> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-infrastructure-entitlement-management-ciem/models.md).

# Models

## The SortObject object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SortObject":{"type":"object","required":["field","order"],"properties":{"field":{"type":"string","description":"The field to sort by.","enum":["account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","is_last_access_supported","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","unused_actions_count"]},"order":{"type":"string","description":"The sort order.","enum":["ASC","DESC"]}}}}}}
```

## The ErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"object","properties":{"err_msg":{"type":"string"}}}}}}}}}}
```

## The CustomLeastPrivilegedAccessResponseDto object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CustomLeastPrivilegedAccessResponseDto":{"type":"object","description":"Response containing the generated Least Privilege Access configuration for the asset.","properties":{"recommendationSnippets":{"$ref":"#/components/schemas/RecommendationSnippetsDto"},"verdicts":{"type":"array","description":"List of permission verdicts for each action associated with the asset. Each verdict indicates whether the action should be kept or removed based on usage during the lookback period.","items":{"$ref":"#/components/schemas/LeastPrivilegedPermissionVerdict"}},"recommendedActionType":{"type":"string","description":"The recommended remediation action based on the evaluation of the asset's permissions.\n- `applySnippets` — The asset has excess permissions. Apply the configuration snippets in `recommendationSnippets` to enforce least-privilege access.\n- `removeAllPolicies` — No actions were observed during the lookback period. Remove all policies or roles currently assigned to the asset.\n- `noActionRequired` — The asset's current permissions already satisfy least-privilege requirements. No remediation is needed.\n- `manuallyRemoveUnusedActions` — The asset has unused permissions that cannot be automatically remediated using configuration snippets. Review and remove the unused permissions manually.","enum":["applySnippets","removeAllPolicies","noActionRequired","manuallyRemoveUnusedActions"]}}},"RecommendationSnippetsDto":{"type":"object","description":"Remediation configuration snippets for applying the recommended least-privilege permissions. Depending on the requested `output_format`, one or more fields are populated.","properties":{"json":{"type":"array","description":"Remediation snippets in JSON format. Returned when `output_format=JSON` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A serialized JSON string representing a single cloud API call. Parse this string as JSON to access the `url` and `body` fields."}},"terraform":{"type":"array","description":"Remediation snippets in Terraform format. Returned when `output_format=TERRAFORM` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A Terraform HCL resource block string defining the least-privilege role or policy."}},"cloudFormation":{"type":"array","description":"Remediation snippets in AWS CloudFormation format. Returned when `output_format=CF` or `output_format=ALL`. Supported for AWS only.","items":{"type":"string","description":"An AWS CloudFormation template fragment string defining the least-privilege IAM policy or role."}},"cli":{"type":"array","description":"Remediation snippets as Google Cloud CLI (gcloud) commands. Returned when `output_format=CLI` or `output_format=ALL`. Supported for GCP only.","items":{"type":"string"}}}},"LeastPrivilegedPermissionVerdict":{"type":"object","description":"List of permission verdicts for actions associated with the asset. Each verdict indicates whether an action should be retained or removed based on its usage during the specified lookback period.","properties":{"actionName":{"type":"string","description":"The cloud permission action that was evaluated. The format varies by cloud provider (for example, `s3:PutObject` for AWS, `Microsoft.Compute/disks/write` for Azure, or `compute.instances.get` for GCP)."},"policyName":{"type":"string","description":"Name of the policy or role that grants the evaluated action."},"recommendation":{"type":"string","description":"Recommended action for the evaluated permission.\n- `Keep` — The action was used during the lookback period and should be retained.\n- `Remove` — The action was not used during the lookback period and should be removed to enforce least privilege.","enum":["Keep","Remove"]},"source":{"type":"string","description":"Source of the access data used to determine the recommendation.\n- `CIEM_LAST_ACCESS` — Based on last-access activity collected by CIEM.\n- `ACCESS_ADVISOR` — Based on access advisor data provided by the cloud provider (for example, AWS IAM Access Advisor), which reports the last time a service was accessed.","enum":["CIEM_LAST_ACCESS","ACCESS_ADVISOR"]}}}}}}
```

