Cortex XDR API get_endpoints vs get_endpoint

[A.Tskhe624154]

Hello,

I've been using python script to get all endpoints /public_api/v1/endpoints/get_endpoints

(https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Endpoints).

Recently there was another business requirement to get OS type of all endpoints and /public_api/v1/endpoints/get_endpoint seems to have more data and contain fields I need  (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-Endpoint). Since there is a limit of 100 record per request I loop request till I get all data.

The problem is that APIs return different number of unique endpoints, first one returns about 7500 records, second one about 5000. Plus, when I retry query using second API results fluctuate a bit.

UPDATE:
I wasn't able to figure out why I don't get all data from /public_api/v1/endpoints/get_endpoint and decided to go with XQL query (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Running-XQL-Query-API...). Works fine and I'm able to get all my endpoints.

[robert2003b]

The /public_api/v1/endpoints/get_endpoints and /public_api/v1/endpoints/get_endpoint APIs may have different underlying implementations or data consistency checks, which could explain the discrepancy in the number of records returned. One API might be using cached data, which can lead to stale or inconsistent results. If the data source is not perfectly synchronized between calls, the results may differ. The APIs might be designed to return different sets of data, with one being more comprehensive than the other. With limits on records per request, subsequent calls might be hitting different data snapshots.