openapi: 3.2.0 info: title: Cisco Secure Firewall Command Line Interface API version: 1.13.0 contact: name: Cisco Security Cloud Control TAC email: cdo.tac@cisco.com description: 'Operations tagged Command Line Interface across 2 of this provider''s published API definitions: cisco-secure-firewall-scc-firewall-manager-openapi.yml, scc-firewall-manager-openapi.yaml. Each path carries the servers of the definition it was published in.' x-provenance: method: harvested first_party: true harvested: '2026-08-19' source: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/openapi.yaml source_repo: https://github.com/CiscoDevNet/scc-public-api-docs note: Verbatim first-party OpenAPI published by Cisco in the CiscoDevNet scc-public-api-docs repository, the source of record for developer.cisco.com/docs/cisco-security-cloud-control-firewall-manager/. Not authored or modified by API Evangelist. derived_view: Per-tag view of cisco-secure-firewall-scc-firewall-manager-openapi.yml, the provider's source document. Operations and schemas are the provider's, unmodified; only the partition is ours. derived_from: cisco-secure-firewall-scc-firewall-manager-openapi.yml operation_coverage: 9/9 x-evidence: fetched: '2026-08-19' url: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/openapi.yaml http_status: 200 servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 tags: - name: Command Line Interface paths: /v1/cli/macros: get: description: Get a list of CLI macros. A CLI macro is a fully-formed CLI command ready to use, or a template of a CLI command you can modify before you run it. operationId: getCliMacros parameters: - description: The number of results to retrieve. in: query name: limit required: false schema: maximum: 200 minimum: 0 type: string - description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine the index of the first result retrieved, and will retrieve `limit` results from the offset specified. in: query name: offset required: false schema: minimum: 0 type: string - description: The query to execute. Use the Lucene Query Syntax to construct your query. example: fieldName:fieldValue in: query name: q required: false schema: type: string - description: The fields to sort results by. example: name:DESC in: query name: sort required: false schema: items: type: string type: array responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliMacroPage' description: List of Security Cloud Control CLI macros '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Get CLI Macros tags: - Command Line Interface post: description: Create a CLI macro, which is a fully-formed CLI command ready to use or a template of a CLI command you can modify before you run it. operationId: createCliMacro requestBody: content: application/json: schema: $ref: '#/components/schemas/CliMacroCreateInput' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliMacro' description: Security Cloud Control CLI macro '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Create CLI Macro tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 /v1/cli/macros/{macroUid}: delete: description: Delete a Security Cloud Control CLI Macro by UID. operationId: deleteCliMacro parameters: - description: The unique identifier, represented as a UUID, of the CDO CLI macro in Security Cloud Control. in: path name: macroUid required: true schema: format: uuid type: string responses: '204': description: Security Cloud Control CLI macro '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Delete CLI Macro tags: - Command Line Interface get: description: 'Get a Security Cloud Control CLI Macro by UID. Note: This operation only returns the SCC CLI Macro. For executing the SCC CLI Macro, refer to the [Execute CLI Macro](https://developer.cisco.com/docs/cisco-security-cloud-control/execute-cli-macro-command/) command.' operationId: getCliMacro parameters: - description: The unique identifier, represented as a UUID, of the CDO CLI macro in Security Cloud Control. in: path name: macroUid required: true schema: format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliMacro' description: Security Cloud Control CLI macro '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '404': $ref: '#/components/responses/http404NotFound' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Get CLI Macro tags: - Command Line Interface patch: description: Modify a Security Cloud Control CLI Macro by UID. operationId: modifyCliMacro parameters: - description: The unique identifier, represented as a UUID, of the CDO CLI macro in Security Cloud Control. in: path name: macroUid required: true schema: format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CliMacroPatchInput' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliMacro' description: Security Cloud Control CLI macro '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '404': $ref: '#/components/responses/http404NotFound' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Modify CLI Macro tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 /v1/cli/results: get: description: Get a list of results from command lines executed using the [CDO Command Line Interface (CLI)](https://docs.defenseorchestrator.com/c-using-the-cdo-command-line-interface.html). These commands can be executed using either the Security Cloud Control UI or the API. operationId: getCliResults parameters: - description: The number of results to retrieve. in: query name: limit required: false schema: maximum: 200 minimum: 0 type: string - description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine the index of the first result retrieved, and will retrieve `limit` results from the offset specified. in: query name: offset required: false schema: minimum: 0 type: string - description: The query to execute. Use the Lucene Query Syntax to construct your query. example: fieldName:fieldValue in: query name: q required: false schema: type: string - description: The fields to sort results by. example: name:DESC in: query name: sort required: false schema: items: type: string type: array responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliResultPage' description: List of Security Cloud Control CLI execution results '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Get CLI Results tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 /v1/cli/results/{cliResultUid}: get: description: Get the result of a command executed using the Security Cloud Control Command Line Interface (CLI) by UID. operationId: getCliResult parameters: - description: The unique identifier, represented as a UUID, of the CDO CLI result in Security Cloud Control. in: path name: cliResultUid required: true schema: format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/CdoCliResult' description: Security Cloud Control CLI result '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '404': $ref: '#/components/responses/http404NotFound' '405': $ref: '#/components/responses/http405MethodNotAllowed' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Get CLI Result tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 /v1/inventory/devices/asas/cli/execute: post: description: This is an asynchronous operation to execute CLI commands on an ASA device in the Security Cloud Control tenant. operationId: executeCliCommand requestBody: content: application/json: schema: $ref: '#/components/schemas/CliCommandInput' responses: '202': content: application/json: schema: $ref: '#/components/schemas/CdoTransaction' description: Security Cloud Control Transaction object that can be used to track the progress of the execute CLI operation '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Execute CLI Command tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 /v1/inventory/devices/asas/cli/executeMacro: post: description: This is an asynchronous operation to execute an CLI macro on an ASA device in the Security Cloud Control tenant. operationId: executeCliMacro requestBody: content: application/json: schema: $ref: '#/components/schemas/CliMacroExecuteInput' responses: '202': content: application/json: schema: $ref: '#/components/schemas/CdoTransaction' description: Security Cloud Control Transaction object that can be used to track the progress of the execute CLI operation '400': $ref: '#/components/responses/http400BadRequest' '401': $ref: '#/components/responses/http401Unauthorised' '403': $ref: '#/components/responses/http403Forbidden' '500': content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Internal server error. security: - bearerAuth: [] summary: Execute CLI Macro Command tags: - Command Line Interface servers: - url: https://api.us.security.cisco.com/firewall description: US - url: https://api.eu.security.cisco.com/firewall description: EU - url: https://api.apj.security.cisco.com/firewall description: APJ - url: https://api.au.security.cisco.com/firewall description: AUS - url: https://api.in.security.cisco.com/firewall description: IN - url: https://api.int.security.cisco.com/firewall description: Staging - url: https://scale.manage.security.cisco.com/api/rest description: Scale - url: https://ci.manage.security.cisco.com/api/rest description: CI - url: https://manage.stg.secure.cisco/api/rest description: Stgf9 components: responses: http403Forbidden: content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: User does not have sufficient privileges to perform this operation. http404NotFound: content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Entity not found. http400BadRequest: content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Invalid input provided. Check the