Palo Alto Networks

Palo Alto Networks Checks API

Operations for managing custom posture checks including CRUD and batch operations.

GitHub OpenAPI

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /checks/v1 List posture checks · List Checks #
Ask an LLM
“Which posture checks, custom and predefined, are available to me?”
“Can I filter posture checks by severity or by the object type they inspect, like security rules?”
Tell an agent
List all {type} posture checks.
Show posture checks with severity {severity} for object type {object_type}.
POST /checks/v1 Create a custom posture check · Create Posture Check #
Ask an LLM
“How do I write my own posture check against security rules?”
“Does creating a custom posture check need an SCM Pro license?”
Tell an agent
Create custom posture check {name} on {object_type} with severity {severity} and rule {data}.
Add a new posture check {name} for {object_type}, severity {severity}, rule {data}, rationale {rationale}.
GET /checks/v1/{id} Get a posture check · Get Posture Check #
Ask an LLM
“What rule expression and rationale does a specific posture check use?”
“Can I look up a predefined posture check by its ID?”
Tell an agent
Get posture check {id}.
Show the rule definition and severity of posture check {id}.
PUT /checks/v1/{id} Update a custom posture check · Update Posture Check #
Ask an LLM
“Can I change the severity of one of my custom posture checks?”
“How do I edit the rule expression of an existing custom check?”
Tell an agent
Update posture check {id} ({name}, {object_type}) to severity {severity} with rule {data}.
Rewrite the rule of custom check {id} to {data}, keeping name {name}, type {object_type}, severity {severity}.
DELETE /checks/v1/{id} Delete a custom posture check · Delete Posture Check #
Ask an LLM
“How do I delete a single custom posture check?”
“Can predefined checks be deleted, or only custom ones?”
Tell an agent destructive · confirm first
Delete custom posture check {id}.
Remove posture check {id} from my custom checks.
POST /checks/v1/{id}:clone Clone a posture check · Clone Posture Check #
Ask an LLM
“Can I copy a predefined posture check and customize the copy?”
“How do I duplicate a posture check under a new name?”
Tell an agent
Clone posture check {id}.
Make a copy of posture check {id} named {name}.
POST /checks/v1/batch-upsert Create or update many posture checks at once · Batch Upsert Checks #
Ask an LLM
“Is there a way to create and update many posture checks in a single request?”
“How does a batch upsert decide whether a posture check is new or updated?”
Tell an agent
Batch upsert these posture checks: {checks}.
Create or update the posture checks {checks} in one call.
POST /checks/v1/batch-delete Delete many posture checks at once · Batch Delete Checks #
Ask an LLM
“Can I delete several custom posture checks in one request?”
“What's the bulk way to remove a list of posture check IDs?”
Tell an agent destructive · confirm first
Batch delete posture checks {ids}.
Remove all of these posture check IDs at once: {ids}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-checks-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-checks-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-checks-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Posture Management Checks API
  description: 'This API provides comprehensive posture management capabilities including:

    - Custom posture check management (create, update, delete, clone, batch operations)

    - Config file upload for BPA (Best Practice Assessment) results

    - Config cleanup for identifying unused or redundant configuration objects

    - Compliance framework definition management (create, update, delete, release)

