Palo Alto Networks Alerts API

openapi: 3.2.0
info:
  title: Palo Alto Networks Alerts API
  x-refined-note:
  - x-description-source differs across the merged source definitions and was not carried
  version: '1.0'
  description: 'Operations tagged Alerts across 12 of this provider''s published API definitions: palo-alto-cortex-xdr-api-openapi-original.yml, palo-alto-cortex-xsiam-api-openapi-original.yml, palo-alto-cspm-alerts-openapi.json, palo-alto-cspm-alertsmicroservices-openapi.json, palo-alto-cspm-alertsnotificationmicroservice-openapi.json, palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-pia-openapi-openapi.json, palo-alto-dspm-dspm-openapi.json, palo-alto-iot-security-api-openapi-original.yml, palo-alto-networks-alerts-api-openapi.yml, palo-alto-prisma-cloud-cspm-api-openapi-original.yml, palo-alto-prisma-cloud-dspm-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api-{fqdn}/public_api/v1
  description: Cortex XDR tenant API endpoint.
  variables:
    fqdn:
      description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
      default: example.xdr.us.paloaltonetworks.com
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
- url: https://api.dig.security
  description: Dig Security public API
- url: PATH_TO_CONSOLE
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
  description: IoT Security API production server.
  variables:
    customer:
      description: Customer-specific tenant identifier.
      default: customer-tenant
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Alerts
  description: Alert retrieval and management.
paths:
  /alerts/get_alerts:
    post:
      operationId: getAlerts
      summary: Palo Alto Networks Get Alerts
      description: Returns alerts matching the specified filter criteria. Alerts represent individual detections from endpoint, network, or cloud data sources. Supports filtering by alert ID, severity, category, and timestamp.
      tags:
      - Alerts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetAlertsRequestExample:
                summary: Default getAlerts request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Alerts returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      alerts:
                        type: array
                        items:
                          $ref: '#/components/schemas/Alert'
              examples:
                GetAlerts200Example:
                  summary: Default getAlerts 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 56
                      result_count: 969
                      alerts:
                      - alert_id: '999423'
                        detection_timestamp: 1733555086833
                        name: Staging Policy 70
                        category: custom
                        description: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected.
                        host_ip:
                        - example-host_ip_item
                        - example-host_ip_item
                        host_name: Corporate Agent 14
                        user_name: jsmith
                        mac:
                        - example-mac_item
                        source: example-source
                        action: alert
                        action_pretty: alert
                        severity: informational
                        matching_status: running
                        alert_type: standard
                        resolution_status: enabled
                        resolution_comment: Monitoring threat applied Security investigation Security configured.
                      - alert_id: '999423'
                        detection_timestamp: 1733555086833
                        name: Staging Policy 70
                        category: custom
                        description: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected.
                        host_ip:
                        - example-host_ip_item
                        - example-host_ip_item
                        host_name: Corporate Agent 14
                        user_name: jsmith
                        mac:
                        - example-mac_item
                        source: example-source
                        action: alert
                        action_pretty: alert
                        severity: informational
                        matching_status: running
                        alert_type: standard
                        resolution_status: enabled
                        resolution_comment: Monitoring threat applied Security investigation Security configured.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - xdrAuth: []
    servers:
    - url: https://api-{fqdn}/public_api/v1
      description: Cortex XDR tenant API endpoint.
      variables:
        fqdn:
          description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
          default: example.xdr.us.paloaltonetworks.com
  /filter/alert/suggest:
    get:
      description: Returns an object whose keys are the available policy filters. The corresponding values are default or recently set filter options
      operationId: get-alert-filter-and-options
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AlertFilterSuggestion'
          description: success
      security:
      - x-redlock-auth: []
      summary: List Alert Filters
      tags:
      - Alerts
    post:
      description: Returns available options for an alert filter key. Supports fuzzy autocomplete search. If you specify a **query** value in the request body parameters, the response includes only items that contain the **query** string.