response for details. http405MethodNotAllowed: content: application/json: schema: $ref: '#/components/schemas/CommonApiError' description: Method not allowed. http401Unauthorised: content: application/json: schema: $ref: '#/components/schemas/AuthenticationError' description: Request not authorized. schemas: AuthenticationError: properties: error: description: A human-readable error description in English. example: invalid_token type: string errorDescription: description: A human-readable error description in English. example: Your token is invalid type: string CliCommandInput: properties: deviceUids: description: List of UIDs of the devices to execute the CLI script for. example: - 7131daad-e813-4b8f-8f42-be1e241e8cdb items: type: string minItems: 1 type: array script: description: The script executed to generate the CLI result. example: show xlate detail minLength: 1 type: string required: - deviceUids - script type: object CdoCliResultPage: properties: count: description: The total number of results available. example: 100 format: int32 type: integer items: description: The list of items retrieved. items: $ref: '#/components/schemas/CdoCliResult' type: array limit: description: The number of results retrieved. example: 50 format: int32 type: integer offset: description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine the index of the first result retrieved, and will retrieve `limit` results from the offset specified. example: 0 format: int32 type: integer type: object CdoTransaction: properties: cdoTransactionStatus: description: The status of the transaction enum: - PENDING - IN_PROGRESS - DONE - ERROR example: IN_PROGRESS type: string entityUid: description: The unique identifier of the entity that the transaction is triggered on. This can be empty, for a transaction that is not tied to an entity, such as transactions which refresh RA VPN sessions. example: f5f660d4-4b81-4374-877d-fbc4bee894e2 format: uuid type: string entityUrl: description: A URL to access the entity that the transaction is triggered on. This can also be empty example: https://edge.us.cdo.cisco.com/platform/public-api/v1/inventory/devices/f5f660d4-4b81-4374-877d-fbc4bee894e2 type: string errorDetails: additionalProperties: type: string description: Transaction error details, if any type: object errorMessage: description: Transaction error message, if any type: string lastUpdatedTime: description: The time (UTC; represented using the RFC-3339 standard) at which the transaction status was last updated example: 2023-12-13 08:15:44+00:00 format: date-time type: string submissionTime: description: The time (UTC; represented using the RFC-3339 standard) at which the transaction was triggered example: 2023-12-13 05:15:44+00:00 format: date-time type: string tenantUid: description: The unique identifier of the tenant that the transaction triggered on. example: 5131daad-e813-4b8f-8f42-be1e241e2cdb format: uuid type: string transactionDetails: additionalProperties: type: string description: Transaction details, if any type: object transactionPollingUrl: description: The URL to poll to track the progress of the transaction. example: https://edge.us.cdo.cisco.com/platform/v1/transactions/7131daad-e813-4b8f-8f42-be1e241e8cdb type: string transactionType: description: the type of the transaction enum: - ONBOARD_ASA - ONBOARD_IOS - ONBOARD_DUO_ADMIN_PANEL - CREATE_FTD - ONBOARD_FTD_ZTP - REGISTER_FTD - DELETE_CDFMC_MANAGED_FTD - RECONNECT_ASA - READ_ASA - BULK_READ_ASA - EXECUTE_CLI_COMMAND - BULK_ACCEPT_ASA_CERTIFICATES - DEPLOY_ASA_DEVICE_CHANGES - DEPLOY_FTD_DEVICE_CHANGES - INDEX_TENANT - TERMINATE_DEVICE_RA_VPN_SESSIONS - REFRESH_RA_VPN_SESSIONS - TERMINATE_USER_RA_VPN_SESSIONS - UPGRADE_ASA - UPGRADE_FTD - UPGRADE_FTD_CACHE - MSP_UPGRADE_FTDS - MSP_GET_COMPATIBLE_FTD_UPGRADE_PACKAGES - CREATE_SDC - SEND_AI_ASSISTANT_MESSAGE - MSP_CREATE_TENANT - MSP_ADD_USERS_TO_TENANT - MSP_ADD_USER_GROUPS_TO_TENANT - MSP_DELETE_USERS_FROM_TENANT - MSP_DELETE_USER_GROUPS_FROM_TENANT - MSP_ADD_EXISTING_TENANT - MSP_ENABLE_MULTICLOUD_DEFENSE - MSP_PROVISION_CDFMC - CREATE_USERS - DELETE_USERS - EXECUTE_ASA_COMMAND - ANALYZE_POLICIES - TRIGGER_FMC_DATA_EXPORT - EXPORT_DEVICES - EXPORT_CLOUD_SERVICES - EXPORT_MANAGERS - EXPORT_TEMPLATES - PROVISION_SDWAN_SAL_RESOURCES - DEPROVISION_SDWAN_SAL_RESOURCES - PROVISION_FIREWALL_SAL_RESOURCES - DEPROVISION_FIREWALL_SAL_RESOURCES - ASA_HEALTH_METRICS_TENANT_OPT_IN - ASA_HEALTH_METRICS_TENANT_OPT_OUT example: ONBOARD_ASA type: string transactionUid: description: The unique identifier of the transaction triggered. example: 7131daad-e813-4b8f-8f42-be1e241e8cdb format: uuid type: string type: object CliMacroExecuteInput: properties: deviceUids: description: List of UIDs of the devices to execute the CLI macro for. example: - 