XSIAM - API Get Correlation Rules - Least Priviledge

[J.MuozTriguero]

In the API reference, it states that you must have Instance Administrator permissions to run the endpoint /public_api/v1/correlations/get.

Is it possible to create a custom role for the API key that has sufficient permissions to execute this endpoint?

Do you know any other way to retrieve the query from a specific correlation rule?

Cortex XSIAM Cortex XSOAR Cortex XDR 

[susekar · Accepted solution]

Hello @J.MuozTriguero ,

Greetings for the day.

Custom Role for Correlation API

No, it is currently not possible to create a custom role with sufficient permissions to execute the /public_api/v1/correlations/get endpoint. This function is hard-coded by design to require either the built-in Instance Administrator or Account Admin roles.

Attempts to use custom roles—even those granted the highest visible permissions (such as "View/Edit" for "Rules" or "Public API")—will result in a 403 Forbidden error with the message “Insufficient permissions for api key.” This is a known product limitation, and feature requests (such as CXDR-I-2505) have been raised to enable more granular RBAC for administrative API endpoints in the future.

Alternative Ways to Retrieve the Query

If you cannot use the Instance Administrator role for an API key, here are alternative methods to retrieve the XQL query from a correlation rule:

Management Console (UI)

Users with sufficient RBAC permissions (typically Detections & Threat Intel > Detections > Rules set to View or View/Edit) can manually retrieve the query via the web interface:

• Navigate to Detections & Threat Intel → Detection Rules → Correlations
• Right-click the specific rule and select Open in XQL to view the underlying query in the Query Center
• Or select Edit to view the rule configuration

Note:
If a rule uses a dataset that does not exist in the tenant (for example, a rule imported from the Marketplace for a source not yet ingested), it will be hidden from non-admin users. Only Instance Administrators can view rules linked to non-existent datasets.

Scripting with Instance Admin Key

If your goal is automation, you must use an API key assigned the Instance Administrator role.

You can verify connectivity by testing a standard endpoint:

curl -X POST https://api-[TENANT_FQDN]/public_api/v1/endpoints/get_endpoints \
-H "x-xdr-auth-id:[KEY_ID]" \
-H "Authorization:[API_KEY]" \
-H "Content-Type:application/json" \
-d '{"request_data": {}}'

Additional Requirement:

The /public_api/v1/correlations/get endpoint is often disabled by default for new tenants. If you are an Instance Administrator and still receive errors indicating the resource is unavailable, you may need to contact support to have the internal server-side feature flag enabled for your tenant.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar