Palo Alto Networks Attack Surface Rules API
Attack surface rule configuration and management.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-attacksurfacerules-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Attack Surface Rules API
version: '1.0'
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
description: 'Operations tagged AttackSurfaceRules across 2 of this provider''s published API definitions: palo-alto-cortex-xpanse-api-openapi-original.yml, palo-alto-networks-attacksurfacerules-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex Xpanse tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Xpanse settings page (e.g., example.xpanse.paloaltonetworks.com).
default: example.xpanse.paloaltonetworks.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
tags:
- name: AttackSurfaceRules
description: Attack surface rule configuration and management.
paths:
/attack_surface_rules/get_attack_surface_rules:
post:
operationId: getAttackSurfaceRules
summary: Palo Alto Networks Get Attack Surface Rules
description: Returns the configured attack surface rules. Attack surface rules define the criteria Xpanse uses to classify exposures as incidents, including service type, port, protocol, and risk classification logic. Rules can be enabled, disabled, or customized per business context.
tags:
- AttackSurfaceRules
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
request_data:
type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/Filter'
search_from:
type: integer
default: 0
search_to:
type: integer
default: 100
sort:
$ref: '#/components/schemas/SortOrder'
examples:
GetAttackSurfaceRulesRequestExample:
summary: Default getAttackSurfaceRules request
x-microcks-default: true
value:
request_data:
filters:
- field: example-field
operator: contains
value: example-value
search_from: 0
search_to: 100
sort:
field: example-field
keyword: asc
responses:
'200':
description: Attack surface rules returned successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: object
properties:
total_count:
type: integer
result_count:
type: integer
attack_surface_rules:
type: array
items:
$ref: '#/components/schemas/AttackSurfaceRule'
examples:
GetAttackSurfaceRules200Example:
summary: Default getAttackSurfaceRules 200 response
x-microcks-default: true
value:
reply:
total_count: 281
result_count: 551
attack_surface_rules:
- attack_surface_rule_id: '791314'
attack_surface_rule_name: Production Policy 68
category: standard
description: Monitoring activity on rule malware Security policy violation configured activity applied violation.
remediation_guidance: example-remediation_guidance
enabled_status: false
severity: low
created: 981
modified: 233
release_status: BETA
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xpanseAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex Xpanse tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Xpanse settings page (e.g., example.xpanse.paloaltonetworks.com).
default: example.xpanse.paloaltonetworks.com
/attack_surface_rules/update_attack_surface_rule:
post:
operationId: updateAttackSurfaceRule
summary: Palo Alto Networks Update Attack Surface Rule
description: Updates the configuration of an attack surface rule, such as enabling or disabling it, changing its severity, or modifying the scope of assets it applies to.
tags:
- AttackSurfaceRules
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- request_data
properties:
request_data:
type: object
required:
- attack_surface_rule_id
properties:
attack_surface_rule_id:
type: string
description: Unique identifier of the attack surface rule.
enabled_status:
type: string
enum:
- true
- false
severity:
type: string
enum:
- critical
- high
- medium
- low
- informational
remediation_guidance:
type: string
description: Updated remediation guidance text.
examples:
UpdateAttackSurfaceRuleRequestExample:
summary: Default updateAttackSurfaceRule request
x-microcks-default: true
value:
request_data:
attack_surface_rule_id: '160681'
enabled_status: false
severity: informational
remediation_guidance: example-remediation_guidance
responses:
'200':
description: Attack surface rule updated successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: boolean
examples:
UpdateAttackSurfaceRule200Example:
summary: Default updateAttackSurfaceRule 200 response
x-microcks-default: true
value:
reply: true
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xpanseAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex Xpanse tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Xpanse settings page (e.g., example.xpanse.paloaltonetworks.com).
default: example.xpanse.paloaltonetworks.com
components:
responses:
BadRequest:
description: Malformed request body or invalid parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Missing or invalid authentication headers.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
NotFound:
description: The requested resource was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
AttackSurfaceRule:
type: object
description: An attack surface rule defining criteria for classifying internet exposures as incidents.
properties:
attack_surface_rule_id:
type: string
example: '791314'
attack_surface_rule_name:
type: string
example: Production Policy 68
category:
type: string
description: Rule category (e.g., Unencrypted, Misconfigured, Unauthorized).
example: standard
description:
type: string
example: Monitoring activity on rule malware Security policy violation configured activity applied violation.
remediation_guidance:
type: string
example: example-remediation_guidance
enabled_status:
type: string
enum:
- true
- false
example: false
severity:
type: string
enum:
- critical
- high
- medium
- low
- informational
example: low
created:
type: integer
example: 981
modified:
type: integer
example: 233
release_status:
type: string
enum:
- GA
- BETA
example: BETA
ErrorResponse:
type: object
properties:
reply:
type: object
properties:
err_code:
type: integer
example: 849
err_msg:
type: string
example: example-err_msg
err_extra:
type: string
example: example-err_extra
example:
err_code: 931
err_msg: example-err_msg
err_extra: example-err_extra
Filter:
type: object
description: A filter criterion for querying Xpanse resources.
required:
- field
- operator
- value
properties:
field:
type: string
description: Field name to filter on.
example: example-field
operator:
type: string
enum:
- in
- contains
- gte
- lte
- eq
- neq
example: contains
value:
description: Filter value (string, integer, or array for "in" operator).
oneOf:
- type: string
- type: integer
- type: array
items:
oneOf:
- type: string
- type: integer
example: example-value
SortOrder:
type: object
description: Sorting specification for result sets.
properties:
field:
type: string
example: example-field
keyword:
type: string
enum:
- asc
- desc
example: asc
securitySchemes:
xpanseAuth:
type: apiKey
in: header
name: x-xdr-hmac-v2
description: 'Cortex Xpanse uses a custom HMAC-SHA256 authentication scheme with RBAC API key pairs. Include four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of api_key + nonce + timestamp). API keys are scoped with RBAC roles controlling which Xpanse data and operations are accessible. Generate keys from Xpanse Settings > Configurations > API Keys.'
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cortex-xpanse-api-openapi-original.yml
- palo-alto-networks-attacksurfacerules-api-openapi.yml