> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/cloud-instance-management.md).

# Cloud Instance Management

These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration.

## Create a cloud onboarding integration template

> Create a template to facilitate the seamless setup of CSP data in Cortex.\
> Define the scope and specify the scan mode. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex generates an authentication template to establish trust to the CSP and grant permissions to Cortex. Cortex Cloud creates an instance in \*pending\* state.\
> The API returns a link to download the template from the Cortex tenant.\
> \
> \*\*Note:\*\* If the template execution in the CSP fails, there is currently no manual execution of the template by API. You must perform manual execution in the UI.\
> \
> For scope modifications, the parameters are CSP-specific. For AWS, use \`accounts\`, for GCP, use \`projects\`, and for Azure, use \`subscriptions\`.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/create_instance_template":{"post":{"summary":"Create a cloud onboarding integration template","operationId":"postCreateInstanceTemplate","description":"Create a template to facilitate the seamless setup of CSP data in Cortex.\nDefine the scope and specify the scan mode. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex generates an authentication template to establish trust to the CSP and grant permissions to Cortex. Cortex Cloud creates an instance in *pending* state.\nThe API returns a link to download the template from the Cortex tenant.\n\n**Note:** If the template execution in the CSP fails, there is currently no manual execution of the template by API. You must perform manual execution in the UI.\n\nFor scope modifications, the parameters are CSP-specific. For AWS, use `accounts`, for GCP, use `projects`, and for Azure, use `subscriptions`.\n\n**Required license:** Cortex Cloud Posture Management","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInstanceTemplateRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInstanceResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"CreateInstanceTemplateRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["scope","scan_mode","cloud_provider","custom_resources_tags","collection_configuration","scope_modifications","additional_capabilities"],"properties":{"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"],"description":"Define the scope for this cloud instance. Valid values include:\n\n- `ORGANIZATION`: Use this to indicate an AWS organization, GCP organization, or Azure tenant.\n- `ACCOUNT_GROUP`: Use this to indicate an AWS account group, GCP folder, or Azure management group.\n- `ACCOUNT`: Use this to indicate an AWS account, GCP project, or Azure subscription."},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"],"description":"Define the scan mode. Valid values include:\n\n- `MANAGED`: (Recommended) Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you.\n\n**Note: ** Scanning with an outpost may require additional CSP permissions and may incur additional CSP costs."},"scan_env_id":{"type":"string","minLength":1,"description":"When the scan mode is `OUTPOST`, you must include the `scan_env_id` field with the outpost ID as the value.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID."},"account_details":{"$ref":"#/components/schemas/AccountDetails"},"instance_name":{"type":"string"},"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`"},"custom_resources_tags":{"type":"array","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"cloud_partition":{"description":"Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants.","enum":["COMMERCIAL","GOV"]},"gcp_workspace":{"type":"object","description":"GCP Workspace configuration (GCP only).","properties":{"customer_ids":{"type":"array","items":{"type":"string"},"nullable":true},"enabled":{"type":"boolean","default":false}}}}}}},"AccountDetails":{"type":"object","description":"`account_details` is required for onboarding Azure and is not used for onboarding AWS or GCP.","properties":{"organization_id":{"type":"string","description":"Azure tenant ID","minLength":1}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/reference-and-developer-docs/reference/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/reference-and-developer-docs/reference/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"CreateInstanceResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing instance information data. It includes a link to download the template file from your tenant.\nIf you use automated upload (only for AWS), the link will take you directly to AWS CloudFormation to create the stack.\nOtherwise, download the template and upload it in your CSP and follow the instructions to manually upload the template:\n- [AWS](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services/deploy-the-cloudformation-template-in-aws)\n- [GCP](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/gcp-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp)\n- [Azure](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template)"}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get cloud instance details

> Get the configuration details of the specified cloud instance.\
> \
> \*\*Required license:\*\* In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_instance_details":{"post":{"summary":"Get cloud instance details","operationId":"postGetInstanceDetails","description":"Get the configuration details of the specified cloud instance.\n\n**Required license:** In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetInstanceDetailsResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"GetInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"The ID of the cloud instance of which you want to get the details."}}}}},"GetInstanceDetailsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"id":{"type":"string"},"collector":{"type":"string"},"instance_name":{"type":"string"},"scope":{"type":"string"},"tags":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"status":{"type":"string","description":"Overall status of the cloud instance.","enum":["CONNECTED","WARNING","ERROR","DISABLED","PENDING"]},"cloud_provider":{"type":"string","description":"The cloud service provider.","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"]},"scan":{"type":"object","properties":{"scan_method":{"type":"string","description":"The scan method used.","enum":["MANAGED","OUTPOST"]},"outpost_id":{"type":"string","description":"The outpost ID. Only present when `scan_method` is `OUTPOST`."}}},"security_capabilities":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"description":{"type":"string"},"status":{"type":"integer","description":"Status of the security capability. One of: `0` (CONNECTED), `1` (WARNING), `2` (DISABLED), `3` (ERROR), `4` (NA).","enum":[0,1,2,3,4]}}}},"upgrade_available":{"type":"boolean"},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"]},"collection_configuration":{"type":"string","description":"JSON-encoded string of the collection configuration for this cloud instance."},"additional_capabilities":{"type":"string","description":"JSON-encoded string of the additional capabilities enabled for this cloud instance."}}}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get all or filtered cloud instances

> Get the configuration details of all or filtered cloud instances. You can use a filter to exclude instances in a PENDING state.\
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_instances":{"post":{"summary":"Get all or filtered cloud instances","operationId":"postGetInstances","description":"Get the configuration details of all or filtered cloud instances. You can use a filter to exclude instances in a PENDING state.\n\n**Required license:** Cortex Cloud Posture Management","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListInstancesRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetInstancesResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"ListInstancesRequestData":{"type":"object","properties":{"request_data":{"type":"object","description":"Valid values for the sort field `FIELD` the filter field `SEARCH_FIELD` include:\n\n- `STATUS` \n- `PROVIDER` \n- `INSTANCE_NAME` \n- `SCOPE` \n- `SCAN_MODE` \n- `CREATION_TIME` \n- `OUTPOST_ID` \n- `AUTHENTICATION_METHOD` \n- `ID`","properties":{"filter_data":{"$ref":"#/components/schemas/FilterData"}}}}},"FilterData":{"type":"object","properties":{"sort":{"type":"array","description":"Sorting criteria for the results","items":{"$ref":"#/components/schemas/SortCriteria"}},"paging":{"$ref":"#/components/schemas/Paging"},"filter":{"description":"Filter criteria for the results.","oneOf":[{"$ref":"#/components/schemas/AndPredicate"},{"$ref":"#/components/schemas/OrPredicate"},{"type":"object"}]}}},"SortCriteria":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field to sort by."},"ORDER":{"type":"string","enum":["ASC","DESC"],"description":"Whether to sort in ascending (`ASC`) order or descending (`DESC`) order."}}},"Paging":{"type":"object","properties":{"from":{"type":"integer","description":"The starting index for pagination.","minimum":0},"to":{"type":"integer","description":"The ending index for pagination.","minimum":1}}},"AndPredicate":{"type":"object","properties":{"AND":{"type":"array","description":"A list of filter criteria to be combined with AND logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"FilterCriteria":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"Specifies the field to filter by. "},"SEARCH_TYPE":{"type":"string","description":"Comparison operator to use with the filter."},"SEARCH_VALUE":{"description":"The value to filter by.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"OrPredicate":{"type":"object","properties":{"OR":{"type":"array","description":"A list of filter criteria to be combined with OR logic","items":{"$ref":"#/components/schemas/FilterCriteria"}}}},"GetInstancesResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/InstanceListItem"}},"FILTER_COUNT":{"type":"integer"},"TOTAL_COUNT":{"type":"integer"}}}}},"InstanceListItem":{"type":"object","description":"A single cloud instance in the list response.","properties":{"instance_id":{"type":"string","description":"Unique identifier of the cloud instance"},"cloud_provider":{"type":"string","enum":["AWS","GCP","AZURE","OCI","ALIBABA_CLOUD"]},"instance_name":{"type":"string","description":"Display name of the cloud instance"},"account_name":{"type":"string","nullable":true,"description":"The display name of the primary account associated with this cloud instance. For organization and organizational unit scopes, this field may be empty if no account name association is found"},"accounts":{"type":"integer","nullable":true,"description":"Count of non-deleted accounts (integer, not an object)"},"scope":{"type":"string","enum":["ORGANIZATION","ACCOUNT_GROUP","ACCOUNT"]},"scan_mode":{"type":"string","enum":["MANAGED","OUTPOST"]},"cloud_partition":{"type":"string","enum":["COMMERCIAL","GOV"],"nullable":true},"creation_time":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"custom_resources_tags":{"type":"string","description":"JSON-encoded string of custom resource tags"},"provisioning_method":{"type":"string","nullable":true,"enum":["TF","TF_M","CF","CF_M","GCDM","ARM","BICEP_M","MANUAL"]},"additional_capabilities":{"type":"string","description":"JSON-encoded string of additional capabilities"},"update_status":{"type":"string","nullable":true,"enum":["UP_TO_DATE","UPDATE_AVAILABLE"]},"is_pending_changes":{"type":"integer","nullable":true,"description":"0 (no pending changes) or 1 (has pending changes)"},"status":{"type":"string","enum":["CONNECTED","WARNING","ERROR","DISABLED","PENDING"]},"outpost_id":{"type":"string","nullable":true,"description":"ID of the associated outpost"}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Edit a cloud instance

