Operations 5
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-dlp-api-beta-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: public dlp DLP API (Beta) API
version: 1.0.0
description: DLP Public API
license:
name: MIT
url: https://opensource.org/license/mit
contact:
email: support@paloaltonetworks.com
name: Palo Alto Networks Technical Support
url: https://support.paloaltonetworks.com
servers:
- url: https://api.dlp.paloaltonetworks.com
description: Prod host
security:
- JWTAuth: []
tags:
- name: DLP API (Beta)
description: Beta DLP APIs
paths:
/v4/api/incidents:
post:
tags:
- DLP API (Beta)
summary: Retrieve initial incident records with token
description: 'This API is used for the initial retrieval of incident details. It allows you to
specify a time range, the desired page size, and an optional maximum number of rows
to fetch. Upon successful execution, it returns a set of incident records and a
pagination token that must be used for subsequent paginated requests via the
GET /incidents API;'
operationId: getIncidentInventory
parameters:
- name: include_data_profiles
in: query
description: Flag to include data profiles.
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentInventoryRequest'
example:
time_range: HOUR_24
required: true
responses:
'200':
description: Successful!
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentInventoryResponse'
example:
rows:
- action: block
asset_name: test asset name
control_point: PRISMA_ACCESS
created_date: 1753121720515000
data_profile_id: '11995064'
destination: web-browsing
incident_id: 58feac56-e49d-43b3-ade3-c2d8e34ecd68
modified_date: 1753121720515739
policy_type: Network
report_id: '3082846756'
severity: '2'
source: palodlp11
source_region: US_STG
status: New
sub_policy_type: Data in Motion
url_domain: test url domain
status: READY
status_description: Query results are ready.
query_token: test_token
total_rows: 1
'400':
description: Bad Request
'500':
description: Internal Server Error
get:
tags:
- DLP API (Beta)
summary: Retrieve paginated incident records using token
description: This API is used to fetch subsequent pages of incident records after an initial request to the POST /incidents API. It requires a token obtained from the initial POST request, along with page_size and offset to control pagination.
operationId: getIncidentInventoryTableResults
parameters:
- name: token
in: query
description: The pagination token received from the initial POST /incidents API call. This token identifies the specific query for which results are being paginated.
required: true
schema:
type: string
- name: offset
in: query
description: The row offset from which to start fetching incident records. For the first paginated request, this would typically be page_size. For subsequent requests, it would be previous_offset + page_size
required: true
schema:
type: string
- name: pageSize
in: query
description: The maximum number of incident records to return in this paginated response. This value should be between 1 and 1000
required: true
schema:
type: string
- name: include_data_profiles
in: query
description: Flag to include data profiles
schema:
type: string
responses:
'200':
description: Successful!
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentInventoryResponse'
example:
rows:
- action: block
asset_name: test asset name
control_point: PRISMA_ACCESS
created_date: 1753121720515000
data_profile_id: '11995064'
destination: web-browsing
incident_id: 58feac56-e49d-43b3-ade3-c2d8e34ecd68
modified_date: 1753121720515739
policy_type: Network
report_id: '3082846756'
severity: '2'
source: palodlp11
source_region: US_STG
status: New
sub_policy_type: Data in Motion
url_domain: test url domain
status: READY
status_description: Query results are ready.
query_token: test_token
total_rows: 1
'400':
description: Bad Request
'500':
description: Internal Server Error
/v4/api/incidents/download:
post:
tags:
- DLP API (Beta)
summary: Get signed download URL for incidents
description: 'Generate a secure, time-limited URL (valid for 5 minutes) to directly download incident
records as a CSV file. Define your desired dataset by providing a time_range, optional
filter criteria, and maxRows.'
operationId: exportIncidentsAndGetUrl
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ResultsDownloadRequest'
example:
time_range: HOUR_24
required: true
responses:
'200':
description: Successful!
content:
application/json:
schema:
$ref: '#/components/schemas/ResultsDownloadResponse'
example:
download_url: https://storage.googleapis.com/casb-data-platform-prod-uim-inc-export/1494634703/incidents_20250721_205140_e3f288124dec432c8f94ed4f5b49b19b.csv.gz?test_signed_url
'400':
description: Bad Request
'500':
description: Internal Server Error
/v4/api/incidents/management:
post:
tags:
- DLP API (Beta)
summary: Update key details for incidents
description: 'Update key incident information like assignee details, resolution status, priority,
tags, and notes. Provide the incident_ids for the incidents you want to change, along
with an update_details object containing only the specific fields you wish to modify.'
