> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cortex XSOAR

> Deploy playbooks to a Palo Alto Cortex XSOAR instance.

## What Cymph uses it for

Cymph connects to Cortex XSOAR as a deployment target — playbooks authored in Cymph are translated to the XSOAR playbook format and pushed to the instance. See [Deploy playbooks](/how-tos/deploy-playbooks).

## Requirements

| Field | Description |
| - | - |
| **Instance URL** | The URL of your Cortex XSOAR instance |
| **Version** | Whether the instance is XSOAR **6** or **8** |
| **API key** | An API key from your instance |
| **API key ID** | **XSOAR 8 only** — the numeric ID shown alongside the key |

To generate an API key, follow the instructions [here](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-6-API/Cortex-XSOAR-6-overview).

<Note>
  The version you select changes both the API paths and the authentication headers. XSOAR 6 sends the key alone; XSOAR 8 additionally sends the key ID as an `x-xdr-auth-id` header, which is why the extra field appears. Selecting the wrong version fails the connection test with "Target does not seem to be a valid Cortex XSOAR *version* instance".
</Note>

## Permissions

An API key is assigned a role, and the key inherits that role's permissions. Rather than using an administrative key, create a custom role granting only what Cymph uses:

| Component | Level | Why |
| - | - | - |
| **Playbooks** | Read-Write | Search and read playbooks, and save a deployed playbook |
| **Incidents** | Read-Only | Search incidents when resolving deployment targets |

Everything else can be set to **None** — Cymph does not run playbooks, execute automations, manage integrations, or read the War Room.

<Tip>
  Cortex XSOAR's built-in roles are broader than this. **Instance Admin** in particular grants far more than Cymph needs; a custom role with the two components above is the least-privilege option.
</Tip>

## What Cymph reads and writes

## Testing the connection


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.