> Edit the configuration settings of the specified cloud instance. After editing, there is a notice in the UI that there are pending changes. The changes are applied after you execute the template in the CSP after editing. \
> \
> \*\*Required license:\*\* Cortex Cloud Posture Management

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/edit_instance":{"post":{"summary":"Edit a cloud instance","operationId":"postEditInstance","description":"Edit the configuration settings of the specified cloud instance. After editing, there is a notice in the UI that there are pending changes. The changes are applied after you execute the template in the CSP after editing. \n\n**Required license:** Cortex Cloud Posture Management","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EditInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EditInstanceResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"EditInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["id","scan_env_id","instance_name","cloud_provider","custom_resources_tags","scope_modifications"],"properties":{"id":{"type":"string","description":"The ID of the cloud instance to edit. To obtain instance IDs, use [Get Instances](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances).","minLength":1},"scan_env_id":{"type":"string","description":"The outpost ID to use for security scanning. Required even when the scan mode is `MANAGED` — pass the current outpost ID or an empty string if no outpost is configured.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID.","minLength":1},"instance_name":{"type":"string","description":"The display name of the cloud instance."},"cloud_provider":{"type":"string","enum":["AWS","AZURE","GCP","OCI","ALIBABA_CLOUD"],"description":"The cloud service provider of the instance being edited. Must match the provider used when the instance was created. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`"},"custom_resources_tags":{"type":"array","description":"A list of key-value tags applied to the cloud resources that Cortex creates in your CSP account (such as IAM roles and CloudFormation stacks). Updating these tags requires re-executing the authentication template in the CSP.","items":{"$ref":"#/components/schemas/CustomResourceTag"}},"scope_modifications":{"$ref":"#/components/schemas/InstanceScopeModifications"},"additional_capabilities":{"$ref":"#/components/schemas/InstanceAdditionalCapabilities"},"collection_configuration":{"$ref":"#/components/schemas/InstanceCollectionConfiguration"},"gcp_workspace":{"type":"object","description":"GCP Workspace configuration. Use this to connect a Google Workspace domain to the GCP cloud instance, enabling Cortex to collect Workspace audit logs and assess Workspace security posture. Only applicable when `cloud_provider` is `GCP`.","properties":{"customer_ids":{"type":"array","nullable":true,"description":"A list of Google Workspace customer IDs to associate with this GCP cloud instance.","items":{"type":"string"}},"enabled":{"type":"boolean","default":false,"description":"Whether to enable Google Workspace integration for this GCP cloud instance."}}}}}}},"CustomResourceTag":{"type":"object","properties":{"key":{"type":"string","description":"The key of the custom resource tag.","minLength":1},"value":{"type":"string","description":"The value of the custom resource tag."}}},"InstanceScopeModifications":{"type":"object","description":"Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.","required":["regions"],"properties":{"accounts":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI."},"projects":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud."},"subscriptions":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud."},"compartments":{"$ref":"#/components/schemas/InstanceAccountsConfig","description":"Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud."},"organizational_units":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"management_groups":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"folders":{"$ref":"#/components/schemas/InstanceOUConfig","description":"Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time."},"regions":{"$ref":"#/components/schemas/InstanceRegionsConfig","description":"Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required."}}},"InstanceAccountsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether to enable (`true`) or disable (`false`)  this scope modification."