Palo Alto Networks

Palo Alto Networks Audit API

Audit and management log retrieval.

GitHub OpenAPI

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /audit/get_audit_management_logs Get Cortex XDR audit management logs · Palo Alto Networks Get Audit Management Logs #
Ask an LLM
“Who changed policies or logged in to the Cortex XDR console?”
“Can I filter Cortex XDR administrative audit logs?”
Tell an agent
Get Cortex XDR audit management logs.
Pull XDR console audit logs using request {request_data}.
POST /audits/management_logs/get_management_logs Get XSIAM audit management logs · Palo Alto Networks Get Audit Management Logs #
Ask an LLM
“Who created or changed API keys in the XSIAM console?”
“Which data source configuration changes were made in XSIAM?”
Tell an agent
Get XSIAM audit management logs.
Pull XSIAM admin activity logs using request {request_data}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-audit-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-audit-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-audit-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Audit API
  version: '1.0'
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  description: 'Operations tagged Audit across 4 of this provider''s published API definitions: palo-alto-cortex-xdr-api-openapi-original.yml, palo-alto-cortex-xpanse-api-openapi-original.yml, palo-alto-cortex-xsiam-api-openapi-original.yml, palo-alto-networks-audit-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api-{fqdn}/public_api/v1
  description: Cortex XDR tenant API endpoint.
  variables:
    fqdn:
      description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
      default: example.xdr.us.paloaltonetworks.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Audit
  description: Audit and management log retrieval.
paths:
  /audit/get_audit_management_logs:
    post:
      operationId: getAuditManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the Cortex XDR console. Includes user logins, policy changes, and configuration modifications.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetAuditManagementLogsRequestExample:
                summary: Default getAuditManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    - field: example-field
                      operator: lte
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Audit management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog'
              examples:
                GetAuditManagementLogs200Example:
                  summary: Default getAuditManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 974
                      result_count: 325
                      data:
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - xdrAuth: []
    servers:
    - url: https://api-{fqdn}/public_api/v1
      description: Cortex XDR tenant API endpoint.
      variables:
        fqdn:
          description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
          default: example.xdr.us.paloaltonetworks.com
  /audits/management_logs/get_management_logs:
    post:
      operationId: getManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the XSIAM console, including user logins, policy changes, data source configuration, and API key management.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter_3'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder_3'
            examples:
              GetManagementLogsRequestExample:
                summary: Default getManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: eq
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: desc
      responses:
        '200':
          description: Management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog_3'
              examples:
                GetManagementLogs200Example:
                  summary: Default getManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 883
                      result_count: 794
                      data:
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - xsiamAuth: []
    servers:
    - url: https://api-{fqdn}/public_api/v1
      description: Cortex XSIAM tenant API endpoint.
      variables:
        fqdn:
          description: Tenant FQDN from the XSIAM settings page (e.g., example.xsiam.paloaltonetworks.com).
          default: example.xsiam.paloaltonetworks.com
components:
  responses:
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden_2:
      description: Insufficient RBAC permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse_2'
  schemas:
    AuditLog:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1725583298090
        actor_primary_username:
          type: string
          description: Username of the administrator who performed the action.
          example: jsmith
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: API
        sub_type:
          type: string
          description: Action subtype (e.g., Login, Logout, Policy Update).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          description: Failure reason if result is FAIL.
          example: Incident investigation threat Security malware applied detected.
        ip:
          type: string
          description: Source IP address of the action.
          example: 10.144.244.59
        description:
          type: string
          example: Firewall activity alert investigation alert on detected threat network.
    SortOrder:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          description: Field to sort by.
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          description: Sort direction.
          example: asc
    Filter:
      type: object
      description: A filter criterion for querying XDR resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on (e.g., incident_id, status, severity).
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          description: Comparison operator.
          example: lte
        value:
          description: Filter value. Use an array for the "in" operator, a string or integer for others.
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 782
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 270
            err_msg: example-err_msg
            err_extra: example-err_extra
    AuditLog_2:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1729794840874
        actor_primary_username:
          type: string
          example: jsmith
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: User
        sub_type:
          type: string
          description: Action subtype (e.g., Login, IpRangeModified, RuleUpdated).
          example: advanced
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: SUCCESS
        reason:
          type: string
          example: Policy malware firewall violation applied blocked suspicious incident activity.
        ip:
          type: string
          description: Source IP address of the action.
          example: 10.209.59.205
        description:
          type: string
          example: Threat firewall monitoring activity policy rule configured.
    SortOrder_2:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: asc
    Filter_2:
      type: object
      description: A filter criterion for querying Xpanse resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: contains
        value:
          description: Filter value (string, integer, or array for "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    ErrorResponse_2:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 849
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 931
            err_msg: example-err_msg
            err_extra: example-err_extra
    AuditLog_3:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1744173019855
        actor_primary_username:
          type: string
          example: soc-analyst
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: User
        sub_type:
          type: string
          description: Action subtype (e.g., Login, PolicyUpdate, DatasourceCreate).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          example: Suspicious investigation alert traffic detected violation alert configured threat Security.
        ip:
          type: string
          example: 10.224.166.122
        description:
          type: string
          example: Violation firewall firewall detected incident endpoint policy.
    SortOrder_3:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: desc
    Filter_3:
      type: object
      description: A filter criterion for querying XSIAM resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: eq
        value:
          description: Filter value (string, integer, or array for the "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    ErrorResponse_3:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 140
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 33
            err_msg: example-err_msg
            err_extra: example-err_extra
  securitySchemes:
    xdrAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex XDR uses a custom HMAC-SHA256 authentication scheme. Each request requires four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of apikey + nonce + timestamp). Generate API keys from Cortex XDR Settings > Configurations > API Keys.'
    xpanseAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex Xpanse uses a custom HMAC-SHA256 authentication scheme with RBAC API key pairs. Include four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of api_key + nonce + timestamp). API keys are scoped with RBAC roles controlling which Xpanse data and operations are accessible. Generate keys from Xpanse Settings > Configurations > API Keys.'
    xsiamAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex XSIAM uses a custom HMAC-SHA256 authentication scheme. Include four headers on each request: x-xdr-auth-id (API key ID number), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds as a string), and x-xdr-hmac-v2 (SHA-256 hash of api_key + nonce + timestamp). Standard and Advanced API key types are supported; Advanced keys provide additional security through IP allowlisting. Generate API keys from XSIAM Settings > Configurations > API Keys.'
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cortex-xdr-api-openapi-original.yml
- palo-alto-cortex-xpanse-api-openapi-original.yml
- palo-alto-cortex-xsiam-api-openapi-original.yml
- palo-alto-networks-audit-api-openapi.yml