> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-inventory.md).
# Asset Inventory
APIs for managing assets in the asset inventory
## Get all or filtered assets
> Retrieve detailed information about all assets within your environment, including enterprise, multi-cloud, code, and external surfaces.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Asset inventory","description":"APIs for managing assets in the asset inventory"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets":{"post":{"tags":["Asset inventory"],"summary":"Get all or filtered assets","operationId":"fetch_all_assets","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/assets_body"}}}},"parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"issues_breakdown":{"type":"object","properties":{"critical":{"type":"integer","description":"Number of critical issues"},"high":{"type":"integer","description":"Number of high issues"},"low":{"type":"integer","description":"Number of low issues"},"medium":{"type":"integer","description":"Number of medium issues"}}},"xdm.asset.first_observed":{"type":"integer","description":"Timestamp of when the asset was first observed"},"xdm.asset.cloud.region":{"description":"Region of the cloud asset","type":"string","nullable":true},"xdm.asset.last_observed":{"type":"integer","description":"Timestamp of when the asset was last observed"},"issues_critical":{"type":"integer"},"xdm.asset.strong_id":{"type":"string"},"xdm.asset.type.category":{"type":"string","description":"A more detailed grouping within a class. It categorizes assets based on their normalized function or common type, regardless of the provider or implementation."},"xdm.asset.name":{"type":"string","description":"Asset name","nullable":true},"xdm.asset.type.name":{"type":"string","description":"Represents the provider-specific name for a particular asset within a category."},"cases_breakdown":{"type":"object","properties":{"critical":{"type":"integer","description":"Number of critical cases"},"high":{"type":"integer","description":"Number of high cases"},"low":{"type":"integer","description":"Number of low cases"},"medium":{"type":"integer","description":"Number of medium cases"}}},"xdm.asset.provider":{"type":"string"},"xdm.asset.type.class":{"type":"string","description":"The highest-level grouping of assets based on their general purpose or domain. It is a broad classification that defines the overall function of the assets"},"xdm.asset.id":{"type":"string","description":"Asset ID"},"xdm.asset.type.id":{"type":"string","description":"Asset type ID"},"cases_critical":{"type":"integer"},"xdm.asset.group_ids":{"type":"array","description":"List of asset group IDs","items":{"type":"string"}},"xdm.asset.realm":{"type":"string"},"xdm.asset.hierarchy.path":{"type":"string","description":"The asset's hierarchy path as a delimited name, for example \"Acme Corp/Engineering\". Hierarchies may be partial depending on account permissions.","nullable":true},"xdm.asset.hierarchy.id_path":{"type":"string","description":"The leaf identifier of the asset's hierarchy, for example \"5590382716\". Hierarchies may be partial depending on account permissions.","nullable":true},"xdm.asset.resource_group":{"type":"string","description":"The resource group the asset belongs to.","nullable":true},"xdm.host.ipv4_addresses":{"type":"array","items":{"type":"string"}}}}},"metadata":{"type":"object","properties":{"filter_count":{"type":"integer","description":"Number of assets returned"},"total_count":{"type":"integer","description":"Number of total results of this filter without paging"}}}}}}}}}},"403":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnauthorizedErrorResponse"}}}}},"500":{"description":"Internal Server Error, Invalid Input","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GenericErrorResponse"}}}}}},"description":"Retrieve detailed information about all assets within your environment, including enterprise, multi-cloud, code, and external surfaces.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus."}}},"components":{"schemas":{"assets_body":{"type":"object","properties":{"filters":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}]},"on_demand_fields":{"type":"array","items":{"type":"string"}},"sort":{"$ref":"#/components/schemas/Sort"},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want assets returned."},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want assets returned.