},"type":{"type":"string","description":"Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`","nullable":true},"account_ids":{"type":"array","description":"The list of account IDs to include or exclude (for AWS).","nullable":true,"items":{"type":"string","minLength":1}},"project_ids":{"type":"array","description":"The list of account IDs to include or exclude (for GCP).","nullable":true,"items":{"type":"string","minLength":1}},"subscription_ids":{"type":"array","description":"The list of account IDs to include or exclude (for Azure).","nullable":true,"items":{"type":"string","minLength":1}},"compartment_ids":{"type":"array","nullable":true,"description":"The list of compartment IDs to include or exclude (for OCI).","items":{"type":"string"}}}},"InstanceOUConfig":{"type":"object","description":"Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.","properties":{"enabled":{"type":"boolean","description":"Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set."},"type":{"type":"string","enum":["INCLUDE","EXCLUDE"],"nullable":true,"description":"Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list."},"organizational_unit_ids":{"type":"array","nullable":true,"description":"A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.","items":{"type":"string","minLength":1}},"management_group_ids":{"type":"array","nullable":true,"description":"A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.","items":{"type":"string","minLength":1}},"folder_ids":{"type":"array","nullable":true,"description":"A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.","items":{"type":"string","minLength":1}}},"required":["enabled"]},"InstanceRegionsConfig":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Flag to enable or disable region configuration"},"type":{"type":"string","nullable":true,"description":"Type of region configuration (e.g., INCLUDE, EXCLUDE)"},"regions":{"type":"array","nullable":true,"description":"List of regions to include or exclude","items":{"type":"string","minLength":1}}}},"InstanceAdditionalCapabilities":{"type":"object","description":"Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/reference-and-developer-docs/reference/cloud-service-provider-permissions).","properties":{"xsiam_analytics":{"type":"boolean","description":"Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected."},"data_security_posture_management":{"type":"boolean","description":"Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.","nullable":true},"registry_scanning":{"type":"boolean","description":"Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets."},"registry_scanning_options":{"$ref":"#/components/schemas/RegistryScanningOptions"},"serverless_scanning":{"type":"boolean","description":"Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment."},"agentless_disk_scanning":{"type":"boolean","description":"Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle."},"upload_files_to_wildfire":{"type":"boolean","description":"Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created."},"kubernetes_security":{"type":"boolean","default":false,"description":"Whether to enable Kubernetes security."},"automation":{"type":"boolean","default":false,"description":"Whether to enable automation."},"automation_log_level":{"description":"Automation log level","enum":["OFF","Debug","Verbose"],"nullable":true}}},"RegistryScanningOptions":{"type":"object","properties":{"type":{"type":"string","description":"Type of registry scanning."},"last_days":{"type":"integer","description":"Number of days to scan back.","nullable":true}}},"InstanceCollectionConfiguration":{"type":"object","description":"This field is optional when onboarding or editing Alibaba Cloud.","properties":{"audit_logs":{"$ref":"#/components/schemas/InstanceAuditLogsConfig"}}},"InstanceAuditLogsConfig":{"type":"object","description":"To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/reference-and-developer-docs/reference/cloud-service-provider-permissions).","required":["enabled"],"properties":{"enabled":{"type":"boolean","description":"Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used."},"collection_method":{"enum":["CUSTOM","AUTOMATED"],"description":"Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n"},"data_events":{"type":"boolean","description":"The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3."},"custom_collectors":{"type":"array","description":"A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.","items":{"type":"object","properties":{"region":{"type":"string","description":"The geographic region where the collection bucket is located."},"bucket_name":{"type":"string","description":"The name of the storage bucket where the log collection data will be collected and stored."},"compartment_ocid":{"type":"string","description":"The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket."}}}},"is_control_tower_byob":{"type":"boolean","default":false,"description":"When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant."}}},"EditInstanceResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"automated":{"type":"object","properties":{"link":{"type":"string"},"tracking_guid":{"type":"string"}}},"manual":{"type":"object","properties":{"TF/ARM":{"type":"string"}}}}}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Enable or disable cloud instances

