Palo Alto Networks

Palo Alto Networks Audit Logs API

As part of compliance requirement for organizations, companies need to demonstrate they are pro-actively tracking security issues and taking steps to remediate issues as they occur. Prisma Cloud Audit Logs section enables companies to prepare for such audits and demonstrates compliance.

GitHub OpenAPI

Operations 3

GET /audit/redlock Prisma Cloud Audit Logs #
POST /audit/api/v1/log Get Audit Logs #
POST /audit/api/v1/filter/suggest Get Filter Suggestions #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-audit-logs-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks-audit-logs-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-audit-logs-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Audit Logs API
  version: '1.0'
  description: 'Operations tagged Audit Logs across 3 of this provider''s published API definitions: palo-alto-cspm-auditlogs-openapi.json, palo-alto-cspm-auditlogsmicroservice-openapi.json, palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: "As part of compliance requirement for organizations, companies need to demonstrate they are pro-actively \ntracking security issues and taking steps to remediate issues as they occur. Prisma Cloud Audit Logs \nsection enables companies to prepare for such audits and demonstrates compliance.\n"
  name: Audit Logs
paths:
  /audit/redlock:
    get:
      description: Returns audit logs for events that took place on the Prisma Cloud platform.
      operationId: rl-audit-logs
      x-public: 'true'
      parameters:
      - description: Time Type
        in: query
        name: timeType
        required: false
        schema:
          enum:
          - relative
          type: string
      - description: Time Amount
        in: query
        name: timeAmount
        required: false
        schema:
          format: int32
          type: integer
      - description: Time Unit
        in: query
        name: timeUnit
        required: false
        schema:
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/RedLockAuditLogBeanModel'
                type: array
          description: successful operation
        '400':
          description: bad_request
        '413':
          description: too_many_matching_results_reduce_time_range
      security:
      - x-redlock-auth: []
      summary: Prisma Cloud Audit Logs
      tags:
      - Audit Logs
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /audit/api/v1/log:
    post:
      tags:
      - Audit Logs
      summary: Get Audit Logs
      description: "Retrieves paginated audit logs based on the provided filter criteria.\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 10/sec \n* Burst limit: 10/sec \n"
      operationId: getAuditLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogFilterRequest'
        required: true
      responses:
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '200':
          description: Successful Operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogViewResponse'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
      security:
      - x-redlock-auth: []
      x-migrated-v3: 'true'
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /audit/api/v1/filter/suggest:
    post:
      tags:
      - Audit Logs
      summary: Get Filter Suggestions
      description: "Get UI Filter Suggestions for Resource Types and User\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 10/sec \n* Burst limit: 10/sec \n"
      operationId: getResourceTypes
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogFilterSuggestRequest'
        required: true
      responses:
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '200':
          description: Successful Operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogFilterSuggestion'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    RedLockAuditLogBeanModel:
      description: Model for RedLockAuditLogBean
      properties:
        action:
          type: string
        actionType:
          description: Action Type
          type: string
        ipAddress:
          description: IP Address
          type: string
        resourceName:
          type: string
        resourceType:
          type: string
        result:
          type: string
        timestamp:
          description: Timestamp
          format: int64
          type: integer
        user:
          description: User
          type: string
      type: object
    AuditLogFilterSuggestion:
      title: Audit Log Filter Suggestion
      type: object
      properties:
        suggestions:
          uniqueItems: true
          type: array
          description: List of Suggestions
          items:
            type: string
            description: List of Suggestions
        queryRemainder:
          type: string
          description: Query Remainder
    AbsoluteTimeRangeValue:
      required:
      - startTime
      type: object
      properties:
        startTime:
          type: integer
          description: Start Time for 'absolute' Time Range
          format: int64
        endTime:
          type: integer
          description: End Time for 'absolute' Time Range
          format: int64
      description: Object holds 'startTime' and 'endTime' for 'absolute' Time Range
    AuditLogGetViewModel:
      type: object
      properties:
        timestamp:
          type: integer
          description: The time stamp of the log entry
          format: int64
          example: 1623733133000
        action:
          type: string
          example: User foo@boo.com logged in via password
        ipAddress:
          type: string
          description: The IP address of associated with the performed the action
          example: 127.0.0.1
        actionType:
          type: string
          description: Represents the type of action performed on a resource by a given user or system
          example: LOGIN
          enum:
          - CREATE
          - READ
          - UPDATE
          - DELETE
          - LOGIN
        resourceName:
          type: string
          description: The name of the resource associated with the action
          example: foo@boo.com
        resourceType:
          type: string
          description: The type of the resource associated with the action
          example: Login
        result:
          type: string
          description: The result of the action performed
          example: Success
        user:
          type: string
          description: The user associated with the action
          example: foo@boo.com
      description: The list of audit logs that match the request
    TimeRange:
      required:
      - type
      - value
      type: object
      properties:
        type:
          type: string
          description: Time Type
          enum:
          - relative
          - absolute
          - to_now
        value:
          type: object
          description: Time Range Value
          oneOf:
          - $ref: '#/components/schemas/RelativeTimeRangeValue'
          - $ref: '#/components/schemas/AbsoluteTimeRangeValue'
          - title: ToNowTimeRangeValue
            type: string
            description: Represents a 'to_now' time type value.
            enum:
            - login
      description: The time range for the audit log filter
      discriminator:
        propertyName: type
    RelativeTimeRangeValue:
      required:
      - amount
      - unit
      type: object
      properties:
        amount:
          type: integer
          description: Time Amount for 'relative' Time Range
          format: int32
        unit:
          type: string
          description: Time Unit for 'relative' Time Range. 'login' not supported here
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
      description: Object holds 'amount' and 'unit' for 'relative' Time Range
    AuditLogViewResponse:
      type: object
      properties:
        value:
          type: array
          description: The list of audit logs that match the request
          items:
            $ref: '#/components/schemas/AuditLogGetViewModel'
        nextPageToken:
          type: string
          description: The token to use to retrieve the next page of results
    AuditLogFilterRequest:
      title: Audit Log Filter Request
      required:
      - timeRange
      type: object
      properties:
        timeRange:
          $ref: '#/components/schemas/TimeRange'
        filters:
          type: array
          description: List of audit log filters
          items:
            $ref: '#/components/schemas/AuditLogFilter'
        limit:
          type: integer
          description: 'The maximum number of results to return per page. Valid Range: [100, 500]'
          format: int32
          default: 500
        nextPageToken:
          type: string
          description: The optional token to retrieve the next page of results
    AuditLogFilter:
      type: object
      properties:
        name:
          type: string
        value:
          type: string
      description: List of audit log filters
    AuditLogFilterSuggestRequest:
      title: Audit Log Filter Suggest Request
      required:
      - filterName
      type: object
      properties:
        filterName:
          type: string
          description: The name of the filter
          example: resourceType
        query:
          type: string
          description: Case-insensitive query to suggest filter values.  Includes only items that contain the query as a substring.
          example: Login
    V2ApiErrorResponse:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
      description: Represents the error encountered while processing the request
    Error:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          description: 'Error Codes: BadRequest(400), Unauthorized(401), Forbidden(403), TooManyRequests(429).'
        message:
          type: string
          description: A human-readable representation of the error.
        target:
          type: string
          description: The target of the error
        details:
          type: array
          description: An array of details about specific errors that led to this reported error
          items:
            $ref: '#/components/schemas/Error'
      description: The actual error object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-auditlogs-openapi.json
- palo-alto-cspm-auditlogsmicroservice-openapi.json
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json