operationId: updateIncidents
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentUpdateRequest'
example:
incident_ids:
- 5ba587fd-4b83-416d-998f-16d79c7da889
- 58feac56-e49d-43b3-ade3-c2d8e34ecd68
update_details:
assignee_display_name: John Doe
assignee_email: john.doe@example.com
assignee_id: user123
resolution_status: under_investigation
priority: 2
tag: security-review
notes: Escalated for further investigation
resolved_by: admin@example.com
required: true
responses:
'200':
description: Successful!
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentUpdateResults'
example:
success: 1
'400':
description: Bad Request
'500':
description: Internal Server Error
/v4/api/incidents/{id}:
get:
tags:
- DLP API (Beta)
summary: Retrieve incident details by ID
description: For a given incident id, return incident details.
operationId: getIncidentDetails
parameters:
- name: id
in: path
description: Incident ID.
required: true
schema:
type: string
- name: includeSnippets
in: query
description: Include snippet details in the response.
schema:
type: boolean
default: false
responses:
'200':
description: Successful!
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentDetailResponse'
example:
rows:
- id: 5ba587fd-4b83-416d-998f-16d79c7da889
tsg_id: '1016831479'
control_point: NGFW
created_date: 1752910252943000
modified_date: 1753137046114000
status: New
notes: test
severity: '5'
category: test
direction: upload
report_id: '229650498'
report_date: 1752910252937000
resolved_by: test
source: 188.188.188.10
destination: 185.125.188.57
url: test
priority: 1
action: block
asset_id: 5ba587fd-4b83-416d-998f-16d79c7da889
asset_name: UNKNOWN
asset_hash: test hash
asset_size: test
tag: test
asset_risk: 25
assigned_to: test
assignee_name: test
assignee_email: test
app_id: '109'
app_type: '0'
app_name: test
app_instance_id: test
app_tags:
- test1
- test2
data_profiles:
- id: '11995181'
name: AEL_Granular
version: test
data_patterns:
- id: 65779c793375232371f9886c
name: test
type: predefined
technique: regex
language: test
category_score: 0
high_confidence_frequency: 2
medium_confidence_frequency: 0
low_confidence_frequency: 4
sub_category_score: 0
total_detection_frequency: 4
total_strict_detection_frequency: 0
strict_detection_frequency: 0
detection_frequency: 4
weighted_frequency: 0
version: 1
peripheral_info:
group_id: ''
group_name: ''
id: test id
is_known: false
manufacturer_name: General
name: USB-4GB
product_id: '1000'
product_name: USB Flash Disk
serial_number: 0415090000013290
type: usb
vendor_id: 090C
policy:
policy_id: test
policy_type: network
policy_version: test
device_info:
- id: test
name: test
ip: 188.188.188.10
serial_number: 024401003837
loggedin_users:
- test
reason_for_action: test
endpoint_os_info:
dlp_client_version: test
gp_version: test
os_type: test
os_version: test
user_id: globaltestuser1
user_email: test
user_name: test
user_location: test
user_department: test
user_manager: test
exposure: test
exposure_details:
is_exposed_by_parent_folder: false
is_public_url: false
is_shared_url: false
is_sign_in_required: true
cloud_url: test cloud url
public_url: test public url
status: READY
status_description: Query results are ready.