> Enable or disable the cloud instances specified by their instance IDs. To obtain the instance IDs, use \[Get Instances]\(<https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cloud-onboarding/cloud-instance-management#post-public\\_api-v1-cloud\\_onboarding-get\\_instances).\\>
> \
> \*\*Required license:\*\* In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/enable_disable_instance":{"post":{"summary":"Enable or disable cloud instances","operationId":"postEnableDisableInstance","description":"Enable or disable the cloud instances specified by their instance IDs. To obtain the instance IDs, use [Get Instances](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances).\n\n**Required license:** In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableDisableInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnableDisableInstancesResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"EnableDisableInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["ids","enable"],"properties":{"ids":{"type":"array","description":"List of cloud instance IDs to enable/disable/","items":{"type":"string"}},"enable":{"type":"boolean","description":"Whether to enable the cloud instances (`true`) or disable (`false`)."}}}}},"EnableDisableInstancesResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Delete the specified cloud instances

> Delete the specified cloud instances.\
> \
> \*\*Required license:\*\* In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/delete_instance":{"post":{"summary":"Delete the specified cloud instances","operationId":"postDeleteInstance","description":"Delete the specified cloud instances.\n\n**Required license:** In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteInstanceRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"422":{"$ref":"#/components/responses/ValidationError"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Cloud instance management"]}}},"components":{"schemas":{"DeleteInstanceRequestData":{"type":"object","properties":{"request_data":{"type":"object","required":["ids"],"properties":{"ids":{"type":"array","description":"List of cloud instance IDs to delete.","items":{"type":"string"}}}}}},"BaseResponse":{"type":"object","properties":{"reply":{"type":"object","description":"The main payload of the response, containing operation-specific data."}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"ValidationError":{"description":"Invalid Client Request Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```

## Get identifier roles for cloud instance

> List all of the identifiers roles for the cloud instance. In the UI, these details are listed under \*\*Authorization details\*\* of the cloud instance.\
> \
> \*\*Required license:\*\* In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cloud Onboarding APIs","version":"Cortex XSIAM 3.x"},"tags":[{"name":"Cloud instance management","description":"These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XSIAM and you can enable, disable, or delete them. You can also edit the cloud instance configuration."}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/public_api/v1/cloud_onboarding/get_identifiers":{"post":{"operationId":"post-public_api-v1-cloud_onboarding-get_identifiers","tags":["Cloud instance management"],"summary":"Get identifier roles for cloud instance","description":"List all of the identifiers roles for the cloud instance. In the UI, these details are listed under **Authorization details** of the cloud instance.\n\n**Required license:** In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetIdentifiersRequestData"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetIdentifiersResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}},"components":{"schemas":{"GetIdentifiersRequestData":{"type":"object","required":["instance_id","cloud_provider"],"properties":{"instance_id":{"type":"string","description":"The cloud instance ID for which you want to list the authorization details."},"cloud_provider":{"type":"string","enum":["GCP"],"description":"The cloud service provider for which you want to list the authorization details."}}},"GetIdentifiersResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"cortex_discovery_role":{"type":"string","description":"The Cortex discovery role identifier"},"cortex_scan_platform_role":{"type":"string","description":"The Cortex scan platform role identifier"},"cortex_log_collection_role":{"type":"string","description":"The Cortex log collection role identifier"},"cortex_outpost_role":{"type":"string","description":"The Cortex outpost role identifier"}}}}},"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"string","description":"Error code"},"err_msg":{"type":"string","description":"Error message"},"err_extra":{"type":"string","description":"Extra information about the error"}}}}}},"responses":{"BadRequest":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseError"}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/cloud-instance-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.