> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/logging-and-collection-service-management/clcs-management.md).

# CLCS Management

The Cloud Logging and Collection Service (CLCS) Management APIs allow you to programmatically manage Next-Generation Firewalls (NGFWs) connected to your CLCS environment.

## List connected NGFW devices

> Returns a list of all Next-Generation Firewalls (NGFWs) currently connected to the Cloud Logging and Collection Service (CLCS) for the authenticated tenant.\
> \
> Each device in the response includes its serial number (\`device\_id\`), the CSP account ID it belongs to, and the region it is deployed in.\
> \
> \*\*Required license:\*\* This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security or Cloud Posture Security add-ons.\
> \
> \*\*Required permission:\*\* Data Collection > Data Sources > View

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSIAM Cloud Logging and Collection Service Management APIs","version":"1.0.0"},"tags":[{"name":"CLCS Management","description":"The Cloud Logging and Collection Service (CLCS) Management APIs allow you to programmatically manage Next-Generation Firewalls (NGFWs) connected to your CLCS environment."}],"servers":[{"url":"https://api-yourfqdn","description":"Your Cortex XSIAM tenant API endpoint. Replace `yourfqdn` with your tenant's fully qualified domain name."}],"paths":{"/public_api/v1/clcs/get_connected_devices":{"get":{"operationId":"getClcsConnectedDevices","summary":"List connected NGFW devices","description":"Returns a list of all Next-Generation Firewalls (NGFWs) currently connected to the Cloud Logging and Collection Service (CLCS) for the authenticated tenant.\n\nEach device in the response includes its serial number (`device_id`), the CSP account ID it belongs to, and the region it is deployed in.\n\n**Required license:** This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security or Cloud Posture Security add-ons.\n\n**Required permission:** Data Collection > Data Sources > View","tags":["CLCS Management"],"parameters":[{"$ref":"#/components/parameters/Authorization"},{"$ref":"#/components/parameters/XdrAuthId"},{"$ref":"#/components/parameters/XdrNonce"},{"$ref":"#/components/parameters/XdrTimestamp"}],"responses":{"200":{"description":"A list of NGFW devices currently connected to CLCS.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetConnectedDevicesResponse"}}}},"401":{"description":"Unauthorized. The API key or key ID is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions to list connected devices. Ensure the key has Data Collection > Data Sources > View permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. An unexpected error occurred on the server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"parameters":{"Authorization":{"name":"Authorization","in":"header","description":"Your Cortex XSIAM API key.","required":true,"schema":{"type":"string"}},"XdrAuthId":{"name":"x-xdr-auth-id","in":"header","description":"Your Cortex XSIAM API key ID.","required":true,"schema":{"type":"string"}},"XdrNonce":{"name":"x-xdr-nonce","in":"header","description":"A unique nonce value used for request authentication.","required":false,"schema":{"type":"string"}},"XdrTimestamp":{"name":"x-xdr-timestamp","in":"header","description":"The Unix timestamp in milliseconds at the time the request is sent.","required":false,"schema":{"type":"string"}}},"schemas":{"GetConnectedDevicesResponse":{"type":"object","description":"The response envelope for the get connected devices operation.","properties":{"reply":{"type":"object","description":"The response payload containing the list of connected devices.","properties":{"devices":{"type":"array","description":"A list of NGFW devices currently connected to CLCS. Returns an empty array if no devices are connected.","items":{"$ref":"#/components/schemas/ConnectedDevice"}}},"required":["devices"]}},"required":["reply"]},"ConnectedDevice":{"type":"object","description":"Represents a single NGFW device connected to CLCS.","properties":{"device_id":{"type":"string","description":"The unique serial number of the NGFW device."},"csp_account_id":{"type":"integer","description":"The CSP (Cloud Service Provider) account ID that the device belongs to."},"region":{"type":"string","description":"The cloud region where the device is deployed."}},"required":["device_id","csp_account_id","region"]},"ErrorResponse":{"type":"object","description":"A standard error response envelope returned when a request fails.","properties":{"reply":{"type":"object","description":"The error payload containing the status code, message, and additional detail.","properties":{"err_code":{"type":"integer","description":"The HTTP status code of the error."},"err_msg":{"type":"string","description":"A short description of the error."},"err_extra":{"type":"string","description":"Additional detail about the error, including remediation guidance where applicable."}},"required":["err_code","err_msg"]}},"required":["reply"]}}}}
```

## Disconnect NGFW devices from CLCS

> Disconnects one or more Next-Generation Firewalls (NGFWs) from the Cloud Logging and Collection Service (CLCS). This operation removes the specified devices from CLCS so they no longer forward logs to Cortex XDR.\
> \
> The request must specify the target devices by their serial numbers (\`device\_ids\`), along with the CSP account ID and region that the devices belong to. Up to 1000 device IDs can be submitted in a single request.\
> \
> If a device ID in the request does not exist or is not connected, it is silently ignored. The response returns only the IDs of devices that were successfully disconnected.\
> \
> \*\*Required license:\*\* This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security or Cloud Posture Security add-ons.\
> \
> \*\*Required permission:\*\* Data Collection > Data Sources > Edit\
> \
> \*\*Validation rules:\*\*\
> \- \`device\_ids\`: Must contain 1–1000 unique alphanumeric strings, each 1–50 characters long.\
> \- \`csp\_account\_id\`: Must be a positive integer.\
> \- \`region\`: Must be a non-empty string (not whitespace-only, not a number).

