Get Script Metadata

Get the full definitions of a specific script in the scripts library.

Synopsis

URI
/public_api/v1/scripts/get_script_metadata/
HTTP Method
POST
Required License
Cortex XDR Pro per Endpoint

Description

Get the full definitions of a specific script in the scripts library.

Request Fields

The body of this request contains a JSON object with the following fields:
Field
Description
request_data
(
Required
) A dictionary containing the API request fields.
script_uid
(
Required
) Unique identifier of the script, returned by the “get scripts” API per script.
Request Example
curl -X POST https://api-{fqdn}/public_api/v1/scripts/get_script_metadata/ \ -H "x-xdr-auth-id:{API_KEY_ID}" \ -H "Authorization:{API_KEY}" \ -H "Content-Type:application/json" \ -d '{ "request_data":{"script_uid": "<unique ID>"} }'

Success Response

Upon success, the HTTP response code is 200.
Field
Description
reply
JSON object containing the query result.
script_id
Integer, Script ID.
name
String , name of script.
description
String , description of script.
modification_date
Timestamp of when the script was last modified.
created_by
String , name of the user who created the script.
is_high_risk
Boolean , whether the script has a high-risk outcome.
windows_supported
Boolean , whether the script can be executed on Windows OS.
linux_supported
Boolean, whether the script can be executed on Linux OS.
macos_supported
Boolean , whether the script can be executed on macOS.
script_uid
GUID, global ID of the script, used toidentify the script when executing.
entry_point
String , name of the entry point selected for the script. Empty string indicate the script defined as
just run
.
script_input
For each parameter:
name
and
type
for the specified entry point.
script_output_type
String, type of output. Can be either
auto_detect
,
dictionary
,
number_list
,
number
,
string
,
string_list
,
boolean_list
,
ip
,
ip_list
,
boolean
.
script_output_dictionary_definitions
In case of the
script_output_type
is a
dictionary
an array with
friendly_name
,
name
, and
type
for each output is returned.
The field is empty in all other cases.
Success Response Example
{ "reply":{ "script_id":<script ID>, "name":"list_directories", "description":"List all directories under path", "modification_date":1585074627259, "created_by":"Palo Alto Networks", "is_high_risk":false, "windows_supported":true, "linux_supported":true, "macos_supported":true, "script_uid":"<unique ID>", "entry_point":"run", "script_input":[ { "name":"path", "type":"string" }, { "friendly_name":"Number of levels", "name":"num_levels", "type":"number" } ], "script_output_type": "dictionary", "script_output_dictionary_definitions": [ { "friendly_name":"Number Of Processes", "name":"output_2", "type":"number" }, { "friendly_name":"Name", "name":"output_1", "type":"string" } ] } }

Error Response

Upon error, the reply includes an HTTP response code, an error message, and additional information describing the error. The HTTP response code is one of the following:
Field
Description
400
Bad Request. Got an invalid JSON.
401
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
402
Unauthorized access. User does not have the required license type to run this API.
403
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
500
Internal server error. A unified status for API communication type errors.
Error Response Format
{"reply": {"err_code": STATUS_CODE, "err_msg": GENERAL_MESSAGE, "err_extra": EXTRA_DATA}}

Recommended For You