Palo Alto Networks Defenders API
{'$ref': 'desc/defenders/defenders.md'}
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-defenders-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Defenders API
version: '1.0'
description: 'Operations tagged Defenders across 4 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
tags:
- name: Defenders
description: Defenders. 21 operations in this definition.
x-description-source: desc/defenders/defenders.md
paths:
/api/v34.03/defenders:
get:
description: 'Get Deployed Defenders. GET /api/v34.03/defenders on the Defenders API. Takes 18 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Hostname is a name of a specific Defender to retrieve.
'
in: query
name: hostname
schema:
type: string
- description: 'Roles are the defender api.Roles to filter.
'
in: query
name: role
schema:
description: 'Roles are the defender api.Roles to filter.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return only connected Defenders (true) or disconnected Defenders (false).
'
in: query
name: connected
schema:
type: boolean
- description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
in: query
name: type
schema:
description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true)
or defenders with older versions (false).
'
in: query
name: latest
schema:
type: boolean
- description: 'SupportedVersion indicates only Defenders of supported versions should be fetched.
'
in: query
name: supportedVersion
schema:
type: boolean
- description: 'Scopes the query by cluster name.
'
in: query
name: cluster
schema:
description: 'Scopes the query by cluster name.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS cluster IDs.
'
in: query
name: tasClusterIDs
schema:
description: 'Scopes the query by TAS cluster IDs.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false).
'
in: query
name: tasBlobstoreScanner
schema:
type: boolean
- description: 'Scopes the query by TAS foundations.
'
in: query
name: tasFoundations
schema:
description: 'Scopes the query by TAS foundations.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query to defenders which are using old certificate.
'
in: query
name: usingOldCA
schema:
type: boolean
- description: 'Scopes the query to defenders which are using expired certificate.
'
in: query
name: usingExpiredCA
schema:
type: boolean
- description: 'Scopes the query by provider type
Indicates whether to return only defenders running on ARM64 architecture.
'
in: query
name: isARM64
schema:
type: boolean
- description: 'Indicates whether to return only defenders running as VPC Observer.
'
in: query
name: isVPCObserver
schema:
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_defender.Defender'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: get-defenders
summary: Get Deployed Defenders
x-description-source: desc/defenders/get.md
/api/v34.03/defenders/aci.yaml:
post:
description: 'ACIContainerGroupYAML receives ACI Container group definition in YAML format, augments the yaml to include defenders, and return a new YAML
'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_uint8'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-aci.yaml
summary: ' A CI Container Group Y A M L'
/api/v34.03/defenders/app-embedded:
post:
description: 'Generate a Docker File for App-embedded Defender. POST /api/v34.03/defenders/app-embedded on the Defenders API. Takes an optional request body. Documented responses: 200.'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/shared.AppEmbeddedEmbedRequest'
responses:
'200':
description: OK
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-app-embedded
summary: Generate a Docker File for App-embedded Defender
x-description-source: desc/defenders/app_embedded_post.md
/api/v34.03/defenders/cloud-run.yaml:
post:
description: 'CloudRunServiceYAML receives Cloud run Service in YAML format, augments the yaml to include defenders, and return a new YAML
'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_uint8'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-cloud-run.yaml
summary: ' Cloud Run Service Y A M L'
/api/v34.03/defenders/daemonset.yaml:
post:
description: 'Generate Daemonset Deployment YAML File. POST /api/v34.03/defenders/daemonset.yaml on the Defenders API. Takes an optional request body. Documented responses: 200.'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/common.DaemonSetOptions'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_uint8'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-daemonset.yaml
summary: Generate Daemonset Deployment YAML File
x-description-source: desc/defenders/daemonset_yaml_post.md
/api/v34.03/defenders/download:
get:
description: 'Download Deployed Defenders. GET /api/v34.03/defenders/download on the Defenders API. Takes 18 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Hostname is a name of a specific Defender to retrieve.
'
in: query
name: hostname
schema:
type: string
- description: 'Roles are the defender api.Roles to filter.
'
in: query
name: role
schema:
description: 'Roles are the defender api.Roles to filter.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return only connected Defenders (true) or disconnected Defenders (false).
'
in: query
name: connected
schema:
type: boolean
- description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
in: query
name: type
schema:
description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true)
or defenders with older versions (false).
'
in: query
name: latest
schema:
type: boolean
- description: 'SupportedVersion indicates only Defenders of supported versions should be fetched.
'
in: query
name: supportedVersion
schema:
type: boolean
- description: 'Scopes the query by cluster name.
'
in: query
name: cluster
schema:
description: 'Scopes the query by cluster name.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS cluster IDs.
'
in: query
name: tasClusterIDs
schema:
description: 'Scopes the query by TAS cluster IDs.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false).
'
in: query
name: tasBlobstoreScanner
schema:
type: boolean
- description: 'Scopes the query by TAS foundations.