      operationId: get-alert-filter-options
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/FilterSuggestionModel'
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ParsedTableFilter'
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Alert Filter Autocomplete Suggestions
      tags:
      - Alerts
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /alert:
    get:
      description: "Returns a list of alerts that match the constraints specified in the query parameters. Max 10k results. To get more, use **List Alerts V2 - GET**.  \n\nData in the response object does not include alert rules.\n\nAlso, in the response object:\n\n* Property **riskDetail** is deprecated.\n* Property **resource.cloudServiceName** is populated only for alerts whose resources belong to a cloud service.\n\nWhen `detailed` flag is set to **true**, following fields will be returned within the policy response object:\n\n- `complianceMetadata`\n- `name`\n- `description`\n- `labels`\n- `deleted`\n- `recommendation`\n- `lastModifiedBy`\n- `lastModifiedOn`\n- `severity`\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 2/sec \n* Burst limit: 10/sec        \n"
      operationId: get-alerts
      parameters:
      - description: Time Type
        in: query
        name: timeType
        required: true
        schema:
          enum:
          - relative
          type: string
      - description: Number of **timeUnits**
        in: query
        name: timeAmount
        required: true
        schema:
          type: string
      - description: Time Unit
        in: query
        name: timeUnit
        required: true
        schema:
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
          type: string
      - description: true = Return detailed alert data.
        in: query
        name: detailed
        required: true
        schema:
          type: boolean
      - description: 'Comma-separated list of specific fields to retrieve. Allowed values: alert.id, alert.status, alert.time, cloud.accountId, cloud.account, cloud.region, resource.id, resource.name, policy.name, policy.type, policy.severity'
        in: query
        name: fields
        required: false
        schema:
          type: string
      - description: The maximum number of items that will be returned in one response. The maximum cannot exceed 10,000. The default is 10,000.
        in: query
        name: limit
        required: false
        schema:
          type: number
      - description: Alert ID
        in: query
        name: alert.id
        required: false
        schema:
          type: string
      - description: Alert status
        in: query
        name: alert.status
        required: false
        schema:
          enum:
          - open
          - dismissed
          - snoozed
          - resolved
          - pending_resolution
          type: string
      - description: Cloud account
        in: query
        name: cloud.account
        required: false
        schema:
          type: string
      - description: Cloud account Id
        in: query
        name: cloud.accountId
        required: false
        schema:
          type: string
      - description: Account group
        in: query
        name: account.group
        required: false
        schema:
          type: string
      - description: Cloud type
        in: query
        name: cloud.type
        required: false
        schema:
          type: string
      - description: Cloud region
        in: query
        name: cloud.region
        required: false
        schema:
          type: string
      - description: Cloud service
        in: query
        name: cloud.service
        required: false
        schema:
          type: string
      - description: Policy ID
        in: query
        name: policy.id
        required: false
        schema:
          type: string
      - description: Policy name
        in: query
        name: policy.name
        required: false
        schema:
          type: string
      - description: Policy severity
        in: query
        name: policy.severity
        required: false
        schema:
          enum:
          - critical
          - high
          - medium
          - low
          - informational
          type: string
      - description: Policy label
        in: query
        name: policy.label
        required: false
        schema:
          type: string
      - description: Policy type
        in: query
        name: policy.type
        required: false
        schema:
          enum:
          - config
          - network
          - audit_event
          type: string
      - description: Policy compliance standard name
        in: query
        name: policy.complianceStandard
        required: false
        schema:
          type: string
      - description: Policy compliance requirement name
        in: query
        name: policy.complianceRequirement
        required: false
        schema:
          type: string
      - description: Policy compliance section ID
        in: query
        name: policy.complianceSection
        required: false
        schema:
          type: string
      - description: Policy is remediable
        in: query
        name: policy.remediable
        required: false
        schema:
          enum:
          - 'true'
          - 'false'
          type: string
      - description: Alert rule name
        in: query
        name: alertRule.name
        required: false
        schema:
          type: string
      - description: Resource ID
        in: query
        name: resource.id
        required: false
        schema:
          type: string
      - description: Resource name
        in: query
        name: resource.name
        required: false
        schema:
          type: string
      - description: Resource TYPE
        in: query
        name: resource.type
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AlertModel'
                type: array
          description: successful operation
        '400':
          description: internal_error
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      summary: List Alerts - GET
      tags:
      - Alerts
    post:
      description: "Returns a list of alerts that matches the constraints specified in the body parameters. Max 10k results. To get more, use **List Alerts V2 - POST**.  \n\nThe **fields** body parameter allows you to request specific fields from the alert payload. These fields\nare separate from the filters you specify. The following are valid **fields** items.\n\n* alert.id\n* alert.status\n* alert.time\n* cloud.account\n* cloud.accountId\n* cloud.region\n* resource.id\n* resource.name\n* policy.name\n* policy.type\n* policy.severity\n\nThe **filters** body parameter enables you to narrow your request for alerts. See \n[List Alert Filters](/prisma-cloud/api/cspm/get-alert-filter-and-options) \nfor an API request to list all the valid filters.\n\nData in the response object does not include alert rules.\n\nAlso, in the response object:\n\n* Property **riskDetail** is deprecated.\n* Property **resource.cloudServiceName** is populated only for alerts whose resources belong to a cloud service.\n\nWhen `detailed` flag is set to **true**, following fields will be returned within the policy response object:\n\n- `complianceMetadata`\n- `name`\n- `description`\n- `labels`\n- `deleted`\n- `recommendation`\n- `lastModifiedBy`\n- `lastModifiedOn`\n- `severity`\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 2/sec \n* Burst limit: 10/sec        \n"
      operationId: post-alerts
      parameters:
      - description: true = Return detailed alert data. Default is false. Overrides **detailed** in body param.
        in: query
        name: detailed
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/FilterModel'
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AlertModel'
                type: array
          description: successful operation
        '400':
          description: internal_error
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      summary: List Alerts - POST
      tags:
      - Alerts
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /v2/alert:
    get:
      description: "Returns a paginated list of alerts from the Prisma Cloud platform.  \n\nData in the response object does not include alert rules.\n\nAlso, in the response object:\n\n* Property **riskDetail** is deprecated.\n* Property **items[].resource.cloudServiceName** is populated only for alerts whose resources belong to a cloud service.\n\nWhen `detailed` flag is set to **true**, following fields will be returned within the policy response object:\n\n- `complianceMetadata`\n- `name`\n- `description`\n- `labels`\n- `deleted`\n- `recommendation`\n- `lastModifiedBy`\n- `lastModifiedOn`\n- `severity`\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 2/sec \n* Burst limit: 10/sec      \n"
      operationId: get-alerts-v2
      parameters:
      - description: Time Type
        in: query
        name: timeType
        required: true
        schema:
          enum:
          - relative
          type: string
      - description: Number of **timeUnits**
        in: query
        name: timeAmount
        required: true
        schema:
          type: string
      - description: Time Unit
        in: query
        name: timeUnit
        required: true
        schema:
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
          type: string
      - description: true = Return detailed alert data.
        in: query
        name: detailed
        required: true
        schema:
          type: boolean
      - description: 'Array of specific fields to return. Allowed fields: alert.id, alert.status, alert.time, cloud.accountId, cloud.account, cloud.region, resource.id, resource.name, policy.name, policy.type, policy.severity'
        in: query
        name: fields
        required: false
        schema:
          type: string
      - description: 'Response object property by which to sort response list. The valid values are in the response object attribute **sortAllowedColumns**. The format is **property:asc** for ascending and **property:desc** for descending sort '
        example: sortBy=id:desc&sortBy=firstseen:asc,lastseen:desc
        in: query
        name: sortBy
        required: false
        schema:
          type: string
      - description: The maximum number of items that will be returned in one response. The maximum cannot exceed 10,000. The default is 10,000.