Assets in the asset inventory that are indexed higher than this value are not returned in the final results set."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"Sort":{"type":"array","items":{"$ref":"#/components/schemas/SortObject"}},"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}},"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```
## Get asset by ID
> Retrieve detailed information about the asset specified by asset ID.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Asset inventory","description":"APIs for managing assets in the asset inventory"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/{id}":{"get":{"tags":["Asset inventory"],"summary":"Get asset by ID","operationId":"get-public_api-v1-assets-by-id","parameters":[{"name":"id","in":"path","description":"Asset ID","required":true,"schema":{"type":"string"}},{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"xdm.asset.last_observed":{"type":"integer","description":"Timestamp of when the asset was last observed"},"xdm.asset.cloud.region":{"type":"string","description":"Region of the cloud asset","nullable":true},"xdm.asset.id":{"type":"string","description":"Asset ID"},"xdm.asset.provider":{"type":"string"},"xdm.asset.first_observed":{"type":"integer","description":"Timestamp of when the asset was first observed"},"xdm.asset.type.name":{"type":"string","description":"Represents the provider-specific name for a particular asset within a category"},"xdm.asset.strong_id":{"type":"string"},"xdm.asset.name":{"type":"string","description":"Asset name","nullable":true},"xdm.asset.type.class":{"type":"string","description":"The highest-level grouping of assets based on their general purpose or domain. It is a broad classification that defines the overall function of the assets."},"xdm.asset.type.id":{"type":"string","description":"Asset type ID"},"xdm.asset.type.category":{"type":"string","description":"A more detailed grouping within a class. It categorizes assets based on their normalized function or common type, regardless of the provider or implementation."},"issues_critical":{"type":"integer"},"xdm.asset.realm":{"type":"string"},"xdm.asset.group_ids":{"type":"array","description":"List of asset group IDs","items":{"type":"string"}},"cases_breakdown":{"type":"object","properties":{"critical":{"type":"integer","description":"Number of critical cases"},"high":{"type":"integer","description":"Number of high cases"},"low":{"type":"integer","description":"Number of low cases"},"medium":{"type":"integer","description":"Number of medium cases"}}},"issues_breakdown":{"type":"object","properties":{"critical":{"type":"integer","description":"Number of critical issues"},"high":{"type":"integer","description":"Number of high issues"},"low":{"type":"integer","description":"Number of low issues"},"medium":{"type":"integer","description":"Number of medium issues"}}},"cases_critical":{"type":"integer"},"xdm.host.ipv4_addresses":{"type":"array","items":{"type":"string"}}}}},"metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}}},"403":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnauthorizedErrorResponse"}}}}},"404":{"description":"Asset Not Found","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/NotFoundErrorResponse"}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GenericErrorResponse"}}}}}},"description":"Retrieve detailed information about the asset specified by asset ID.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus."}}},"components":{"schemas":{"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"NotFoundErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```
## Get raw fields of asset by ID
> Get the raw fields of the asset specified by asset ID.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Asset inventory","description":"APIs for managing assets in the asset inventory"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/{id}/raw_fields":{"get":{"tags":["Asset inventory"],"summary":"Get raw fields of asset by ID","operationId":"get-public_api-v1-assets-raw-fields-by-id","parameters":[{"name":"id","in":"path","description":"Asset ID","required":true,"schema":{"type":"string"}},{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"xdm__asset__raw_fields":{"type":"object","properties":{"Platform Discovery":{"type":"object","properties":{"Adjustable":{"type":"boolean"},"Description":{"type":"string"},"GlobalQuota":{"type":"boolean"},"QuotaAppliedAtLevel":{"type":"string"},"QuotaArn":{"type":"string"},"QuotaCode":{"type":"string"},"QuotaName":{"type":"string"},"ServiceCode":{"type":"string"},"ServiceName":{"type":"string"},"Unit":{"type":"string"},"Value":{"type":"integer"}}}}}}}},"metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}}}}},"403":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnauthorizedErrorResponse"}}}}},"404":{"description":"Asset Not Found","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/NotFoundErrorResponse"}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GenericErrorResponse"}}}}}},"description":"Get the raw fields of the asset specified by asset ID.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus."}}},"components":{"schemas":{"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"NotFoundErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```
## Get schema of asset inventory
> Get the schema of the asset inventory, including the field names, pretty field names, and field type for every entry in the data model.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Asset inventory","description":"APIs for managing assets in the asset inventory"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/schema":{"get":{"tags":["Asset inventory"],"summary":"Get schema of asset inventory","operationId":"get-public_api-v1-assets-get-schema","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GetSchemaResponse"}}}}},"403":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnauthorizedErrorResponse"}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GenericErrorResponse"}}}}}},"description":"Get the schema of the asset inventory, including the field names, pretty field names, and field type for every entry in the data model.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus."}}},"components":{"schemas":{"GetSchemaResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GetSchemaResponse_reply"}}},"GetSchemaResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SchemaField"}}}},"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}},"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```
## Get enum values of specified field
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Asset inventory","description":"APIs for managing assets in the asset inventory"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/enum/{field_name}":{"get":{"tags":["Asset inventory"],"summary":"Get enum values of specified field","operationId":"get-public_api-v1-assets-get-enum-by-field-name","parameters":[{"name":"field_name","in":"path","description":"Field name - must be of type Enum","required":true,"schema":{"type":"string"}},{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/EnumValuesResponse"}}}}},"403":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/UnauthorizedErrorResponse"}}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/GenericErrorResponse"}}}}}},"description":"**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus."}}},"components":{"schemas":{"EnumValuesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/EnumValuesResponse_reply"}}},"EnumValuesResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EnumField"}}}},"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}},"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}},"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-inventory.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.