Self-service API keys for CLI scans - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Follow this procedure if you have Instance Admin or Account Admin privileges. Because you already hold tenant-wide permissions, you do not need to assign CLI roles to your user account via User Groups. You can skip those steps (required for non-admins) and attach the default CLI roles directly to the API key.

The following procedure is required for non-admin users, because the built-in CLI and CLI Read Only roles are not visible in the API Keys screen for non-admins.

Now that you have the required permissions (from either Path A or Path B), you must manually generate a Primary API Key through the console. This primary key acts as the master credential for subsequent automation.

Using the Primary Key, developers can now make calls to the Public API to generate subsequent keys as needed for IDE or CLI scans:

The following curl command demonstrates how developers can use the Primary Key to generate a new API key assigned with the CLI Read-Only role:

curl --request POST \
  --url https://api-<YOUR_TENANT>.xdr.<REGION>.paloaltonetworks.com/public_api/v1/api_keys/generate \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: <YOUR_PRIMARY_KEY_HERE>' \
  --header 'x-xdr-auth-id: <YOUR_AUTH_ID>' \
  --data '{
  "request_data": {
    "roles": [
      "CLI Read-Only Custom"
    ],
    "security_level": "standard",
    "comment": "Developer CLI Read-Only scan key",
    "expiration": <FUTURE_EPOCH_TIMESTAMP> 
  }
}'

To ensure the keys are configured correctly, privileged users can verify their status by navigating to Settings → API Keys. Locate the generated key in the API Keys inventory and confirm that the Role column reflects the specific custom role assigned rather than a broad administrative role.

For more information about generating API Keys, refer to Manage API keys.