7131daad-e813-4b8f-8f42-be1e241e8cdb items: type: string minItems: 1 type: array macroUid: description: The unique identifier, represented as a UUID, of the CLI macro. example: 7131daad-e813-4b8f-8f42-be1e241e8cdb format: uuid type: string parameters: additionalProperties: type: string description: Parameters provided for the CLI macro execution as key-value pairs. example: USER: admin type: object required: - deviceUids type: object CdoCliMacro: properties: deviceType: $ref: '#/components/schemas/EntityType' description: The type of the device. example: ASA name: description: The name of the CLI macro. example: Disconnect VPN User type: string parameters: description: A set of parameters provided in the script example: - USER items: type: string type: array uniqueItems: true script: description: The script executed to generate the CLI result. example: vpn-sessiondb logoff name {{USER}} noconfirm type: string systemDefined: description: Indicating whether this CLI macro is system-defined. example: true type: boolean uid: description: The unique identifier, represented as a UUID, of the CLI macro. example: 7131daad-e813-4b8f-8f42-be1e241e8cdb format: uuid type: string required: - deviceType - uid type: object CommonApiError: properties: details: additionalProperties: description: Additional details, if any, on the error example: {} type: object description: Additional details, if any, on the error example: {} type: object errorCode: description: A unique code that describes the error. enum: - INVALID_INPUT - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - METHOD_NOT_ALLOWED - CONFLICT - TOO_MANY_REQUESTS - SERVER_ERROR - PROXY_ERROR - BAD_REQUEST - UNPROCESSABLE_ENTITY example: INVALID_INPUT type: string errorMsg: description: A human-readable error description in English. example: sample error type: string EntityType: enum: - ASA - CDFMC_MANAGED_FTD - ONPREM_FMC_MANAGED_FTD - ONPREM_FMC_MANAGED_FIREPOWER - ONPREM_FMC_NGIPS - FDM_MANAGED_FTD - IOS - ISR - SSH_DEVICE - GENERIC_DEVICE - MERAKI_MX - CLOUD_DNG - SFCN - SFCN_DNG - SFCN_STS - ONPREM_FMC - CDFMC - AWS_VPC - AZURE_VNET - DUO_ADMIN_PANEL - UMBRELLA_ORGANIZATION type: string CliMacroCreateInput: properties: description: description: A detailed description of what the CLI Macro does. example: This macro defines a network object in a firewall configuration. type: string deviceType: description: The type of device the CLI Macro is intended for. enum: - ASA - IOS example: IOS type: string name: description: A human-readable name for the CLI Macro. example: My Network Object type: string script: description: The script content of the CLI Macro that will be executed on the device. example: object network obj-192.168.1.0 type: string type: object CdoCliResult: properties: deviceUid: description: The unique identifier, represented as a UUID, of the device. example: 7131daad-e813-4b8f-8f42-be1e241e8cdb format: uuid type: string errorMsg: description: The error message, if any. example: 'Error: Connection timed out' type: string result: description: The result of the CLI execution. example: 5 type: string script: description: The script executed to generate the CLI result. example: show xlate detail type: string startTime: description: The time (in UTC) at which the user run the CLI execution, represented using the RFC-3339 standard. example: 2023-12-13 05:15:44+00:00 format: date-time type: string uid: description: The unique identifier, represented as a UUID, of the CLI execution result. example: 7131daad-e813-4b8f-8f42-be1e241e8cdb format: uuid type: string required: - deviceUid - uid type: object CliMacroPatchInput: properties: description: description: A detailed description of what the CLI Macro does. example: This macro defines a network object in a firewall configuration. type: string name: description: A human-readable name for the CLI Macro. example: My Network Object type: string script: description: The script content of the CLI Macro that will be executed on the device. example: object network obj-192.168.1.0 type: string type: object CdoCliMacroPage: properties: count: description: The total number of results available. example: 100 format: int32 type: integer items: description: The list of items retrieved. items: $ref: '#/components/schemas/CdoCliMacro' type: array limit: description: The number of results retrieved. example: 50 format: int32 type: integer offset: description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine the index of the first result retrieved, and will retrieve `limit` results from the offset specified. example: 0 format: int32 type: integer type: object securitySchemes: bearerAuth: bearerFormat: JWT scheme: bearer type: http x-refined-from: - cisco-secure-firewall-scc-firewall-manager-openapi.yml - scc-firewall-manager-openapi.yaml