'
in: query
name: tasFoundations
schema:
description: 'Scopes the query by TAS foundations.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query to defenders which are using old certificate.
'
in: query
name: usingOldCA
schema:
type: boolean
- description: 'Scopes the query to defenders which are using expired certificate.
'
in: query
name: usingExpiredCA
schema:
type: boolean
- description: 'Scopes the query by provider type
Indicates whether to return only defenders running on ARM64 architecture.
'
in: query
name: isARM64
schema:
type: boolean
- description: 'Indicates whether to return only defenders running as VPC Observer.
'
in: query
name: isVPCObserver
schema:
type: boolean
responses:
'200':
description: OK
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: get-defenders-download
summary: Download Deployed Defenders
x-description-source: desc/defenders/download_get.md
/api/v34.03/defenders/eks-fargate.yaml:
post:
description: 'GenerateK8sControllerManifest receives a Kubernetes controller definition in YAML format,
augments the YAML to include defenders, and returns a new YAML.
'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_uint8'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-eks-fargate.yaml
summary: ' Generate K8s Controller Manifest'
/api/v34.03/defenders/fargate.json:
post:
description: 'Generate a Protected JSON Fargate Task Definition. POST /api/v34.03/defenders/fargate.json on the Defenders API. Takes 10 query parameters, an optional request body. Documented responses: 200.'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'DefenderType is the type of the defender to create the install bundle for.
'
in: query
name: defenderType
schema:
description: Type is the type to be given at startup
enum:
- - none
- docker
- dockerWindows
- containerdWindows
- swarm
- daemonset
- serverLinux
- serverWindows
- cri
- fargate
- appEmbedded
- tas
- tasWindows
- serverless
- ecs
- podman
- eksFargate
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the fargate defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'CloudFormation indicates if the given fargate task definition is in Cloud Formation format.
'
in: query
name: cloudFormation
schema:
type: boolean
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'ExtractEntrypoint indicates if entrypoint will be extracted automatically.
'
in: query
name: extractEntrypoint
schema:
type: boolean
- description: 'RegistryType is the registry type for fetching image details needed to create fargate task definition (e.g., dockerhub).
'
in: query
name: registryType
schema:
type: string
- description: 'RegistryCredentialID of the credentials in the credentials store to use for authenticating with the registry.
'
in: query
name: registryCredentialID
schema:
type: string
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
- description: 'DefenderImagePullSecret is the name of the secret required to pull the Defender image from private registry.
'
in: query
name: defenderImagePullSecret
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/appembedded.FargateTask'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/appembedded.FargateTask'
description: FargateTask represents the generic fargate task AWS template
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-fargate.json
summary: Generate a Protected JSON Fargate Task Definition
x-description-source: desc/defenders/fargate_json_post.md
/api/v34.03/defenders/fargate.yaml:
post:
description: 'Generate a Protected YAML Fargate Task Definition. POST /api/v34.03/defenders/fargate.yaml on the Defenders API. Takes 10 query parameters. Documented responses: 200.'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'DefenderType is the type of the defender to create the install bundle for.
'
in: query
name: defenderType
schema:
description: Type is the type to be given at startup
enum:
- - none
- docker
- dockerWindows
- containerdWindows
- swarm
- daemonset
- serverLinux
- serverWindows
- cri
- fargate
- appEmbedded
- tas
- tasWindows
- serverless
- ecs
- podman
- eksFargate
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the fargate defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'CloudFormation indicates if the given fargate task definition is in Cloud Formation format.
'
in: query
name: cloudFormation
schema:
type: boolean
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'ExtractEntrypoint indicates if entrypoint will be extracted automatically.
'
in: query
name: extractEntrypoint
schema:
type: boolean
- description: 'RegistryType is the registry type for fetching image details needed to create fargate task definition (e.g., dockerhub).
'
in: query
name: registryType
schema:
type: string
- description: 'RegistryCredentialID of the credentials in the credentials store to use for authenticating with the registry.
'
in: query
name: registryCredentialID
schema:
type: string
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
- description: 'DefenderImagePullSecret is the name of the secret required to pull the Defender image from private registry.
'
in: query
name: defenderImagePullSecret
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_uint8'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-fargate.yaml
summary: Generate a Protected YAML Fargate Task Definition
x-description-source: desc/defenders/fargate_yaml_post.md
/api/v34.03/defenders/helm/twistlock-defender-helm.tar.gz:
post:
description: 'Generate a Helm Deployment Chart for Defender. POST /api/v34.03/defenders/helm/twistlock-defender-helm.tar.gz on the Defenders API. Takes an optional request body. Documented responses: 200.'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/common.DaemonSetOptions'
responses:
'200':
description: OK
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: post-defenders-helm-twistlock-defender-helm.tar.gz
summary: Generate a Helm Deployment Chart for Defender
x-description-source: desc/defenders/helm_post.md
/api/v34.03/defenders/image-name:
get:
description: 'Get Docker Image Name for Defender. GET /api/v34.03/defenders/image-name on the Defenders API. Documented responses: 200.'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/string'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: get-defenders-image-name
summary: Get Docker Image Name for Defender
x-description-source: desc/defenders/image-name_get.md
/api/v34.03/defenders/install-bundle:
get:
description: 'Get Certificate Bundle for Defender. GET /api/v34.03/defenders/install-bundle on the Defenders API. Takes 10 query parameters. Documented responses: 200.'
parameters:
- description: 'ConsoleAddr is the remote console address.
