> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/scripts.md).

# Scripts

APIs for managing scripts (automations)

## Create or update automation

> Create or update a given automation.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Scripts","description":"APIs for managing scripts (automations)"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"automationScriptFilterWrapper":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}},"application/xml":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}}}}},"schemas":{"automationScriptFilterWrapper":{"type":"object","title":"automationScriptFilterWrapper ...","properties":{"filter":{"$ref":"#/components/schemas/GenericStringFilter"},"savePassword":{"type":"boolean"},"script":{"$ref":"#/components/schemas/AutomationScript"}}},"GenericStringFilter":{"type":"object","description":"GenericStringFilter is a general filter that will fetch entities using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"},"automationScriptResult":{"type":"object","title":"automationScriptResult ...","properties":{"pythonEnabled":{"type":"boolean"},"scripts":{"type":"array","items":{"$ref":"#/components/schemas/ScriptAPI"}},"selectedScript":{"type":"object","additionalProperties":{"type":"object"}},"suggestions":{"type":"array","items":{"type":"string"}}}},"ScriptAPI":{"type":"object","title":"ScriptAPI ...","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}},"paths":{"/automation":{"post":{"summary":"Create or update automation","description":"Create or update a given automation.","operationId":"saveOrUpdateScript","requestBody":{"$ref":"#/components/requestBodies/automationScriptFilterWrapper"},"responses":{"200":{"description":"The saved automation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptResult"}}}}},"tags":["Scripts"]}}}}
```

## Copy automation

> Copy given automation

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Scripts","description":"APIs for managing scripts (automations)"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"automationScriptFilterWrapper":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}},"application/xml":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}}}}},"schemas":{"automationScriptFilterWrapper":{"type":"object","title":"automationScriptFilterWrapper ...","properties":{"filter":{"$ref":"#/components/schemas/GenericStringFilter"},"savePassword":{"type":"boolean"},"script":{"$ref":"#/components/schemas/AutomationScript"}}},"GenericStringFilter":{"type":"object","description":"GenericStringFilter is a general filter that will fetch entities using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"},"automationScriptResult":{"type":"object","title":"automationScriptResult ...","properties":{"pythonEnabled":{"type":"boolean"},"scripts":{"type":"array","items":{"$ref":"#/components/schemas/ScriptAPI"}},"selectedScript":{"type":"object","additionalProperties":{"type":"object"}},"suggestions":{"type":"array","items":{"type":"string"}}}},"ScriptAPI":{"type":"object","title":"ScriptAPI ...","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}},"paths":{"/automation/copy":{"post":{"summary":"Copy automation","description":"Copy given automation","operationId":"copyScript","requestBody":{"$ref":"#/components/requestBodies/automationScriptFilterWrapper"},"responses":{"200":{"description":"The saved automation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptResult"}}}}},"tags":["Scripts"]}}}}
```

## Delete existing automation

> Delete a given automation from the system.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Scripts","description":"APIs for managing scripts (automations)"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"automationScriptFilterWrapper":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}},"application/xml":{"schema":{"$ref":"#/components/schemas/automationScriptFilterWrapper"}}}}},"schemas":{"automationScriptFilterWrapper":{"type":"object","title":"automationScriptFilterWrapper ...","properties":{"filter":{"$ref":"#/components/schemas/GenericStringFilter"},"savePassword":{"type":"boolean"},"script":{"$ref":"#/components/schemas/AutomationScript"}}},"GenericStringFilter":{"type":"object","description":"GenericStringFilter is a general filter that will fetch entities using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}},"paths":{"/automation/delete":{"post":{"summary":"Delete existing automation","description":"Delete a given automation from the system.","operationId":"deleteAutomationScript","requestBody":{"$ref":"#/components/requestBodies/automationScriptFilterWrapper"},"responses":{"200":{"description":"automation deleted"}},"tags":["Scripts"]}}}}
```

## Import an automation

> Import an automation to Cortex XSOAR

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Scripts","description":"APIs for managing scripts (automations)"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"importScript":{"content":{"multipart/form-data":{"schema":{"type":"object","properties":{"file":{"description":"file","type":"string"}}}}}}},"schemas":{"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}},"paths":{"/automation/import":{"post":{"summary":"Import an automation","description":"Import an automation to Cortex XSOAR","operationId":"importScript","requestBody":{"$ref":"#/components/requestBodies/importScript"},"responses":{"200":{"description":"The saved automation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationScript"}}}}},"tags":["Scripts"]}}}}
```

## Search Automation (aka scripts)

> Search Automation by filter

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Scripts","description":"APIs for managing scripts (automations)"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"automationScriptFilter":{"type":"object","description":"automationScriptFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"stripContext":{"type":"boolean"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"automationScriptResult":{"type":"object","title":"automationScriptResult ...","properties":{"pythonEnabled":{"type":"boolean"},"scripts":{"type":"array","items":{"$ref":"#/components/schemas/ScriptAPI"}},"selectedScript":{"type":"object","additionalProperties":{"type":"object"}},"suggestions":{"type":"array","items":{"type":"string"}}}},"ScriptAPI":{"type":"object","title":"ScriptAPI ...","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}},"paths":{"/automation/search":{"post":{"summary":"Search Automation (aka scripts)","description":"Search Automation by filter","operationId":"getAutomationScripts","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptFilter"}},"application/xml":{"schema":{"$ref":"#/components/schemas/automationScriptFilter"}}}},"responses":{"200":{"description":"automationScriptResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/automationScriptResult"}}}}},"tags":["Scripts"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/scripts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.