_cloud_account_ids":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Cloud Account Ids","description":"present if Asset Matching Type is `CLOUD_ACCOUNTS`"},"enabled":{"type":"boolean","title":"Enabled"},"mode":{"$ref":"#/components/schemas/PolicyMode","description":"whether the policy is built-in (`DEFAULT`) or user-created (`CUSTOM`)"},"creation_time":{"type":"integer","title":"Creation Time","description":"in Unix epoch milliseconds"},"created_by":{"type":"string","title":"Created By"},"modification_time":{"type":"integer","title":"Modification Time","description":"in Unix epoch milliseconds"},"modified_by":{"type":"string","title":"Modified By"}},"type":"object","required":["id","name","rule_matching_type","asset_matching_type","enabled","mode","creation_time","created_by","modification_time","modified_by"],"title":"PolicyResponse"},"RuleMatchingType-Output":{"type":"string","enum":["RULE_FILTER","RULES","ALL_RULES"],"title":"RuleMatchingType"},"AndPredicate-Output":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Output":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"AssetMatchingType-Output":{"type":"string","enum":["ASSET_GROUPS","ALL_ASSETS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"},"PolicyMode":{"type":"string","enum":["DEFAULT","CUSTOM"],"title":"PolicyMode"}}}}
```

## The PublicPolicyCreateRequest object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PublicPolicyCreateRequest":{"properties":{"name":{"type":"string","title":"Name","description":"Name of the policy"},"description":{"type":"string","title":"Description","description":"Description of the policy"},"labels":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Labels","description":"Labels associated with the policy"},"rule_matching_type":{"$ref":"#/components/schemas/PublicRuleMatchingType","description":"Type of rule matching for the policy"},"associated_rule_filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"type":"null"}],"title":"Associated Rule Filter","description":"Rule filter for the policy, required if rule_matching_type is RULE_FILTER"},"associated_rule_ids":{"anyOf":[{"items":{"type":"string","format":"uuid"},"type":"array","maxItems":500},{"type":"null"}],"title":"Associated Rule Ids","description":"List of rule IDs, required if rule_matching_type is RULES"},"asset_matching_type":{"$ref":"#/components/schemas/PublicAssetMatchingType","description":"Type of asset matching for the policy"},"associated_asset_group_ids":{"anyOf":[{"items":{"type":"integer"},"type":"array","maxItems":10},{"type":"null"}],"title":"Associated Asset Group Ids","description":"List of asset group IDs, required if asset_matching_type is ASSET_GROUPS"},"associated_cloud_account_ids":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Associated Cloud Account Ids","description":"List of cloud account IDs associated with the policy"},"enabled":{"type":"boolean","title":"Enabled","description":"Whether the policy is enabled or not","default":true}},"type":"object","required":["name","description","rule_matching_type","asset_matching_type"],"title":"PublicPolicyCreateRequest"},"PublicRuleMatchingType":{"type":"string","enum":["ALL_RULES","RULES","RULE_FILTER"],"title":"RuleMatchingType"},"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"PublicAssetMatchingType":{"type":"string","enum":["ALL_ASSETS","ASSET_GROUPS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The PublicPolicyModifyRequest object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PublicPolicyModifyRequest":{"properties":{"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name","description":"Name of the policy"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description","description":"Description of the policy"},"labels":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Labels","description":"Labels associated with the policy"},"rule_matching_type":{"anyOf":[{"$ref":"#/components/schemas/PublicRuleMatchingType"},{"type":"null"}],"description":"Type of rule matching for the policy"},"associated_rule_filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"type":"null"}],"title":"Associated Rule Filter","description":"Rule filter for the policy, required if rule_matching_type is RULE_FILTER"},"associated_rule_ids":{"anyOf":[{"items":{"type":"string","format":"uuid"},"type":"array","maxItems":500},{"type":"null"}],"title":"Associated Rule Ids","description":"List of rule IDs, required if rule_matching_type is RULES"},"asset_matching_type":{"anyOf":[{"$ref":"#/components/schemas/PublicAssetMatchingType"},{"type":"null"}],"description":"Type of asset matching for the policy"},"associated_asset_group_ids":{"anyOf":[{"items":{"type":"integer"},"type":"array","maxItems":10},{"type":"null"}],"title":"Associated Asset Group Ids","description":"List of asset group IDs, required if asset_matching_type is ASSET_GROUPS"},"associated_cloud_account_ids":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Associated Cloud Account Ids","description":"List of cloud account IDs associated with the policy"},"enabled":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Enabled","description":"Whether the policy is enabled or not"}},"type":"object","title":"PublicPolicyModifyRequest"},"PublicRuleMatchingType":{"type":"string","enum":["ALL_RULES","RULES","RULE_FILTER"],"title":"RuleMatchingType"},"AndPredicate-Input":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Input":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Input"},{"$ref":"#/components/schemas/OrPredicate-Input"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"PublicAssetMatchingType":{"type":"string","enum":["ALL_ASSETS","ASSET_GROUPS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The Range object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"}}}}
```

