> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-injection-and-prevention-rules/models.md).

# Models

## The GetDataRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"GetDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from)."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."},"FilterRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`                \n"}}}}}}
```

## The SortingRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."}}}}
```

## The FilterRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"FilterRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`                \n"}}}}}}
```

## The PublicGetDataResponse object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","description":"Container object for the response data and metadata","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisableInjectionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```

## The BaseResponseString object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Injection and Prevention Rule ID."}}}}}}
```

## The DisableInjectionResponseString object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisableInjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the success message."}}}}}}
```

## The DisableInjectionRulePAPIObject object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```

## The DisableInjectionAddRulePAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisableInjectionAddRulePAPIRequest":{"type":"object","description":"Request schema for creating a new Disable Injection and Prevention rule. All required fields must be provided to successfully create a rule.","required":["rule_name","description","platform","process_name","path","hours_to_expiration","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":100,"description":"Unique name for the new rule. Must be between 1-100 characters and should be descriptive of the rule's purpose."},"description":{"type":"string","maxLength":500,"description":"Description explaining the purpose and context of this rule. Maximum 500 characters."},"platform":{"type":"string","enum":["windows","linux","macos"],"description":"Target operating system to which the rule applies. "},"process_name":{"type":"string","minLength":1,"maxLength":100,"description":"Name of the process executable to protect. Must match the exact process name (1-100 characters)."},"path":{"type":"string","minLength":1,"maxLength":1000,"description":"Full file system path to the process executable. Must be a valid path for the specified platform (1-1000 characters)."},"hours_to_expiration":{"type":"integer","enum":[24,48],"description":"Number of hours until the rule expires. After expiration, the rule will no longer be applied. For example, 24 hours."},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule should apply. \nRequired when `scope` is `profile`. Must be `null` or omitted when scope is `global`.","nullable":true,"items":{"type":"integer","default":96}},"scope":{"type":"string","enum":["global","profile"],"description":"Defines the application scope of the rule.\n- `global`: Rule applies to all endpoints all matching endpoints (by platform and agent version >= 7.9)\n- `profile`: Rule applies only to endpoints in the specified `profile_ids`"}}}}}}
```

## The DisableInjectionDisableRulesPAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Injection and Prevention Rules Public API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisableInjectionDisableRulesPAPIRequest":{"type":"object","description":"Request schema for disabling one or more existing Disable Injection Prevention rules. Requires at least one valid rule ID.","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"Array of rule IDs to disable. Must contain at least one valid rule ID.","items":{"type":"string"}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-injection-and-prevention-rules/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.