        in: query
        name: limit
        required: false
        schema:
          type: number
      - description: Token that identifies the required page of data. When there are multiple pages of data in the response, set **pageToken** to the **nextPageToken** value from the previous API response to retrieve the next page of data.
        in: query
        name: pageToken
        required: false
        schema:
          type: string
      - description: Alert ID
        in: query
        name: alert.id
        required: false
        schema:
          type: string
      - description: Alert status
        in: query
        name: alert.status
        required: false
        schema:
          enum:
          - open
          - dismissed
          - snoozed
          - resolved
          - pending_resolution
          type: string
      - description: Cloud account
        in: query
        name: cloud.account
        required: false
        schema:
          type: string
      - description: Cloud account Id
        in: query
        name: cloud.accountId
        required: false
        schema:
          type: string
      - description: Account group
        in: query
        name: account.group
        required: false
        schema:
          type: string
      - description: Cloud type
        in: query
        name: cloud.type
        required: false
        schema:
          type: string
      - description: Cloud region
        in: query
        name: cloud.region
        required: false
        schema:
          type: string
      - description: Cloud service
        in: query
        name: cloud.service
        required: false
        schema:
          type: string
      - description: Policy ID
        in: query
        name: policy.id
        required: false
        schema:
          type: string
      - description: Policy name
        in: query
        name: policy.name
        required: false
        schema:
          type: string
      - description: Policy severity
        in: query
        name: policy.severity
        required: false
        schema:
          enum:
          - critical
          - high
          - medium
          - low
          - informational
          type: string
      - description: Policy label
        in: query
        name: policy.label
        required: false
        schema:
          type: string
      - description: Policy type
        in: query
        name: policy.type
        required: false
        schema:
          enum:
          - config
          - network
          - audit_event
          type: string
      - description: Policy compliance standard name
        in: query
        name: policy.complianceStandard
        required: false
        schema:
          type: string
      - description: Policy compliance requirement name
        in: query
        name: policy.complianceRequirement
        required: false
        schema:
          type: string
      - description: Policy compliance section ID
        in: query
        name: policy.complianceSection
        required: false
        schema:
          type: string
      - description: Policy is remediable
        in: query
        name: policy.remediable
        required: false
        schema:
          enum:
          - 'true'
          - 'false'
          type: string
      - description: Alert rule name
        in: query
        name: alertRule.name
        required: false
        schema:
          type: string
      - description: Resource ID
        in: query
        name: resource.id
        required: false
        schema:
          type: string
      - description: Resource name
        in: query
        name: resource.name
        required: false
        schema:
          type: string
      - description: Resource TYPE
        in: query
        name: resource.type
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PagedResultsAlertModel'
          description: successful operation
        '400':
          description: internal_error
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      summary: List Alerts V2 - GET
      tags:
      - Alerts
    post:
      description: "Returns a paginated list of alerts that matches the constraints specified in the body parameters.  \n\nThe **fields** request body parameter allows you to request specific fields from the alert payload. \nThese fields are separate from the filters you specify. The following are valid **fields** items.\n\n* alert.id\n* alert.status\n* alert.time\n* cloud.account\n* cloud.accountId\n* cloud.region\n* resource.id\n* resource.name\n* policy.name\n* policy.type\n* policy.severity\n\nThe **filters** request body parameter enables you to narrow your request for alerts. See \n[List Alert Filters](/prisma-cloud/api/cspm/get-alert-filter-and-options) \nfor an API request to list all the valid filters.\n\nYou can find the valid values for the **sortBy** request body parameter in the response \nobject attribute **sortAllowedColumns**.\n\nData in the response object does not include alert rules.\n\nAlso, in the response object:\n\n* Property **riskDetail** is deprecated.\n* Property **items[].resource.cloudServiceName** is populated only for alerts whose resources belong to a cloud service.\n\nWhen `detailed` flag is set to **true**, following fields will be returned within the policy response object:\n\n- `complianceMetadata`\n- `name`\n- `description`\n- `labels`\n- `deleted`\n- `recommendation`\n- `lastModifiedBy`\n- `lastModifiedOn`\n- `severity`\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 2/sec \n* Burst limit: 10/sec \n"
      operationId: post-alerts-v2
      parameters:
      - description: true = Return detailed alert data. Default is false. Overrides **detailed** in body param.
