> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/external-application-management/external-applications.md).

# External Applications

Manage external application integrations for Cortex XSIAM.

## List all applications

> Retrieves a list of external applications (AWS SQS, AWS S3, Syslog, Splunk, and webhook) and their attributes. The meaning behind all attributes in this response could be found in the \`\`\`ExternalApplication\`\`\` schema. Please note that the field \`\`\`connection\_config\`\`\` is retrieved with masked attributes for security purposes; examples are provided in the sample response shown for this endpoint. Please note that the \`\`\`last\_modified\_by\`\`\`, \`\`\`last\_error\`\`\`, and \`\`\`last\_error\_at\`\`\` attributes are not populated for Syslog integrations.

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM External Application Management API","version":"Cortex XSIAM 3.5"},"tags":[{"name":"External Applications","description":"Manage external application integrations for Cortex XSIAM."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/integration/v1/external-application":{"get":{"summary":"List all applications","operationId":"listApplications","description":"Retrieves a list of external applications (AWS SQS, AWS S3, Syslog, Splunk, and webhook) and their attributes. The meaning behind all attributes in this response could be found in the ```ExternalApplication``` schema. Please note that the field ```connection_config``` is retrieved with masked attributes for security purposes; examples are provided in the sample response shown for this endpoint. Please note that the ```last_modified_by```, ```last_error```, and ```last_error_at``` attributes are not populated for Syslog integrations.","tags":["External Applications"],"responses":{"200":{"description":"A list of applications.","content":{"application/json":{"schema":{"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ExternalApplication"}},"metadata":{"type":"object","$ref":"#/components/schemas/Metadata"}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"ExternalApplication":{"type":"object","description":"Enumerates the various attributes of an external application object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]},"Metadata":{"type":"object","description":"Metadata for the response","additionalProperties":true}},"responses":{"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Create a new application

> Allows the user to create a new external application integration and specify its attributes. To see the possible \`\`\`application\_type\`\`\` values, please check the relevant enum in the \`\`\`ExternalApplication\`\`\` schema for additional information. The \`\`\`connection\_config\`\`\` attribute is where a user would define AWS SQS, AWS S3, Splunk, Syslog, and webhook configurations; the required formats for these fields are documented in the respective schemas that are linked to the base \`\`\`ConnectionConfig\`\`\` schema. Please ensure that you have setup the proper egress configurations on the Cortex Gateway; this API verifies the new connection against the egress configurations specified for the given tenant. If assistance is required, please utilize the cue on the UI menu for creating a new external application configuration.

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM External Application Management API","version":"Cortex XSIAM 3.5"},"tags":[{"name":"External Applications","description":"Manage external application integrations for Cortex XSIAM."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/integration/v1/external-application":{"post":{"summary":"Create a new application","description":"Allows the user to create a new external application integration and specify its attributes. To see the possible ```application_type``` values, please check the relevant enum in the ```ExternalApplication``` schema for additional information. The ```connection_config``` attribute is where a user would define AWS SQS, AWS S3, Splunk, Syslog, and webhook configurations; the required formats for these fields are documented in the respective schemas that are linked to the base ```ConnectionConfig``` schema. Please ensure that you have setup the proper egress configurations on the Cortex Gateway; this API verifies the new connection against the egress configurations specified for the given tenant. If assistance is required, please utilize the cue on the UI menu for creating a new external application configuration.","operationId":"createApplication","tags":["External Applications"],"requestBody":{"description":"Allows the user to create a new external application. ","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ExternalApplicationRequest"},{"properties":{"application_id":{"description":"Omitted on insert","readOnly":true},"created_at":{"description":"Omitted on insert","readOnly":true},"last_modified_by":{"description":"Must be supplied on insert, but not readOnly.","readOnly":true},"modified_at":{"description":"Omitted on insert","readOnly":true}}}]}}}},"responses":{"201":{"description":"Application successfully created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApplicationResponse"}}}},"400":{"$ref":"#/components/responses/ExternalApplicationCreatedBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"ExternalApplicationRequest":{"type":"object","description":"Enumerates the parameters for an external application request object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","application_type","connection_config"],"properties":{"name":{"type":"string","description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]},"ExternalApplicationResponse":{"type":"object","description":"Enumerates the various attributes of an external application response object","properties":{"data":{"type":"object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","maxLength":256,"description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}}},"responses":{"ExternalApplicationCreatedBadRequest":{"description":"Bad request for external application create call. Errors here could come from validations of input, egress failures, test connection issues, and more.","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}}}}}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Update an existing application (full replacement)

> Allows the user to edit an external application and specify its new attributes. To see the possible \`\`\`application\_type\`\`\` values, please check the relevant enum in the \`\`\`ExternalApplication\`\`\` schema for additional information. The \`\`\`connection\_config\`\`\` attribute is where a user would define AWS SQS, AWS S3, Splunk, Syslog, and webhook configurations; the required formats for these fields are documented in the respective schemas that are linked to the base \`\`\`ConnectionConfig\`\`\` schema. Please ensure that you have setup the proper egress configurations on the Cortex Gateway; this API verifies the new connection against the egress configurations specified for the given tenant. If assistance is required, please utilize the cue on the UI menu for creating a new external application configuration.

