sectionorder:
- Connect
commonfields:
  id: Core REST API
  version: -1
name: Core REST API
display: Core REST API
category: Utilities
provider: Palo Alto Networks
description: Use Core REST APIs.
configuration:
- display: Core Server URL
  name: url
  defaultvalue: https://127.0.0.1
  type: 0
  required: true
  additionalinfo: For Cortex XSOAR 8 or Cortex XSIAM, use the Copy API URL button on the API Keys page. For Cortex XSOAR 6, use the server URL.
  section: Connect
- display: API Key ID
  displaypassword: API Key
  name: creds_apikey
  type: 9
  additionalinfo: Please provide API Key ID when using Cortex XSIAM or Cortex XSOAR 8.0.0 and above.
  required: false
  section: Connect
- display: Authentication method
  name: auth_method
  type: 15
  defaultvalue: Advanced
  additionalinfo: Whether authentication should be using "Standard" API key or "Advanced" API key. For XSOAR version < 8.0.0, choose "Standard".
  options:
  - Standard
  - Advanced
  required: false
  section: Connect
- display: Base marketplace url
  name: marketplace_url
  defaultvalue: https://marketplace.xsoar.paloaltonetworks.com/content/packs/
  type: 0
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use tenant
  additionalinfo: Whether API calls should be made to the current tenant instead of the main tenant.
  name: use_tenant
  type: 8
  required: false
  section: Connect
  advanced: true
script:
  script: ''
  type: javascript
  commands:
  - name: demisto-api-post
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /incident or /public_api/v1/incidents/update_incident).
    - name: body
      description: Body of HTTP POST.
    description: Deprecated. Use core-api-post instead.
    execution: true
    deprecated: true
  - name: demisto-api-get
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user or /public_api/v1/rbac/get_users).
    description: Deprecated. Use core-api-get instead.
    deprecated: true
  - name: demisto-api-put
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    - name: body
      description: Request body.
    description: Deprecated. Use core-api-put instead.
    execution: true
    deprecated: true
  - name: demisto-api-delete
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    description: Deprecated. Use core-api-delete instead.
    execution: true
    deprecated: true
  - name: demisto-api-download
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: filename
      description: File name of download.
    - name: description
      description: Description of file entry.
    description: Deprecated. Use core-api-download instead.
    deprecated: true
  - name: demisto-api-multipart
    arguments:
    - name: uri
      required: true
      description: Request URI.
    - name: entryID
      required: true
      description: File entry ID.
    - name: body
      description: Request body.
    description: Deprecated. Use core-api-multipart instead.
    deprecated: true
  - name: demisto-delete-incidents
    arguments:
    - name: ids
      required: true
      description: IDs of the incidents to delete.
      isArray: true
    - name: fields
      description: 'Comma separated list of fields to return, case sensitive. Set "all" for all fields. WARNING: Setting all fields may result in big results.'
      isArray: true
      defaultValue: id,name,type,severity,status
    description: Deprecated. Use core-delete-incidents instead.
    execution: true
    deprecated: true
  - name: demisto-api-install-packs
    arguments:
    - name: packs_to_install
      description: 'The packs to install in JSON format (e.g. [{"AutoFocus": "2.0.8"}] ).'
      isArray: true
    - name: file_url
      description: 'The pack zip file url.'
    - name: entry_id
      description: 'The War Room entry ID of the pack zip file.'
    - name: skip_verify
      description: 'If true will skip pack signature validation, Available from 6.5.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: skip_validation
      description: 'If true will skip all pack validations, Available from 6.6.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Deprecated. Use core-api-install-packs instead.
    deprecated: true
  - name: core-api-post
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /incident or /public_api/v1/incidents/update_incident).
    - name: body
      description: Body of HTTP POST.
    - name: timeout
      description: Request timeout in minutes. Default is 3 minutes.
    description: send HTTP POST request.
    execution: true
  - name: core-api-get
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user or /public_api/v1/rbac/get_users).
    description: send HTTP GET requests.
  - name: core-api-put
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    - name: body
      description: Request body.
    description: send HTTP PUT request.
    execution: true
  - name: core-api-delete
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    description: send HTTP DELETE request.
    execution: true
  - name: core-api-download
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: filename
      description: File name of download.
    - name: description
      description: Description of file entry.
    description: Download files from Core server.
  - name: core-api-multipart
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: entryID
      required: true
      description: File entry ID.
    - name: body
      description: Request body.
    description: Send HTTP Multipart request to upload files to Core server.
  - name: core-delete-incidents
    arguments:
    - name: ids
      required: true
      description: IDs of the incidents to delete.
      isArray: true
    description: Delete Core incidents.
    execution: true
  - name: core-api-install-packs
    arguments:
    - name: packs_to_install
      description: 'The packs to install in JSON format (e.g. [{"AutoFocus": "2.0.8"}] ).'
      isArray: true
    - name: file_url
      description: 'The pack zip file url.'
    - name: entry_id
      description: 'The War Room entry ID of the pack zip file.'
    - name: skip_verify
      description: 'If true will skip pack signature validation, Available from 6.5.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: skip_validation
      description: 'If true will skip all pack validations, Available from 6.6.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: timeout_in_seconds
      description: The request timeout in seconds.
      defaultValue: '180'
    description: Upload packs to the core server from the URL or marketplace.
  - name: core-api-file-upload
    arguments:
    - name: incident_id
      description: The incident's ID.
    - name: file_name
      description: "The new file's name."
    - name: file_content
      description: "The new file's content."
    - name: entry_id
      description: "The War Room entry ID of the pack zip file."
    description: Upload to the incident a file that the user provided according to the entry_id or the content of the file.
  - name: core-api-file-delete
    arguments:
    - name: entry_id
      description: "The War Room entry ID of the file."
      required: true
    description: Delete a war room (investigation) file entry.
  - name: core-api-file-attachment-delete
    arguments:
    - name: incident_id
      required: true
      description: The incident's ID.
    - name: file_path
      required: true
      description: "The file's path."
    - name: field_name
      defaultValue: 'attachment'
      description: "Name of the field (type attachment) from which to remove the attachment."
    description: Delete a file attachment from an incident — specifically from the incident’s file attachments.
  - name: core-api-file-check
    arguments:
    - name: entry_id
      description: "The War Room entry ID of the file."
      required: true
    description: Check if the file exists in Cortex XSOAR (Context) by entry_id.
    outputs:
    - description: Dictionary with EntryID as the key and boolean if the file exists as a value in Context.
      contextPath: IsFileExists
tests:
- TestDemistoRestAPI
- UploadFile Test
fromversion: 5.0.0