Get started with Cortex XSOAR 8.x APIs

Cortex XSOAR is a comprehensive security orchestration, automation and response (SOAR) platform that unifies case management, automation, real-time collaboration and threat intel management to serve security teams across the incident lifecycle. Using the Cortex XSOAR APIs, you can integrate Cortex XSOAR with third-party apps or services. The APIs allow you to create and search for incidents, search for indicators, and retrieve a widget's statistics.

Before you can begin using Cortex XSOAR APIs, you must generate the following items from Cortex XSOAR:

Value	Description
API Key	The API Key is your unique identifier used as the Authorization:{key} header required for authenticating API calls. Depending on your desired security level, you can generate two types of API keys, Advanced or Standard, from Cortex XSOAR.
API Key ID	The API Key ID is your unique token used to authenticate the API Key. The header used when running an API call is x-xdr-auth-id:{key_id}.
FQDN	The FQDN is a unique host and domain name associated with each tenant.

Cortex XSOAR API URIs are made up of your tenant's FQDN, the API name, and endpoint path. For example, https://api-{fqdn}/xsoar/public/v1/{endpoint_path}/.

Note

In Cortex XSOAR OPP, you must add a DNS record that points the Cortex XSOAR DNS name that is mapped to the API IP address. For example, api-xsoar.mycompany.com.

The following steps describe how to generate the necessary key values and run your first API call:

1. Create a new API key.
2. Get your Cortex XSOAR API key ID.
3. Get your FQDN.
4. Make your first API call.