## The RuleMatchingType-Output object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"RuleMatchingType-Output":{"type":"string","enum":["RULE_FILTER","RULES","ALL_RULES"],"title":"RuleMatchingType"}}}}
```

## The SearchType object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"}}}}
```

## The Sort object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"Sort":{"properties":{"FIELD":{"type":"string","title":"Field"},"ORDER":{"$ref":"#/components/schemas/Order"}},"type":"object","required":["FIELD","ORDER"],"title":"Sort"},"Order":{"type":"string","enum":["ASC","DESC"],"title":"Order"}}}}
```

## The PolicyErrorResponse object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyErrorResponse":{"properties":{"err_msg":{"type":"string","title":"Err Msg"},"metadata":{"anyOf":[{"$ref":"#/components/schemas/ErrorMetadata"},{"type":"null"}]}},"type":"object","required":["err_msg"],"title":"ErrorResponse"},"ErrorMetadata":{"properties":{"err_extra":{"anyOf":[{"items":{"$ref":"#/components/schemas/ErrorExtra"},"type":"array"},{"type":"null"}],"title":"Err Extra"}},"type":"object","title":"ErrorMetadata"},"ErrorExtra":{"properties":{"field":{"type":"string","title":"Field"},"message":{"type":"string","title":"Message"}},"type":"object","required":["field","message"],"title":"ErrorExtra"}}}}
```