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM External Application Management API","version":"Cortex XSIAM 3.5"},"tags":[{"name":"External Applications","description":"Manage external application integrations for Cortex XSIAM."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/integration/v1/external-application/{application_id}":{"put":{"summary":"Update an existing application (full replacement)","operationId":"updateApplication","description":"Allows the user to edit an external application and specify its new attributes. To see the possible ```application_type``` values, please check the relevant enum in the ```ExternalApplication``` schema for additional information. The ```connection_config``` attribute is where a user would define AWS SQS, AWS S3, Splunk, Syslog, and webhook configurations; the required formats for these fields are documented in the respective schemas that are linked to the base ```ConnectionConfig``` schema. Please ensure that you have setup the proper egress configurations on the Cortex Gateway; this API verifies the new connection against the egress configurations specified for the given tenant. If assistance is required, please utilize the cue on the UI menu for creating a new external application configuration.","parameters":[{"name":"application_id","in":"path","description":"The unique identifier of the application.","required":true,"schema":{"type":"string"}}],"tags":["External Applications"],"requestBody":{"description":"Application object to update. Must include all non-readOnly required fields: ```name```,```application_type```,```connection_config```. Please note that one cannot update the ```application_type``` of an existing external application; this field must stay constant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApplicationRequest"}}}},"responses":{"200":{"description":"Application updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApplicationResponse"}}}},"400":{"$ref":"#/components/responses/ExternalApplicationEditedBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"ExternalApplicationRequest":{"type":"object","description":"Enumerates the parameters for an external application request object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","application_type","connection_config"],"properties":{"name":{"type":"string","description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]},"ExternalApplicationResponse":{"type":"object","description":"Enumerates the various attributes of an external application response object","properties":{"data":{"type":"object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","maxLength":256,"description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}}},"responses":{"ExternalApplicationEditedBadRequest":{"description":"Bad request for external application update call. Errors here could come from validations of input, egress failures, test connection issues, and more.","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}}}}}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Get External Application details by ID

> Retrieves an external application and returns its attributes. The meaning behind all attributes in this response could be found in the \`\`\`ExternalApplication\`\`\` schema.

