Retrieve agent status timeout settings

Cortex XSIAM Platform APIs

get /public_api/v1/configurations/agent/agent_status

Returns the current agent status configuration for the tenant, including license revocation timeout and agent deletion retention period.

Requires appropriate RBAC permissions for agent settings management.

Authentication: api-key-header-x-xdr-auth-id Api Key "x-xdr-auth-id"
Authentication: api-key-header-authorization Api Key "Authorization"
CLIENT REQUEST
curl -X 'GET'
-H "x-xdr-auth-id: [[apiKey]]" \
-H "Authorization: [[apiKey]]" \
-H 'Accept: application/json'
'https://api-yourfqdn/public_api/v1/configurations/agent/agent_status'
import http.client conn = http.client.HTTPSConnection("api-yourfqdn") headers = { 'x-xdr-auth-id': "REPLACE_KEY_VALUE" } conn.request("GET", "/public_api/v1/configurations/agent/agent_status", headers=headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
require 'uri' require 'net/http' require 'openssl' url = URI("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Get.new(url) request["x-xdr-auth-id"] = 'REPLACE_KEY_VALUE' response = http.request(request) puts response.read_body
const data = null; const xhr = new XMLHttpRequest(); xhr.withCredentials = true; xhr.addEventListener("readystatechange", function () { if (this.readyState === this.DONE) { console.log(this.responseText); } }); xhr.open("GET", "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); xhr.setRequestHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE"); xhr.send(data);
HttpResponse<String> response = Unirest.get("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status") .header("x-xdr-auth-id", "REPLACE_KEY_VALUE") .asString();
import Foundation let headers = ["x-xdr-auth-id": "REPLACE_KEY_VALUE"] let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume()
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "GET", CURLOPT_HTTPHEADER => [ "x-xdr-auth-id: REPLACE_KEY_VALUE" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }
CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "GET"); curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "x-xdr-auth-id: REPLACE_KEY_VALUE"); curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers); CURLcode ret = curl_easy_perform(hnd);
var client = new RestClient("https://api-yourfqdn/public_api/v1/configurations/agent/agent_status"); var request = new RestRequest(Method.GET); request.AddHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE"); IRestResponse response = client.Execute(request);
Responses

Successful response containing the current agent status configuration.

Body
application/json

Current agent status timeout configuration.

license_revocation_after_lost_connectioninteger

The current number of days after which the license is revoked when an agent loses connection.

Example:30
agent_deletion_retentioninteger

The current number of days agent data is retained before automatic deletion after disconnection.

Example:90
RESPONSE
{ "license_revocation_after_lost_connection": 30, "agent_deletion_retention": 90 }

Bad request. The request was malformed or contained invalid parameters.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

Example:500
err_msgstring

Human-readable error message describing what went wrong.

Example:"Internal server error"
err_extrastring

Additional context about the error, if available.

Example:"Additional error context"
RESPONSE
{ "reply": { "err_code": 500, "err_msg": "Internal server error", "err_extra": "Additional error context" } }

Unauthorized. Authentication credentials are missing or invalid.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

Example:500
err_msgstring

Human-readable error message describing what went wrong.

Example:"Internal server error"
err_extrastring

Additional context about the error, if available.

Example:"Additional error context"
RESPONSE
{ "reply": { "err_code": 500, "err_msg": "Internal server error", "err_extra": "Additional error context" } }

Forbidden. The API key does not have the required permissions.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

Example:500
err_msgstring

Human-readable error message describing what went wrong.

Example:"Internal server error"
err_extrastring

Additional context about the error, if available.

Example:"Additional error context"
RESPONSE
{ "reply": { "err_code": 500, "err_msg": "Internal server error", "err_extra": "Additional error context" } }

Internal server error.

Body
application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

Example:500
err_msgstring

Human-readable error message describing what went wrong.

Example:"Internal server error"
err_extrastring

Additional context about the error, if available.

Example:"Additional error context"
RESPONSE
{ "reply": { "err_code": 500, "err_msg": "Internal server error", "err_extra": "Additional error context" } }