## The RecommendationSnippetsDto object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"RecommendationSnippetsDto":{"type":"object","description":"Remediation configuration snippets for applying the recommended least-privilege permissions. Depending on the requested `output_format`, one or more fields are populated.","properties":{"json":{"type":"array","description":"Remediation snippets in JSON format. Returned when `output_format=JSON` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A serialized JSON string representing a single cloud API call. Parse this string as JSON to access the `url` and `body` fields."}},"terraform":{"type":"array","description":"Remediation snippets in Terraform format. Returned when `output_format=TERRAFORM` or `output_format=ALL`. Supported for AWS, Azure, and GCP.","items":{"type":"string","description":"A Terraform HCL resource block string defining the least-privilege role or policy."}},"cloudFormation":{"type":"array","description":"Remediation snippets in AWS CloudFormation format. Returned when `output_format=CF` or `output_format=ALL`. Supported for AWS only.","items":{"type":"string","description":"An AWS CloudFormation template fragment string defining the least-privilege IAM policy or role."}},"cli":{"type":"array","description":"Remediation snippets as Google Cloud CLI (gcloud) commands. Returned when `output_format=CLI` or `output_format=ALL`. Supported for GCP only.","items":{"type":"string"}}}}}}}
```

## The LeastPrivilegedPermissionVerdict object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"LeastPrivilegedPermissionVerdict":{"type":"object","description":"List of permission verdicts for actions associated with the asset. Each verdict indicates whether an action should be retained or removed based on its usage during the specified lookback period.","properties":{"actionName":{"type":"string","description":"The cloud permission action that was evaluated. The format varies by cloud provider (for example, `s3:PutObject` for AWS, `Microsoft.Compute/disks/write` for Azure, or `compute.instances.get` for GCP)."},"policyName":{"type":"string","description":"Name of the policy or role that grants the evaluated action."},"recommendation":{"type":"string","description":"Recommended action for the evaluated permission.\n- `Keep` — The action was used during the lookback period and should be retained.\n- `Remove` — The action was not used during the lookback period and should be removed to enforce least privilege.","enum":["Keep","Remove"]},"source":{"type":"string","description":"Source of the access data used to determine the recommendation.\n- `CIEM_LAST_ACCESS` — Based on last-access activity collected by CIEM.\n- `ACCESS_ADVISOR` — Based on access advisor data provided by the cloud provider (for example, AWS IAM Access Advisor), which reports the last time a service was accessed.","enum":["CIEM_LAST_ACCESS","ACCESS_ADVISOR"]}}}}}}
```

## The CiemAccessGetRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CiemAccessGetRequest":{"type":"object","description":"Optional request body for CIEM access GET endpoints, supporting filtering and sorting.","properties":{"filter":{"type":"object","description":"Optional filters to apply to the results.","properties":{"AND":{"type":"array","description":"A list of filter conditions combined with AND logic.","items":{"$ref":"#/components/schemas/GetFilterObject"}}}},"sort":{"type":"array","description":"Optional sorting criteria for the results. The sort array is passed through as-is to the underlying Cortex Platform data endpoint.","items":{"$ref":"#/components/schemas/SortObject"},"minItems":1,"maxItems":1}}},"GetFilterObject":{"type":"object","description":"Filter object for the CIEM access GET endpoints.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Identifies the field to filter.","enum":["access_levels","account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_region","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","destCategory","destination_access_labels","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","granterCategory","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_region","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","sourceCategory","sourceVendorName","unused_actions_count"]},"SEARCH_TYPE":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`","enum":["EQ"]},"SEARCH_VALUE":{"type":"string","description":"Value that this filter must match."}}},"SortObject":{"type":"object","required":["field","order"],"properties":{"field":{"type":"string","description":"The field to sort by.","enum":["account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","is_last_access_supported","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","unused_actions_count"]},"order":{"type":"string","description":"The sort order.","enum":["ASC","DESC"]}}}}}}
```