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM External Application Management API","version":"Cortex XSIAM 3.5"},"tags":[{"name":"External Applications","description":"Manage external application integrations for Cortex XSIAM."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/integration/v1/external-application/{application_type}/id/{application_id}":{"get":{"summary":"Get External Application details by ID","operationId":"getExternalApplicationById","description":"Retrieves an external application and returns its attributes. The meaning behind all attributes in this response could be found in the ```ExternalApplication``` schema.","parameters":[{"name":"application_id","in":"path","required":true,"description":"The unique identifier of the application.","schema":{"type":"string"}},{"name":"application_type","in":"path","required":true,"description":"The application type of the specified application","schema":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"]}}],"tags":["External Applications"],"responses":{"200":{"description":"Application details retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalApplicationResponse"}}}},"400":{"$ref":"#/components/responses/GetExternalApplicationByUUIDBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"ExternalApplicationResponse":{"type":"object","description":"Enumerates the various attributes of an external application response object","properties":{"data":{"type":"object","properties":{"application_id":{"type":"integer","format":"int64","description":"Unique identifier","readOnly":true},"name":{"type":"string","maxLength":256,"description":"Name of the application."},"description":{"type":"string","description":"Description of the application."},"status":{"type":"string","enum":["connected","warning","disabled","error","in_progress","pending_authorization","authorization_failure","incomplete","pending"],"description":"Current status of the application.","readOnly":true,"default":"connected"},"created_at":{"type":"integer","format":"int64","description":"Timestamp when the application was created.","readOnly":true},"last_modified_by":{"type":"string","description":"Identifier of the user who created the app.","readOnly":true},"last_error":{"type":"string","description":"Description summarizing that last known error for the given external application.","readOnly":true},"last_error_at":{"type":"integer","format":"int64","description":"Timestamp of the last error.","readOnly":true},"modified_at":{"type":"integer","format":"int64","description":"Timestamp of the last modification.","readOnly":true},"application_type":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"],"description":"The type of application instance."},"connection_config":{"$ref":"#/components/schemas/ConnectionConfig"}}}}},"ConnectionConfig":{"type":"object","description":"Connection configuration based on application_type.","oneOf":[{"$ref":"#/components/schemas/WebhookConnectionConfig"},{"$ref":"#/components/schemas/SplunkConnectionConfig"},{"$ref":"#/components/schemas/AwsSqsConnectionConfig"},{"$ref":"#/components/schemas/AwsS3ConnectionConfig"},{"$ref":"#/components/schemas/SyslogConnectionConfig"}]},"WebhookConnectionConfig":{"title":"WebhookConnectionConfig","description":"Enumerates the configuration parameters for webhook external applications","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"url","description":"webhook URL."},"http_method":{"type":"string","enum":["POST","PUT"],"default":"POST"},"headers":{"type":"object","description":"Custom HTTP headers to include."}}},"SplunkConnectionConfig":{"title":"SplunkConnectionConfig","description":"Enumerates the configuration parameters for splunk external applications","type":"object","properties":{"hec_endpoint":{"type":"string","format":"url","description":"Splunk HTTP Event Collector (HEC) endpoint."},"auth_token":{"type":"string","description":"HEC authentication token."}},"required":["hec_endpoint","auth_token"]},"AwsSqsConnectionConfig":{"title":"SQSConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws sqs external applications","properties":{"queue_url":{"type":"string","format":"url","description":"The SQS queue destination URL."},"access_key":{"type":"string"},"secret_key":{"type":"string"},"role_arn":{"type":"string"},"connection_type":{"type":"string","enum":["ROLE_ARN","ACCESS_KEY"],"default":"ROLE_ARN"}},"required":["queue_url"]},"AwsS3ConnectionConfig":{"title":"S3ConnectionConfig","type":"object","description":"Enumerates the configuration parameters for aws s3 external applications","properties":{"s3_uri":{"type":"string","format":"url","description":"Amazon S3 bucket URI"},"region":{"type":"string","description":"AWS region where the S3 bucket resides"},"role_arn":{"type":"string","description":"Role ARN associated with the IAM role for S3 access"},"roll_up_interval":{"type":"integer","format":"int32","description":"Roll-up interval for metrics or data aggregation (in minutes)","enum":[15,30,60,180],"default":60}},"required":["s3_uri","region","role_arn"]},"SyslogConnectionConfig":{"title":"SyslogConnectionConfig","description":"Enumerates the configuration parameters for syslog external applications","type":"object","properties":{"port":{"type":"integer"},"protocol":{"type":"string","enum":["UDP","TCP","TLS"]},"facility":{"type":"string","description":"Choose one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424."},"address":{"type":"string","description":"IP address or fully qualified domain name (FQDN) of the syslog server."},"security_info":{"type":"object","properties":{"certificate_name":{"type":"string","description":"When using TLS for communication between Cortex and the syslog server, Cortex validates that the syslog receiver has a certificate. Specify the certificate name here."},"ignore_cert_errors":{"type":"boolean","default":false,"description":"Whether to ignore certificate errors. For security reasons, this is not recommended. If you set this to true, logs will be forwarded even if the certificate contains errors."},"certificate_content":{"type":"string","format":"binary","description":"Binary string of the certificate."}}}},"required":["port","protocol","address","facility"]}},"responses":{"GetExternalApplicationByUUIDBadRequest":{"description":"Bad request for external application get by id call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}}}}}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Delete an application

> Allows the user to delete an external application. Deletion is not permitted if the application is associated with an active notification rule.

```json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM External Application Management API","version":"Cortex XSIAM 3.5"},"tags":[{"name":"External Applications","description":"Manage external application integrations for Cortex XSIAM."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/integration/v1/external-application/{application_type}/id/{application_id}":{"delete":{"summary":"Delete an application","operationId":"deleteApplication","description":"Allows the user to delete an external application. Deletion is not permitted if the application is associated with an active notification rule.","parameters":[{"name":"application_id","in":"path","required":true,"description":"The unique identifier of the application.","schema":{"type":"string"}},{"name":"application_type","in":"path","required":true,"description":"The application type of the specified application","schema":{"type":"string","enum":["syslog","webhook","splunk","aws_sqs","aws_s3"]}}],"tags":["External Applications"],"responses":{"200":{"$ref":"#/components/responses/ExternalApplicationDeleteSuccess"},"400":{"$ref":"#/components/responses/ExternalApplicationDeleteBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"responses":{"ExternalApplicationDeleteSuccess":{"description":"Successful deletion of External Application","content":{"application/json":{"schema":{"type":"null"}}}},"ExternalApplicationDeleteBadRequest":{"description":"Bad request for external application delete call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}}}}}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/external-application-management/external-applications.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.