Palo Alto Networks Attachments API
Email attachment retrieval operations.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-attachments-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Attachments API
version: '1.0'
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
description: 'Operations tagged Attachments across 2 of this provider''s published API definitions: palo-alto-email-dlp-api-openapi-original.yml, palo-alto-networks-attachments-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.{region}.dlp.paloaltonetworks.com/v1
description: Email DLP API production server.
variables:
region:
description: Deployment region for the Email DLP service. Choose the region matching your tenant data residency.
default: us
enum:
- us
- eu
- in
- apac
- uk
- jp
- au
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
tags:
- name: Attachments
description: Email attachment retrieval operations.
paths:
/email-incidents/{id}/attachments:
get:
operationId: getEmailIncidentAttachments
summary: Palo Alto Networks Get Email Incident Attachments
description: Returns metadata for all attachments associated with a specific email DLP incident. Includes attachment filename, content type, size, and data pattern match information for each attachment that contributed to the incident.
tags:
- Attachments
parameters:
- name: id
in: path
required: true
description: Unique incident identifier.
schema:
type: string
example: example-id
responses:
'200':
description: Email attachments returned successfully.
content:
application/json:
schema:
type: object
properties:
incident_id:
type: string
description: Identifier of the parent incident.
attachments:
type: array
items:
$ref: '#/components/schemas/EmailAttachment'
examples:
GetEmailIncidentAttachments200Example:
summary: Default getEmailIncidentAttachments 200 response
x-microcks-default: true
value:
incident_id: '290598'
attachments:
- filename: Corporate Policy 38
content_type: advanced
size: 438
has_matches: false
match_count: 158
patterns_matched:
- example-patterns_matched_item
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- bearerAuth: []
servers:
- url: https://api.{region}.dlp.paloaltonetworks.com/v1
description: Email DLP API production server.
variables:
region:
description: Deployment region for the Email DLP service. Choose the region matching your tenant data residency.
default: us
enum:
- us
- eu
- in
- apac
- uk
- jp
- au
components:
responses:
Forbidden:
description: Insufficient role permissions for this operation.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
InternalServerError:
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Invalid or expired bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
NotFound:
description: The requested resource was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code or type.
example: example-error
message:
type: string
description: Human-readable error message.
example: Policy network malware on detected configured on incident blocked violation.
EmailAttachment:
type: object
properties:
filename:
type: string
description: Attachment filename.
example: Corporate Policy 38
content_type:
type: string
description: MIME content type of the attachment.
example: advanced
size:
type: integer
description: Attachment size in bytes.
example: 438
has_matches:
type: boolean
description: Whether the attachment contained data pattern matches.
example: false
match_count:
type: integer
description: Number of data pattern matches in the attachment.
example: 158
patterns_matched:
type: array
items:
type: string
description: Names of data patterns that matched in the attachment.
example:
- example-patterns_matched_item
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: Bearer token for authentication. Requires SOC_Admin, Superuser, or Data_Security_Admin role assigned in the Palo Alto Networks tenant.
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-email-dlp-api-openapi-original.yml
- palo-alto-networks-attachments-api-openapi.yml