Retrieve agent status configurations

Cortex XSIAM Platform APIs

post /public_api/v1/configurations/agent/agent_status

Returns the current agent status configurations for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not impact the VDI or Temporary Session agents.

Authentication: api-key-header-x-xdr-auth-id Api Key "x-xdr-auth-id"
Authentication: api-key-header-authorization Api Key "Authorization"
CLIENT REQUEST
curl -X 'POST'
-H "x-xdr-auth-id: [[apiKey]]" \
-H "Authorization: [[apiKey]]" \
-H 'Accept: application/json'
'https://api-yourfqdn/public_api/v1/configurations/agent/agent_status'
import http.client conn = http.client.HTTPSConnection("api-yourfqdn") headers = { 'x-xdr-auth-id': "REPLACE_KEY_VALUE" } conn.request("POST", "/public_api/v1/configurations/agent/agent_status", headers=headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
require 'uri' require 'net/http' require 'openssl' url = URI("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request["x-xdr-auth-id"] = 'REPLACE_KEY_VALUE' response = http.request(request) puts response.read_body
const data = null; const xhr = new XMLHttpRequest(); xhr.withCredentials = true; xhr.addEventListener("readystatechange", function () { if (this.readyState === this.DONE) { console.log(this.responseText); } }); xhr.open("POST", "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); xhr.setRequestHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE"); xhr.send(data);
HttpResponse<String> response = Unirest.post("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status") .header("x-xdr-auth-id", "REPLACE_KEY_VALUE") .asString();
import Foundation let headers = ["x-xdr-auth-id": "REPLACE_KEY_VALUE"] let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume()
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_HTTPHEADER => [ "x-xdr-auth-id: REPLACE_KEY_VALUE" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }
CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST"); curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "x-xdr-auth-id: REPLACE_KEY_VALUE"); curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers); CURLcode ret = curl_easy_perform(hnd);
var client = new RestClient("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); var request = new RestRequest(Method.POST); request.AddHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE"); IRestResponse response = client.Execute(request);
Responses

Successful response containing the current agent status configuration.

Body
application/json

Current agent status timeout configuration.

replyobject
license_revocation_after_lost_connectioninteger

Indicates the current number of days after which the license is revoked when an agent loses connection to Cortex.

Example:30
agent_deletion_retentioninteger

Indicates the number of days to retain agent data before deletion from the Cortex database after loss of connection.

Example:90
RESPONSE
{ "reply": { "license_revocation_after_lost_connection": 30, "agent_deletion_retention": 90 } }

Bad request. The request was malformed or contained invalid parameters.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSE
{ "reply": { "err_code": 400, "err_msg": "Bad request. Got an invalid JSON.", "err_extra": "Additional error context" } }

Unauthorized. Authentication credentials are missing or invalid.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSE
{ "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": "Additional error context" } }

Forbidden. The API key does not have the required permissions.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSE
{ "reply": { "err_code": 403, "err_msg": "Forbidden. Access was denied to this resource.", "err_extra": "Insufficient permissions for api key" } }

Internal server error.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSE
{ "reply": { "err_code": 500, "err_msg": "Internal server error", "err_extra": "Additional error context" } }