> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/panther-developer-workflows/detections-repo/pat/managing-scheduled-prompts.md).

# Managing Scheduled Prompts with the Panther Analysis Tool

## Overview

[Scheduled AI prompts](/ai/using-panther-ai/scheduled-ai-prompts.md) run Panther AI analyses automatically on a defined schedule. You can manage them as code — validating, packaging, and uploading them through CI/CD — using the [Panther Analysis Tool (PAT)](/panther-developer-workflows/detections-repo/pat.md), the same way you manage rules and scheduled searches.

{% hint style="warning" %}
Bulk upload is **shared-only**: a prompt with `Private: true` is rejected on import. You can download a private prompt for backup, but it will fail to re-import. You can only make a prompt private through the Panther Console.
{% endhint %}

## Prerequisites

* PAT must be [installed and authenticated with an API token](/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat.md). **Scheduled prompts require API-token authentication** (`--api-token` and `--api-host`) — AWS-profile authentication is not supported for prompts, because every prompt must have a real owner.
* The API token's role must hold the following permissions:
  * `BulkUpload` (or `BulkUploadValidate` for `validate` only)
  * `ManageScheduledPrompts`
  * `AIRunAsModify` — always required when uploading with an API token (a token is never its own `RunAsUser`); with user authentication, required only when a prompt's `RunAsUser` is a different user.
* The `RunAsUser` target (a user or API token) must hold the **Run Panther AI** permission.

See [RBAC](/system-configuration/rbac.md) for permission details.

## Authoring a scheduled prompt

Each prompt is a single YAML document (one prompt per file). When PAT auto-discovers content (run without an explicit `--path`), folders containing prompts must have `scheduled_prompts` in their name. When you pass `--path` directly to a prompts folder (as in the examples below), PAT walks that path regardless of its name.

```yaml
AnalysisType: scheduled_prompt
PromptName: weekly_iam_review
DisplayName: Weekly IAM Review
Description: Summarize unusual new IAM users created this week.
PromptText: |
  Look at the new IAM users created this week.
  Summarize anything unusual, especially accounts with broad permissions.
OutputLength: medium
Private: false
Enabled: true
RunAsUser: alice@example.com
Schedule:
  CronExpression: "0 9 * * 1"
  TimeoutMinutes: 10
```

For the full field reference, see [Manage scheduled prompts as code](/ai/using-panther-ai/scheduled-ai-prompts.md#manage-scheduled-prompts-as-code).

## Validating and uploading

```bash
# Validate without writing any changes
pat validate --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"

# Upload
pat upload --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"
```

The upsert key is `PromptName` (scoped to shared prompts). Re-uploading a file updates the existing shared prompt in place and preserves its owner — it does not create a duplicate.

## Retiring a prompt

There is no `pat delete` for scheduled prompts. To take a prompt out of rotation as-code, set `Enabled: false` and re-upload. To permanently delete a prompt, use the [Panther Console](/ai/using-panther-ai/scheduled-ai-prompts.md#delete-a-scheduled-prompt).

## Downloading existing prompts

You can export prompts from the Console as YAML to bring them under version control. See [Manage scheduled prompts as code](/ai/using-panther-ai/scheduled-ai-prompts.md#manage-scheduled-prompts-as-code).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.panther.com/panther-developer-workflows/detections-repo/pat/managing-scheduled-prompts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.