    - Compliance analytics and reporting

    - Benchmark monitoring and BPC (Best Practice Check) verdict tracking'
  version: 1.1.0
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/posture
  description: Current
security:
- BearerAuth: []
tags:
- name: Checks
  description: Operations for managing custom posture checks including CRUD and batch operations.
paths:
  /checks/v1:
    get:
      tags:
      - Checks
      summary: List Checks
      description: Returns a paginated list of posture checks (both custom and predefined).
      operationId: ListPostureChecks
      parameters:
      - in: query
        name: type
        schema:
          type: string
          enum:
          - custom
          - predefined
        description: Filter by check type.
      - in: query
        name: object_type
        schema:
          type: string
        description: Filter by configuration object type (e.g., "security_rule", "address").
      - in: query
        name: severity
        schema:
          type: string
          enum:
          - Critical
          - High
          - Warning
          - Informational
        description: Filter by severity level.
      - in: query
        name: management_type
        schema:
          type: string
          enum:
          - cloud
          - panorama
        description: Filter by management platform.
      - in: query
        name: limit
        schema:
          type: integer
          minimum: 1
          maximum: 200
          default: 100
        description: Maximum number of results to return.
      - in: query
        name: offset
        schema:
          type: integer
          minimum: 0
          default: 0
        description: Number of results to skip for pagination.
      responses:
        '200':
          description: List of posture checks.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheckListResponse'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
      - Checks
      summary: Create Posture Check
      description: Creates a new custom posture check. Requires SCM Pro license.
      operationId: CreatePostureCheck
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureCheckCreateRequest'
      responses:
        '201':
          description: Posture check created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
        '400':
          description: Bad request - validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /checks/v1/{id}:
    get:
      tags:
      - Checks
      summary: Get Posture Check
      description: Returns a specific posture check by ID.
      operationId: GetPostureCheckByID
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The posture check ID.
      responses:
        '200':
          description: Posture check details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
      - Checks
      summary: Update Posture Check
      description: Updates an existing custom posture check. Requires SCM Pro license.
      operationId: UpdatePostureCheckByID
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The posture check ID.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureCheckUpdateRequest'
      responses:
        '200':
          description: Posture check updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
        '400':
          description: Bad request - validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
      - Checks
      summary: Delete Posture Check
      description: Deletes a custom posture check. Requires SCM Pro license.
      operationId: DeletePostureCheckByID
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The posture check ID.
      responses:
        '204':
          description: Posture check deleted successfully.
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /checks/v1/{id}:clone:
    post:
      tags:
      - Checks
      summary: Clone Posture Check
      description: Creates a copy of an existing posture check with a new ID. Requires SCM Pro license.
      operationId: ClonePostureCheckByID
      parameters:
      - in: path
        name: id
        schema:
          type: string
        required: true
        description: The posture check ID to clone.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureCheckCloneRequest'
      responses:
        '201':
          description: Posture check cloned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
        '400':
          description: Bad request - validation error (e.g., duplicate name).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /checks/v1/batch-upsert:
    post:
      tags:
      - Checks
      summary: Batch Upsert Checks
      description: Creates or updates multiple posture checks in a single call. Objects with an existing ID will be updated, new objects will be created. Requires SCM Pro license.
      operationId: BatchUpsertPostureChecks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureCheckBatchUpsertRequest'
      responses:
        '200':
          description: Batch upsert completed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheckBatchUpsertResponse'
        '400':
          description: Bad request - validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /checks/v1/batch-delete:
    post:
      tags:
      - Checks
      summary: Batch Delete Checks
      description: Deletes multiple posture checks in a single call. Requires SCM Pro license.
      operationId: BatchDeletePostureChecks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureCheckBatchDeleteRequest'
      responses:
        '200':
          description: Batch delete completed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheckBatchDeleteResponse'
        '400':
          description: Bad request - validation error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden - SCM Pro license required.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    PostureCheckBatchUpsertRequest:
      type: object
      required:
      - checks
      properties:
        checks:
          type: array
          items:
            $ref: '#/components/schemas/PostureCheckUpsertItem'
          minItems: 1
          maxItems: 100
          description: Array of posture checks to create or update.
    PostureCheckUpsertItem:
      type: object
      required:
      - name
      - object_type
      - data
      - severity
      properties:
        id:
          type: string
          description: If provided, the check will be updated.
        name:
          type: string
        description:
          type: string
        rationale:
          type: string
        object_type:
          type: string
        sub_type:
          type: string
        severity:
          type: string
          enum:
          - Critical
          - High
          - Warning
          - Informational
        management_type:
          type: string
          enum:
          - cloud
          - panorama
          default: cloud
        action:
          type: string
          enum:
          - alert
          - failCommit
          default: alert
        data:
          type: object
          additionalProperties: true
        fields_affected:
          type: array
          items:
            type: string
        sub_feature:
          type: object
          additionalProperties: true
    PostureCheckListResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/PostureCheck'
        total:
          type: integer
          description: Total number of posture checks matching the query.
        limit:
          type: integer
          description: Maximum number of results returned.
        offset:
          type: integer
          description: Number of results skipped.
    PostureCheck:
      type: object
      required:
      - id
      - name
      - object_type
      - type
      - severity
      properties:
        id:
          type: string
          description: Unique identifier for the posture check.
        name:
          type: string
          description: Human-readable name of the posture check.
        description:
          type: string
          description: Detailed description of what the check validates.
        rationale:
          type: string
          description: Explanation of why this check is important.
        object_type:
          type: string
          description: The configuration object type this check applies to.
        type:
          type: string
          enum:
          - custom
          - predefined
          description: Whether this is a custom or predefined check.
        severity:
          type: string
          enum:
          - Critical
          - High
          - Warning
          - Informational
          description: Severity level of the check.
        management_type:
          type: string
          enum:
          - cloud
          - panorama
          description: Management platform this check applies to.
        sub_type:
          type: string
          description: Sub-category of the check.
        action:
          type: string
          enum:
          - alert
          - failCommit
          description: Action to take when check fails.
        data:
          type: object
          additionalProperties: true
          description: Check rule definition/expression (custom checks only).
        fields_affected:
          type: array
          items:
            type: string
          description: List of config fields this check evaluates.
        recommendation:
          type: string
          description: Recommended action for this check.
        impact:
          type: string
          description: Impact description if the check fails.
        created_at:
          type: string
          format: date-time
          description: Timestamp when the check was created.
        updated_at:
          type: string
          format: date-time
          description: Timestamp when the check was last updated.
    PostureCheckCloneRequest:
      type: object
      properties:
        name:
          type: string
          description: Optional new name for the cloned check.
          maxLength: 256
    PostureCheckUpdateRequest:
      type: object
      required:
      - name
      - object_type
      - data
      - severity
      properties:
        name:
          type: string
        description:
          type: string
        rationale:
          type: string
        object_type:
          type: string
        sub_type:
          type: string
        severity:
          type: string
          enum:
          - Critical
          - High
          - Warning
          - Informational
        management_type:
          type: string
          enum:
          - cloud
          - panorama
        action:
          type: string
          enum:
          - alert
          - failCommit
        data:
          type: object
          additionalProperties: true
        sub_feature:
          type: object
          additionalProperties: true
    PostureCheckBatchDeleteRequest:
      type: object
      required:
      - ids
      properties:
        ids:
          type: array
          items:
            type: string
          minItems: 1
          maxItems: 100
          description: Array of posture check IDs to delete.
    Error:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                description: The error code representing a specific error condition.
              message:
                type: string
                description: A brief description of the error condition.
              details:
                type: array
                items:
                  type: string
                description: An explanation of the error condition.
              help:
                type: string
                format: uri
                description: A URL link to documentation describing the error condition.
        _request_id:
          type: string
          format: uuid
          description: The request ID for troubleshooting purposes.
    PostureCheckBatchDeleteResponse:
      type: object
      properties:
        deleted:
          type: array
          items:
            type: string
          description: List of successfully deleted posture check IDs.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/BatchOperationError'
          description: List of errors for checks that failed to delete.
    PostureCheckBatchUpsertResponse:
      type: object
      properties:
        created:
          type: array
          items:
            $ref: '#/components/schemas/PostureCheck'
          description: List of newly created posture checks.
        updated:
          type: array
          items:
            $ref: '#/components/schemas/PostureCheck'
          description: List of updated posture checks.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/BatchOperationError'
          description: List of errors for checks that failed.
    BatchOperationError:
      type: object
      properties:
        id:
          type: string
          description: The ID or index of the item that failed.
        message:
          type: string
          description: Error message describing why the operation failed.
    PostureCheckCreateRequest:
      type: object
      required:
      - name
      - object_type
      - data
      - severity
      properties:
        name:
          type: string
          description: Human-readable name of the posture check.
        description:
          type: string
        rationale:
          type: string
        object_type:
          type: string
          description: The configuration object type this check applies to.
        sub_type:
          type: string
          description: Sub-category of the check.
        severity:
          type: string
          enum:
          - Critical
          - High
          - Warning
          - Informational
        management_type:
          type: string
          enum:
          - cloud
          - panorama
          default: cloud
        action:
          type: string
          enum:
          - alert
          - failCommit
          default: alert
        data:
          type: object
          additionalProperties: true
          description: Check rule definition/expression.
        sub_feature:
          type: object
          additionalProperties: true
          description: Sub-feature configuration for rule-specific checks.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token authentication using JWT.