Palo Alto Networks

Palo Alto Networks DLP API

DLP API

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /v1/public/report/{reportId} Get a DLP scan report · Get Reports #
Ask an LLM
“Can I retrieve an Enterprise DLP report by its ID?”
“Can I include the matched-data snippets when fetching a DLP report?”
Tell an agent
Get DLP report {reportId}.
Get DLP report {reportId} with snippets set to {fetchSnippets}.
PUT /v1/api/incidents/{incidentID}/assignee Assign an Enterprise DLP incident · Assign Incidents #
Ask an LLM
“How do I assign a DLP incident to an analyst?”
“Does assigning an incident need its region if it is outside the US?”
Tell an agent
Assign DLP incident {incidentID}.
Set the assignee on incident {incidentID} in region {region}.
PUT /v1/api/incidents/{incidentID}/notes Update notes on a DLP incident · Update Inicident Note #
Ask an LLM
“Can I write investigation notes on an Enterprise DLP incident?”
“Can I edit the note attached to a DLP incident?”
Tell an agent
Update the notes on DLP incident {incidentID}.
Save a note to incident {incidentID} in region {region}.
DELETE /v1/api/incidents/{incidentID}/notes Remove notes from a DLP incident · Remove Incident Notes #
Ask an LLM
“Is there a way to clear the notes on a DLP incident?”
“Can I remove incident notes for an incident outside the default US region?”
Tell an agent destructive · confirm first
Remove the notes from DLP incident {incidentID}.
Delete incident {incidentID} notes in region {region}.
PUT /v1/api/incidents/{incidentID}/resolution-status Set a DLP incident's resolution · Update Incident Resolution #
Ask an LLM
“How do I mark an Enterprise DLP incident as resolved?”
“Can I change the resolution status of an incident in another region?”
Tell an agent
Update the resolution status of DLP incident {incidentID}.
Resolve incident {incidentID} in region {region}.
GET /v1/api/incidents/assignee List DLP incident assignees · Get All Assignees #
Ask an LLM
“Who can DLP incidents be assigned to?”
“Which assignees are set up for Enterprise DLP?”
Tell an agent
List all DLP incident assignees.
Show everyone available to take DLP incidents.
PUT /v1/api/incidents/assignee Add or update a DLP incident assignee · Create or Update Incident Assignee #
Ask an LLM
“How do I add a new person who can be assigned DLP incidents?”
“Can I deactivate an existing DLP assignee?”
Tell an agent
Add assignee {firstName} {lastName} with email {emailAddress} and status {status}.
Set assignee {id} ({emailAddress}, {firstName} {lastName}) to status {status}.
GET /v1/api/incidents/assignee/{assigneeId} Get a DLP incident assignee · Get Assignee by ID #
Ask an LLM
“Where can I look up one DLP assignee's details?”
“Is a specific DLP assignee still active?”
Tell an agent
Get DLP assignee {assigneeId}.
Show whether assignee {assigneeId} is active.
GET /v2/api/incidents/{incidentID} Get an Enterprise DLP incident · Get Incident Details #
Ask an LLM
“What are the full details of one Enterprise DLP incident?”
“How do I read a DLP incident stored in a non-US region?”
Tell an agent
Get Enterprise DLP incident {incidentID}.
Show DLP incident {incidentID} from region {region}.
GET /v2/api/incidents List Enterprise DLP incidents · Get Incidents #
Ask an LLM
“Which DLP incidents came from the firewall channel versus Prisma Access?”
“Can I find every DLP incident triggered by a particular file hash?”
Tell an agent
List Enterprise DLP incidents from channel {channel} since {start_time}.
Find DLP incidents triggered by file hashes {file_shas}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-dlp-api-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-dlp-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-dlp-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: public dlp DLP API
  version: 1.0.0
  description: DLP Public API
  license:
    name: MIT
    url: https://opensource.org/license/mit
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
servers:
- url: https://api.dlp.paloaltonetworks.com
  description: Prod host
security:
- JWTAuth: []
tags:


# --- truncated at 32 KB (42 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-dlp-api-api-openapi.yml