> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-prevention-rule/models.md).

# Models

## The GetDataRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"GetDataRequest":{"type":"object","properties":{"search_from":{"type":"integer","default":0,"description":"Zero-based index of the first Disable Prevention rule to return. Used for pagination.","minimum":0},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Index number of Disable Prevention rules to return starting from `search_from`."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}}}}}
```

## The SortingRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}}}}}
```

## The FilterRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}}}}}
```

## The PublicGetDataResponse object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## The BaseResponseString object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## The DeleteResponseString object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DeleteResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the result of the API operation."}}}}}}
```

## The BaseResponseArrayModules object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"BaseResponseArrayModules":{"type":"object","properties":{"reply":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionModulePAPIObject"}}}},"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## The DisablePreventionRulePAPIObject object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## The DisablePreventionGetModulesPAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionGetModulesPAPIRequest":{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`."}}}}}}
```

## The DisablePreventionModulePAPIObject object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## The DisablePreventionAddRulePAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionAddRulePAPIRequest":{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionEditRulePAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionEditRulePAPIRequest":{"allOf":[{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},{"type":"object","required":["rule_id"],"properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."}}}]},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionModifyRulePAPIRequestBase object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionDeleteRulesPAPIRequest object

```json
{"openapi":"3.0.3","info":{"title":"Disable Prevention Rule Public APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"DisablePreventionDeleteRulesPAPIRequest":{"type":"object","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"The unique identifier of the Disable Prevention rule.","items":{"type":"string"}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-prevention-rule/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.