## The CiemAccessGetResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CiemAccessGetResponse":{"type":"object","description":"Response object for CIEM access GET endpoints.","properties":{"FILTER_COUNT":{"type":"integer","description":"The number of results matching the applied filters.","format":"int32"},"TOTAL_COUNT":{"type":"integer","description":"The total number of available access records.","format":"int32"},"DATA":{"type":"array","description":"An array of access entries matching the specified UAI.","items":{"$ref":"#/components/schemas/CiemAccessGetEntry"}},"metadata":{"type":"object","description":"Pagination metadata. The `next_page_token` field is present only when additional pages are available.","properties":{"next_page_token":{"type":"string","description":"A base64-encoded token to retrieve the next page of results. Absent on the last page."}}}}},"CiemAccessGetEntry":{"type":"object","description":"Represents a single access entry returned by the CIEM access GET endpoints.","properties":{"source_cloud_resource_name":{"type":"string","description":"Name of the source cloud resource"},"source_cloud_resource_id":{"type":"string","description":"Source cloud resource ID"},"source_cloud_resource_uai":{"type":"string","description":"Source cloud resource UAI"},"source_cloud_resource_type":{"type":"string","description":"Type of the source cloud resource"},"source_cloud_service_name":{"type":"string","description":"Name of the source cloud service"},"source_cloud_region":{"type":"string","description":"Source cloud region"},"sourceCategory":{"type":"string","description":"Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"source_grouping_value":{"type":"string","description":"Grouping value for the source entity. For internal use; not intended for external consumption."},"source_cloud_account_id":{"type":"string","description":"Source cloud account ID"},"source_cloud_account_name":{"type":"string","description":"Name of the source cloud account"},"source_cloud_account_is_vendor":{"type":"boolean","description":"Indicates if the source account is a known vendor"},"sourceVendorName":{"type":"string","description":"Name of the source vendor"},"dest_cloud_account_id":{"type":"string","description":"Destination cloud account ID"},"dest_cloud_account_name":{"type":"string","description":"Name of the destination cloud account"},"dest_cloud_resource_name":{"type":"string","description":"Name of the destination cloud resource"},"dest_cloud_resource_id":{"type":"string","description":"Destination cloud resource ID"},"dest_cloud_resource_uai":{"type":"string","description":"Destination cloud resource UAI"},"dest_cloud_resource_type":{"type":"string","description":"Type of the destination cloud resource"},"dest_cloud_service_name":{"type":"string","description":"Name of the destination cloud service"},"dest_cloud_region":{"type":"string","description":"Destination cloud region"},"destCategory":{"type":"string","description":"Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"dest_grouping_value":{"type":"string","description":"Grouping value for the destination entity. For internal use; not intended for external consumption."},"destination_access_labels":{"type":"array","description":"Labels describing access to data","items":{"type":"string"}},"grantedby_cloud_entity_name":{"type":"string","description":"Name of the cloud entity that granted access"},"grantedby_cloud_entity_id":{"type":"string","description":"Granted by cloud entity ID"},"grantedby_cloud_entity_uai":{"type":"string","description":"Granted by cloud entity UAI"},"grantedby_cloud_entity_type":{"type":"string","description":"Type of the cloud entity that granted access"},"granterCategory":{"type":"string","description":"Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"granter_grouping_value":{"type":"string","description":"Grouping value for the granter entity. For internal use; not intended for external consumption."},"access_levels":{"type":"array","description":"Access levels granted","items":{"type":"string"}},"actions":{"type":"object","description":"Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.","additionalProperties":{"type":"array","items":{"type":"string"}}},"actions_count":{"type":"integer","description":"Total number of actions"},"last_used":{"type":"string","format":"date-time","description":"Timestamp of when access was last used"},"account_access_transformed":{"type":"string","description":"Transformed account access details"},"permission_scope":{"type":"string","description":"Scope of the permission"},"excessive_policies_count":{"type":"integer","description":"Number of excessive policies"},"unused_actions_count":{"type":"integer","description":"Number of unused actions"},"is_last_access_supported":{"type":"boolean","description":"Indicates if last access tracking is supported"}}}}}}
```