'
in: query
name: consoleaddr
schema:
type: string
- description: 'DefenderType is the type of the defender to create the install bundle for.
'
in: query
name: defenderType
schema:
description: Type is the type to be given at startup
enum:
- - none
- docker
- dockerWindows
- containerdWindows
- swarm
- daemonset
- serverLinux
- serverWindows
- cri
- fargate
- appEmbedded
- tas
- tasWindows
- serverless
- ecs
- podman
- eksFargate
type: string
- description: 'Interpreter is a custom interpreter set by the user to run the fargate defender entrypoint script.
'
in: query
name: interpreter
schema:
type: string
- description: 'CloudFormation indicates if the given fargate task definition is in Cloud Formation format.
'
in: query
name: cloudFormation
schema:
type: boolean
- description: 'FilesystemMonitoring is the filesystem monitoring flag.
'
in: query
name: filesystemMonitoring
schema:
type: boolean
- description: 'ExtractEntrypoint indicates if entrypoint will be extracted automatically.
'
in: query
name: extractEntrypoint
schema:
type: boolean
- description: 'RegistryType is the registry type for fetching image details needed to create fargate task definition (e.g., dockerhub).
'
in: query
name: registryType
schema:
type: string
- description: 'RegistryCredentialID of the credentials in the credentials store to use for authenticating with the registry.
'
in: query
name: registryCredentialID
schema:
type: string
- description: 'DefenderImage is the full path to the Defender image, if not specified Prisma''s private registry is used.
'
in: query
name: defenderImage
schema:
type: string
- description: 'DefenderImagePullSecret is the name of the secret required to pull the Defender image from private registry.
'
in: query
name: defenderImagePullSecret
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/shared.DefenderInstallBundle'
description: DefenderInstallBundle represents the install bundle for the defender
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: get-defenders-install-bundle
summary: Get Certificate Bundle for Defender
x-description-source: desc/defenders/install-bundle_get.md
/api/v34.03/defenders/names:
get:
description: 'Get Defender Names. GET /api/v34.03/defenders/names on the Defenders API. Takes 18 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Hostname is a name of a specific Defender to retrieve.
'
in: query
name: hostname
schema:
type: string
- description: 'Roles are the defender api.Roles to filter.
'
in: query
name: role
schema:
description: 'Roles are the defender api.Roles to filter.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return only connected Defenders (true) or disconnected Defenders (false).
'
in: query
name: connected
schema:
type: boolean
- description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
in: query
name: type
schema:
description: 'Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true)
or defenders with older versions (false).
'
in: query
name: latest
schema:
type: boolean
- description: 'SupportedVersion indicates only Defenders of supported versions should be fetched.
'
in: query
name: supportedVersion
schema:
type: boolean
- description: 'Scopes the query by cluster name.
'
in: query
name: cluster
schema:
description: 'Scopes the query by cluster name.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS cluster IDs.
'
in: query
name: tasClusterIDs
schema:
description: 'Scopes the query by TAS cluster IDs.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false).
'
in: query
name: tasBlobstoreScanner
schema:
type: boolean
- description: 'Scopes the query by TAS foundations.
'
in: query
name: tasFoundations
schema:
description: 'Scopes the query by TAS foundations.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Scopes the query to defenders which are using old certificate.
'
in: query
name: usingOldCA
schema:
type: boolean
- description: 'Scopes the query to defenders which are using expired certificate.
'
in: query
name: usingExpiredCA
schema:
type: boolean
- description: 'Scopes the query by provider type
Indicates whether to return only defenders running on ARM64 architecture.
'
in: query
name: isARM64
schema:
type: boolean
- description: 'Indicates whether to return only defenders running as VPC Observer.
'
in: query
name: isVPCObserver
schema:
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_string'
description: ''
default:
description: ''
tags:
- Defenders
x-prisma-cloud-target-env:
permission: manageDefenders
operationId: get-defenders-names
summary: Get Defender Names
x-description-source: desc/defenders/names_get.md
/api/v34.03/defenders/serverless/bundle:
post:
description: 'Generate Serverless Bundle for Defender. POST /api/v34.03/defenders/serverless/bundle on the Defenders API. Takes an optional request body. Documented responses: 200.'
requestBody:
# --- truncated at 32 KB (118 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-defenders-api-openapi.yml