Palo Alto Networks Audit API

openapi: 3.2.0
info:
  title: Palo Alto Networks Audit API
  version: '1.0'
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  description: 'Operations tagged Audit across 4 of this provider''s published API definitions: palo-alto-cortex-xdr-api-openapi-original.yml, palo-alto-cortex-xpanse-api-openapi-original.yml, palo-alto-cortex-xsiam-api-openapi-original.yml, palo-alto-networks-audit-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api-{fqdn}/public_api/v1
  description: Cortex XDR tenant API endpoint.
  variables:
    fqdn:
      description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
      default: example.xdr.us.paloaltonetworks.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Audit
  description: Audit and management log retrieval.
paths:
  /audit/get_audit_management_logs:
    post:
      operationId: getAuditManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the Cortex XDR console. Includes user logins, policy changes, and configuration modifications.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetAuditManagementLogsRequestExample:
                summary: Default getAuditManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    - field: example-field
                      operator: lte
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Audit management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog'
              examples:
                GetAuditManagementLogs200Example:
                  summary: Default getAuditManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 974
                      result_count: 325
                      data:
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - xdrAuth: []
    servers:
    - url: https://api-{fqdn}/public_api/v1
      description: Cortex XDR tenant API endpoint.
      variables:
        fqdn:
          description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
          default: example.xdr.us.paloaltonetworks.com
  /audits/management_logs/get_management_logs:
    post:
      operationId: getManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the XSIAM console, including user logins, policy changes, data source configuration, and API key management.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter_3'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder_3'
            examples:
              GetManagementLogsRequestExample:
                summary: Default getManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: eq
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: desc
      responses:
        '200':
          description: Management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog_3'
              examples:
                GetManagementLogs200Example:
                  summary: Default getManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 883
                      result_count: 794
                      data:
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - xsiamAuth: []
    servers:
    - url: https://api-{fqdn}/public_api/v1
      description: Cortex XSIAM tenant API endpoint.
      variables:
        fqdn:
          description: Tenant FQDN from the XSIAM settings page (e.g., example.xsiam.paloaltonetworks.com).
          default: example.xsiam.paloaltonetworks.com
components:
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden_2:
      description: Insufficient RBAC permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse_2'
  schemas:
    AuditLog:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1725583298090
        actor_primary_username:
          type: string
          description: Username of the administrator who performed the action.
          example: jsmith
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: API
        sub_type:
          type: string
          description: Action subtype (e.g., Login, Logout, Policy Update).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          description: Failure reason if result is FAIL.
          example: Incident investigation threat Security malware applied detected.
        ip:
          type: string
          description: Source IP address of the action.
          example: 10.144.244.59
        description:
          type: string
          example: Firewall activity alert investigation alert on detected threat network.
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 782
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 270
            err_msg: example-err_msg
            err_extra: example-err_extra
    Filter:
      type: object
      description: A filter criterion for querying XDR resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on (e.g., incident_id, status, severity).
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          description: Comparison operator.
          example: lte
        value:
          description: Filter value. Use an array for the "in" operator, a string or integer for others.
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    SortOrder:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          description: Field to sort by.
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          description: Sort direction.
          example: asc
    AuditLog_2:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1729794840874
        actor_primary_username:
          type: string
          example: jsmith
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: User
        sub_type:
          type: string
          description: Action subtype (e.g., Login, IpRangeModified, RuleUpdated).
          example: advanced
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: SUCCESS
        reason:
          type: string
          example: Policy malware firewall violation applied blocked suspicious incident activity.
        ip:
          type: string
          description: Source IP address of the action.
          example: 10.209.59.205
        description:
          type: string
          example: Threat firewall monitoring activity policy rule configured.
    ErrorResponse_2:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 849
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 931
            err_msg: example-err_msg
            err_extra: example-err_extra
    Filter_2:
      type: object
      description: A filter criterion for querying Xpanse resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: contains
        value:
          description: Filter value (string, integer, or array for "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    SortOrder_2:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: asc
    AuditLog_3:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1744173019855
        actor_primary_username:
          type: string
          example: soc-analyst
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: User
        sub_type:
          type: string
          description: Action subtype (e.g., Login, PolicyUpdate, DatasourceCreate).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          example: Suspicious investigation alert traffic detected violation alert configured threat Security.
        ip:
          type: string
          example: 10.224.166.122
        description:
          type: string
          example: Violation firewall firewall detected incident endpoint policy.
    ErrorResponse_3:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 140
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 33
            err_msg: example-err_msg
            err_extra: example-err_extra
    Filter_3:
      type: object
      description: A filter criterion for querying XSIAM resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: eq
        value:
          description: Filter value (string, integer, or array for the "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    SortOrder_3:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: desc
  securitySchemes:
    xdrAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex XDR uses a custom HMAC-SHA256 authentication scheme. Each request requires four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of apikey + nonce + timestamp). Generate API keys from Cortex XDR Settings > Configurations > API Keys.'
    xpanseAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex Xpanse uses a custom HMAC-SHA256 authentication scheme with RBAC API key pairs. Include four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of api_key + nonce + timestamp). API keys are scoped with RBAC roles controlling which Xpanse data and operations are accessible. Generate keys from Xpanse Settings > Configurations > API Keys.'
    xsiamAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex XSIAM uses a custom HMAC-SHA256 authentication scheme. Include four headers on each request: x-xdr-auth-id (API key ID number), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds as a string), and x-xdr-hmac-v2 (SHA-256 hash of api_key + nonce + timestamp). Standard and Advanced API key types are supported; Advanced keys provide additional security through IP allowlisting. Generate API keys from XSIAM Settings > Configurations > API Keys.'
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cortex-xdr-api-openapi-original.yml
- palo-alto-cortex-xpanse-api-openapi-original.yml
- palo-alto-cortex-xsiam-api-openapi-original.yml
- palo-alto-networks-audit-api-openapi.yml