        in: query
        name: detailed
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/FilterModel'
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/PagedResultsAlertModel'
          description: successful operation
        '400':
          description: internal_error
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      summary: List Alerts V2 - POST
      tags:
      - Alerts
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /alert/policy:
    get:
      description: "Returns alert counts grouped by policy. You can use query parameters to narrow the response.  \n\nIn the response object:\n\n* Property **alertRules** is not populated.         \n* Property **riskDetail** is deprecated.\n* Property **resource.cloudServiceName** is not populated.\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 1/sec \n* Burst limit: 5/sec        \n"
      operationId: get-alerts-grouped
      parameters:
      - description: Alert ID
        in: query
        name: alert.id
        required: false
        schema:
          type: string
      - description: Alert status
        in: query
        name: alert.status
        required: false
        schema:
          enum:
          - open
          - dismissed
          - snoozed
          - resolved
          - pending_resolution
          type: string
      - description: Cloud account
        in: query
        name: cloud.account
        required: false
        schema:
          type: string
      - description: Cloud account Id
        in: query
        name: cloud.accountId
        required: false
        schema:
          type: string
      - description: Account group
        in: query
        name: account.group
        required: false
        schema:
          type: string
      - description: Cloud type
        in: query
        name: cloud.type
        required: false
        schema:
          type: string
      - description: Cloud region
        in: query
        name: cloud.region
        required: false
        schema:
          type: string
      - description: Cloud service
        in: query
        name: cloud.service
        required: false
        schema:
          type: string
      - description: Policy ID
        in: query
        name: policy.id
        required: false
        schema:
          type: string
      - description: Policy name
        in: query
        name: policy.name
        required: false
        schema:
          type: string
      - description: Policy severity
        in: query
        name: policy.severity
        required: false
        schema:
          enum:
          - critical
          - high
          - medium
          - low
          - informational
          type: string
      - description: Policy label
        in: query
        name: policy.label
        required: false
        schema:
          type: string
      - description: Policy type
        in: query
        name: policy.type
        required: false
        schema:
          enum:
          - config
          - network
          - audit_event
          type: string
      - description: Policy compliance standard name
        in: query
        name: policy.complianceStandard
        required: false
        schema:
          type: string
      - description: Policy compliance requirement name
        in: query
        name: policy.complianceRequirement
        required: false
        schema:
          type: string
      - description: Policy compliance section ID
        in: query
        name: policy.complianceSection
        required: false
        schema:
          type: string
      - description: Policy is remediable
        in: query
        name: policy.remediable
        required: false
        schema:
          enum:
          - 'true'
          - 'false'
          type: string
      - description: Alert rule name
        in: query
        name: alertRule.name
        required: false
        schema:
          type: string
      - description: Resource ID
        in: query
        name: resource.id
        required: false
        schema:
          type: string
      - description: Resource name
        in: query
        name: resource.name
        required: false
        schema:
          type: string
      - description: Resource TYPE
        in: query
        name: resource.type
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/AlertModel'
                type: array
          description: successful operation
        '400':
          description: internal_error
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      summary: List Alert Counts By Policy - GET
      tags:
      - Alerts
    post:
      description: "Returns alert counts grouped by policy. You can use body parameters to na

# --- truncated at 32 KB (215 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-alerts-api-openapi.yml