## The PolicyListResponse object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PolicyListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/PolicyResponse"},"type":"array","title":"Data","default":[]},"metadata":{"anyOf":[{"$ref":"#/components/schemas/Metadata"},{"type":"null"}]}},"type":"object","title":"ViewDataResponse"},"PolicyResponse":{"properties":{"id":{"type":"string","format":"uuid","title":"Id"},"name":{"type":"string","title":"Name"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"labels":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Labels"},"rule_matching_type":{"$ref":"#/components/schemas/RuleMatchingType-Output","description":"method of selecting the applicable rules for this policy"},"associated_rule_filter":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"type":"null"}],"title":"Associated Rule Filter","description":"present if Rule Matching Type is `RULE_FILTER`"},"associated_rule_ids":{"anyOf":[{"items":{"type":"string","format":"uuid"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Rule Ids","description":"present if Rule Matching Type is `RULES`"},"asset_matching_type":{"$ref":"#/components/schemas/AssetMatchingType-Output","description":"method of selecting the assets in scope for this policy"},"associated_asset_group_ids":{"anyOf":[{"items":{"type":"integer"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Asset Group Ids","description":"present if Asset Matching Type is `ASSET_GROUPS`"},"associated_cloud_account_ids":{"anyOf":[{"items":{"type":"string"},"type":"array","uniqueItems":true},{"type":"null"}],"title":"Associated Cloud Account Ids","description":"present if Asset Matching Type is `CLOUD_ACCOUNTS`"},"enabled":{"type":"boolean","title":"Enabled"},"mode":{"$ref":"#/components/schemas/PolicyMode","description":"whether the policy is built-in (`DEFAULT`) or user-created (`CUSTOM`)"},"creation_time":{"type":"integer","title":"Creation Time","description":"in Unix epoch milliseconds"},"created_by":{"type":"string","title":"Created By"},"modification_time":{"type":"integer","title":"Modification Time","description":"in Unix epoch milliseconds"},"modified_by":{"type":"string","title":"Modified By"}},"type":"object","required":["id","name","rule_matching_type","asset_matching_type","enabled","mode","creation_time","created_by","modification_time","modified_by"],"title":"PolicyResponse"},"RuleMatchingType-Output":{"type":"string","enum":["RULE_FILTER","RULES","ALL_RULES"],"title":"RuleMatchingType"},"AndPredicate-Output":{"properties":{"AND":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"And"}},"type":"object","required":["AND"],"title":"AndPredicate"},"OrPredicate-Output":{"properties":{"OR":{"items":{"anyOf":[{"$ref":"#/components/schemas/AndPredicate-Output"},{"$ref":"#/components/schemas/OrPredicate-Output"},{"$ref":"#/components/schemas/Filter"}]},"type":"array","title":"Or"}},"type":"object","required":["OR"],"title":"OrPredicate"},"Filter":{"properties":{"SEARCH_FIELD":{"type":"string","title":"Search Field"},"SEARCH_TYPE":{"$ref":"#/components/schemas/SearchType"},"SEARCH_VALUE":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"items":{"type":"string"},"type":"array"},{"$ref":"#/components/schemas/Range"},{"$ref":"#/components/schemas/KeyValue"}],"title":"Search Value"}},"type":"object","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"title":"Filter"},"SearchType":{"type":"string","enum":["CONTAINS","NCONTAINS","CONTAINS_IN_LIST","NOT_CONTAINS_IN_LIST","WILDCARD","WILDCARD_NOT","EQ","NEQ","IS_EMPTY","NIS_EMPTY","RANGE","IN","NIN","RELATIVE_TIMESTAMP","JSON_WILDCARD","JSON_WILDCARD_NOT","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS"],"title":"SearchType"},"Range":{"properties":{"from":{"type":"integer","title":"From"},"to":{"type":"integer","title":"To"}},"type":"object","required":["from","to"],"title":"Range"},"KeyValue":{"properties":{"key":{"type":"string","title":"Key"},"value":{"type":"string","title":"Value"}},"type":"object","required":["key","value"],"title":"KeyValue"},"AssetMatchingType-Output":{"type":"string","enum":["ASSET_GROUPS","ALL_ASSETS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"},"PolicyMode":{"type":"string","enum":["DEFAULT","CUSTOM"],"title":"PolicyMode"},"Metadata":{"properties":{"total_count":{"type":"integer","minimum":0,"title":"Total Count"},"filter_count":{"type":"integer","minimum":0,"title":"Filter Count"}},"type":"object","required":["total_count","filter_count"],"title":"Metadata"}}}}
```

## The PublicAssetMatchingType object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PublicAssetMatchingType":{"type":"string","enum":["ALL_ASSETS","ASSET_GROUPS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The PublicRuleMatchingType object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"PublicRuleMatchingType":{"type":"string","enum":["ALL_RULES","RULES","RULE_FILTER"],"title":"RuleMatchingType"}}}}
```

## The InternalAssetMatchingType object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"InternalAssetMatchingType":{"type":"string","enum":["ASSET_GROUPS","ALL_ASSETS","CLOUD_ACCOUNTS"],"title":"AssetMatchingType"}}}}
```

## The InternalRuleMatchingType object

```json
{"openapi":"3.1.0","info":{"title":"Policies","version":"Cortex XDR 5.1"},"components":{"schemas":{"InternalRuleMatchingType":{"type":"string","enum":["RULE_FILTER","RULES","ALL_RULES"],"title":"RuleMatchingType"}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/policies/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.