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSIAM Cloud Logging and Collection Service Management APIs","version":"1.0.0"},"tags":[{"name":"CLCS Management","description":"The Cloud Logging and Collection Service (CLCS) Management APIs allow you to programmatically manage Next-Generation Firewalls (NGFWs) connected to your CLCS environment."}],"servers":[{"url":"https://api-yourfqdn","description":"Your Cortex XSIAM tenant API endpoint. Replace `yourfqdn` with your tenant's fully qualified domain name."}],"paths":{"/public_api/v1/clcs/disconnect_devices":{"post":{"operationId":"postClcsDisconnectDevices","summary":"Disconnect NGFW devices from CLCS","description":"Disconnects one or more Next-Generation Firewalls (NGFWs) from the Cloud Logging and Collection Service (CLCS). This operation removes the specified devices from CLCS so they no longer forward logs to Cortex XDR.\n\nThe request must specify the target devices by their serial numbers (`device_ids`), along with the CSP account ID and region that the devices belong to. Up to 1000 device IDs can be submitted in a single request.\n\nIf a device ID in the request does not exist or is not connected, it is silently ignored. The response returns only the IDs of devices that were successfully disconnected.\n\n**Required license:** This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM product that has the Cloud Runtime Security or Cloud Posture Security add-ons.\n\n**Required permission:** Data Collection > Data Sources > Edit\n\n**Validation rules:**\n- `device_ids`: Must contain 1–1000 unique alphanumeric strings, each 1–50 characters long.\n- `csp_account_id`: Must be a positive integer.\n- `region`: Must be a non-empty string (not whitespace-only, not a number).","tags":["CLCS Management"],"parameters":[{"$ref":"#/components/parameters/Authorization"},{"$ref":"#/components/parameters/XdrAuthId"},{"$ref":"#/components/parameters/XdrNonce"},{"$ref":"#/components/parameters/XdrTimestamp"}],"requestBody":{"description":"The list of NGFW devices to disconnect, identified by their serial numbers, CSP account ID, and region.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectDevicesRequest"}}}},"responses":{"200":{"description":"The operation completed. The response contains the IDs of devices that were successfully disconnected. Device IDs that were not found are silently omitted from the response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectDevicesResponse"}}}},"400":{"description":"**Note:** This response describes the intended validation error envelope. The backend currently raises a generic `500 Internal Server Error` for these validation failures pending a fix to wrap Pydantic validation errors in the documented envelope. Treat the structure below as the contract clients should code against.\n\nBad request. The request body failed validation. Common causes include duplicate device IDs, an invalid or zero-value `csp_account_id`, or an empty `region`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. The API key or key ID provided for this request is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions to disconnect devices. Ensure the key has Data Collection > Data Sources > Edit permission.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error. An unexpected error occurred while processing the disconnect request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"parameters":{"Authorization":{"name":"Authorization","in":"header","description":"Your Cortex XSIAM API key.","required":true,"schema":{"type":"string"}},"XdrAuthId":{"name":"x-xdr-auth-id","in":"header","description":"Your Cortex XSIAM API key ID.","required":true,"schema":{"type":"string"}},"XdrNonce":{"name":"x-xdr-nonce","in":"header","description":"A unique nonce value used for request authentication.","required":false,"schema":{"type":"string"}},"XdrTimestamp":{"name":"x-xdr-timestamp","in":"header","description":"The Unix timestamp in milliseconds at the time the request is sent.","required":false,"schema":{"type":"string"}}},"schemas":{"DisconnectDevicesRequest":{"type":"object","description":"The request body for disconnecting NGFW devices from CLCS.","properties":{"request_data":{"type":"object","description":"The parameters specifying which devices to disconnect.","properties":{"device_ids":{"type":"array","description":"A list of NGFW device serial numbers to disconnect. Must contain 1–1000 unique alphanumeric strings, each between 1 and 50 characters long.","minItems":1,"maxItems":1000,"items":{"type":"string","description":"An alphanumeric NGFW device serial number, between 1 and 50 characters.","minLength":1,"maxLength":50,"pattern":"^[a-zA-Z0-9]+$"}},"csp_account_id":{"type":"integer","description":"The CSP (Cloud Service Provider) account ID that the devices belong to. Must be a positive integer.","minimum":1},"region":{"type":"string","description":"The cloud region where the devices are deployed. Must be a non-empty string (not whitespace-only, not a numeric value).","minLength":1}},"required":["device_ids","csp_account_id","region"]}},"required":["request_data"]},"DisconnectDevicesResponse":{"type":"object","description":"The response envelope for the disconnect devices operation.","properties":{"reply":{"type":"object","description":"The response payload containing the IDs of successfully disconnected devices.","properties":{"device_ids":{"type":"array","description":"The serial numbers of devices that were successfully disconnected. Device IDs from the request that were not found are silently omitted.","items":{"type":"string","description":"An alphanumeric NGFW device serial number."}}},"required":["device_ids"]}},"required":["reply"]},"ErrorResponse":{"type":"object","description":"A standard error response envelope returned when a request fails.","properties":{"reply":{"type":"object","description":"The error payload containing the status code, message, and additional detail.","properties":{"err_code":{"type":"integer","description":"The HTTP status code of the error."},"err_msg":{"type":"string","description":"A short description of the error."},"err_extra":{"type":"string","description":"Additional detail about the error, including remediation guidance where applicable."}},"required":["err_code","err_msg"]}},"required":["reply"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/logging-and-collection-service-management/clcs-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.