Remove Tags

post /public_api/v1/tags/agents/remove

Remove one or more tags from one or more endpoints.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

CURL

  curl -X POST \

-H "Accept: application/json" \
 -H "Content-Type: application/json" \
"https://api-yourfqdn/public_api/v1/tags/agents/remove" \
 -d '{
  "request_data" : {
    "filters" : [ {
      "field" : "endpoint_id_list",
      "value" : [ "value", "value" ],
      "operator" : "in"
    }, {
      "field" : "endpoint_id_list",
      "value" : [ "value", "value" ],
      "operator" : "in"
    } ],
    "tag" : "tag"
  }
}'
  

Request

Body

optional

Example: {"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":[""]}],"tag":""}}

request_data

optional

A dictionary containing the following API request fields.

filters

optional

Array

Array of filter fields.

field

required

String (Enum)

String that identifies the field the filter is matching. Filters are based on the following keywords:

endpoint_id_list: List of endpoint IDs.
endpoint_status: Status of the endpoint ID.
dist_name: Distribution / Installation Package name.
ip_list: List of IP addresses.
group_name: Group name the agent belongs to.
platform: Platform name.
alias: Alias name.
isolate: If the endpoint was isolated.
hostname: Hostname

Allowed values:

endpoint_id_list

endpoint_status

dist_name

ip_list

group_name

platform

alias

isolate

hostname

operator

required

String (Enum)

String that identifies the comparison operator you want to use for this filter. Valid keywords and values are: in

endpoint_id_list, dist_name, group_name, alias, hostname, username: List of strings.
endpoint_status: Permitted values are connected or disconnected.
ip_list: List of strings, for example 192.168.5.12.
platform: Permitted values are windows, linux, macos, or android.
isolate: Permitted values are isolated or unisolated.
scan_status: Permitted values are none, pending, in_progress, canceled, aborted, pending_cancellation, success, or error. gte / lte
first_seen and last_seen: Integer in timestamp epoch milliseconds.

Allowed values:

gte

lte

value

required

Array of strings

Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:

endpoint_id_list, distribution_name, hostname, alias, group_name: List of strings.
endpoint_status: Must contain only the following valid values: connected or disconnected
ip_list: String list of IP addresses.
platform: Must contain only the following valid values: windows, linux, macos, or android.
isolate: Must contain only the following valid values: isolated or unisolated.

tag

optional

String

The tag you want to remove.

Responses

Successful response

Body

Bad Request. Got an invalid JSON.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Unauthorized access. User does not have the required license type to run this API.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Unauthorized access. User does not have the required license type to run this API.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.

Internal server error. A unified status for API communication type errors.

Body

The query result upon error.

err_code

optional

String

HTTP response code.

err_msg

optional

String

Error message.

Example: {"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extra

optional

String

Additional information describing the error.