## The CiemAccessGetEntry object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CiemAccessGetEntry":{"type":"object","description":"Represents a single access entry returned by the CIEM access GET endpoints.","properties":{"source_cloud_resource_name":{"type":"string","description":"Name of the source cloud resource"},"source_cloud_resource_id":{"type":"string","description":"Source cloud resource ID"},"source_cloud_resource_uai":{"type":"string","description":"Source cloud resource UAI"},"source_cloud_resource_type":{"type":"string","description":"Type of the source cloud resource"},"source_cloud_service_name":{"type":"string","description":"Name of the source cloud service"},"source_cloud_region":{"type":"string","description":"Source cloud region"},"sourceCategory":{"type":"string","description":"Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"source_grouping_value":{"type":"string","description":"Grouping value for the source entity. For internal use; not intended for external consumption."},"source_cloud_account_id":{"type":"string","description":"Source cloud account ID"},"source_cloud_account_name":{"type":"string","description":"Name of the source cloud account"},"source_cloud_account_is_vendor":{"type":"boolean","description":"Indicates if the source account is a known vendor"},"sourceVendorName":{"type":"string","description":"Name of the source vendor"},"dest_cloud_account_id":{"type":"string","description":"Destination cloud account ID"},"dest_cloud_account_name":{"type":"string","description":"Name of the destination cloud account"},"dest_cloud_resource_name":{"type":"string","description":"Name of the destination cloud resource"},"dest_cloud_resource_id":{"type":"string","description":"Destination cloud resource ID"},"dest_cloud_resource_uai":{"type":"string","description":"Destination cloud resource UAI"},"dest_cloud_resource_type":{"type":"string","description":"Type of the destination cloud resource"},"dest_cloud_service_name":{"type":"string","description":"Name of the destination cloud service"},"dest_cloud_region":{"type":"string","description":"Destination cloud region"},"destCategory":{"type":"string","description":"Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"dest_grouping_value":{"type":"string","description":"Grouping value for the destination entity. For internal use; not intended for external consumption."},"destination_access_labels":{"type":"array","description":"Labels describing access to data","items":{"type":"string"}},"grantedby_cloud_entity_name":{"type":"string","description":"Name of the cloud entity that granted access"},"grantedby_cloud_entity_id":{"type":"string","description":"Granted by cloud entity ID"},"grantedby_cloud_entity_uai":{"type":"string","description":"Granted by cloud entity UAI"},"grantedby_cloud_entity_type":{"type":"string","description":"Type of the cloud entity that granted access"},"granterCategory":{"type":"string","description":"Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.","enum":["Human","Non-human","Cloud Service Account","IAM Group","IAM Policy"]},"granter_grouping_value":{"type":"string","description":"Grouping value for the granter entity. For internal use; not intended for external consumption."},"access_levels":{"type":"array","description":"Access levels granted","items":{"type":"string"}},"actions":{"type":"object","description":"Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.","additionalProperties":{"type":"array","items":{"type":"string"}}},"actions_count":{"type":"integer","description":"Total number of actions"},"last_used":{"type":"string","format":"date-time","description":"Timestamp of when access was last used"},"account_access_transformed":{"type":"string","description":"Transformed account access details"},"permission_scope":{"type":"string","description":"Scope of the permission"},"excessive_policies_count":{"type":"integer","description":"Number of excessive policies"},"unused_actions_count":{"type":"integer","description":"Number of unused actions"},"is_last_access_supported":{"type":"boolean","description":"Indicates if last access tracking is supported"}}}}}}
```

## The GetFilterObject object

```json
{"openapi":"3.0.0","info":{"title":"Cloud Infrastructure Entitlement Management APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetFilterObject":{"type":"object","description":"Filter object for the CIEM access GET endpoints.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Identifies the field to filter.","enum":["access_levels","account_access_transformed","dest_cloud_account_id","dest_cloud_account_name","dest_cloud_region","dest_cloud_resource_id","dest_cloud_resource_name","dest_cloud_resource_type","dest_cloud_resource_uai","dest_cloud_service_name","destCategory","destination_access_labels","excessive_policies_count","grantedby_cloud_entity_id","grantedby_cloud_entity_name","grantedby_cloud_entity_type","grantedby_cloud_entity_uai","granterCategory","last_used","permission_scope","source_cloud_account_id","source_cloud_account_is_vendor","source_cloud_account_name","source_cloud_region","source_cloud_resource_id","source_cloud_resource_name","source_cloud_resource_type","source_cloud_resource_uai","source_cloud_service_name","sourceCategory","sourceVendorName","unused_actions_count"]},"SEARCH_TYPE":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`","enum":["EQ"]},"SEARCH_VALUE":{"type":"string","description":"Value that this filter must match."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-infrastructure-entitlement-management-ciem/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.