total_rows: 1
'400':
description: Bad Request
'500':
description: Internal Server Error
components:
schemas:
IncidentUpdateRequest:
type: object
properties:
incident_ids:
type: array
items:
type: string
format: uuid
minItems: 1
update_details:
$ref: '#/components/schemas/IncidentUpdateDetails'
required:
- incident_ids
- update_details
IncidentDetailEntity:
type: object
properties:
id:
type: string
tsg_id:
type: string
control_point:
type: string
created_date:
type: integer
format: int64
modified_date:
type: integer
format: int64
status:
type: string
notes:
type: string
severity:
type: string
category:
type: string
direction:
type: string
report_id:
type: string
report_date:
type: integer
format: int64
resolved_by:
type: string
source:
type: string
destination:
type: string
url:
type: string
priority:
type: integer
format: int32
action:
type: string
asset_id:
type: string
asset_name:
type: string
asset_hash:
type: string
asset_size:
type: string
tag:
type: string
asset_risk:
type: number
format: double
assigned_to:
type: string
assignee_name:
type: string
assignee_email:
type: string
app_id:
type: string
app_type:
type: string
app_name:
type: string
app_instance_id:
type: string
app_tags:
type: array
items:
type: string
data_profiles:
type: array
items:
$ref: '#/components/schemas/DataProfile'
data_patterns:
type: array
items:
$ref: '#/components/schemas/DataPattern'
peripheral_info:
$ref: '#/components/schemas/PeripheralInfo'
policy:
$ref: '#/components/schemas/Policy'
device_info:
type: array
items:
$ref: '#/components/schemas/DeviceInfo'
reason_for_action:
type: string
endpoint_os_info:
$ref: '#/components/schemas/EndpointOsInfo'
user_id:
type: string
user_email:
type: string
user_name:
type: string
user_location:
type: string
user_department:
type: string
user_manager:
type: string
exposure:
type: string
exposure_details:
$ref: '#/components/schemas/ExposureDetails'
ErrorInfo:
type: object
properties:
id:
type: string
minLength: 1
error_message:
type: string
minLength: 1
error_code:
type: string
minLength: 1
IncidentInventoryEntity:
type: object
properties:
action:
type: string
asset_name:
type: string
assignee_email:
type: string
assignee_id:
type: string
assignee_name:
type: string
control_point:
type: string
created_date:
type: integer
format: int64
data_profile_id:
type: string
destination:
type: string
incident_id:
type: string
modified_date:
type: integer
format: int64
notes:
type: string
peripheral_name:
type: string
peripheral_type:
type: string
policy_type:
type: string
priority:
type: integer
format: int32
report_id:
type: string
resolved_by:
type: string
severity:
type: string
source:
type: string
source_region:
type: string
status:
type: string
sub_policy_type:
type: string
tag:
type: string
url_domain:
type: string
ResultsDownloadResponse:
type: object
properties:
download_url:
type: string
PeripheralInfo:
type: object
properties:
group_id:
type: string
group_name:
type: string
id:
type: string
is_known:
type: boolean
manufacturer_name:
type: string
name:
type: string
product_id:
type: string
product_name:
type: string
serial_number:
type: string
type:
type: string
vendor_id:
type: string
DataProfile:
type: object
properties:
id:
type: string
name:
type: string
version:
type: string
ExposureDetails:
type: object
properties:
is_exposed_by_parent_folder:
type: boolean
is_public_url:
type: boolean
is_shared_url:
type: boolean
is_sign_in_required:
type: boolean
cloud_url:
type: string
public_url:
type: string
ResultsDownloadRequest:
type: object
properties:
filter:
type: string
description: "Filter expression string\n<br>Operators supported: =, in and AND\n<br>Pattern: {FilterName} = {value} or {FilterName} in ({value1}, {value2}, ...)\n<br>Supported FilterName values:\n- Action: Filter by action taken (e.g., 'block', 'allow')\n- ApplicationName: Filter by application name\n- Asset: Filter by asset name\n- AssigneeId: Filter by assignee user ID\n- AssigneeName: Filter by assignee display name\n- Channel: Filter by channel (e.g., 'PRISMA_ACCESS', 'NGFW')\n- DataPattern: Filter by detection types/data patterns (e.g., 'SSN', 'Credit Card')\n- DataProfile: Filter by data profile ID\n- Destination: Filter by destination\n- IncidentId: Filter by specific incident ID\n- Priority: Filter by priority level (numeric values 1-5)\n- ReportId: Filter by report ID\n- Severity: Filter by severity level\n - 5 = Critical\n - 4 = High\n - 3 = Medium\n - 2 = Low\n - 1 = Informational\n- Source: Filter by source\n- Region: Filter by region (e.g., 'US', 'EU', 'UK', 'SG', 'IN', 'AU', 'CA', 'JP')\n- Status: Filter by incident status (e.g., 'New', 'open', 'under_investigation', 'closed')\n- UrlDomain: Filter by URL domain\n- Tag: Filter by incident tags\n\nExamples:\n- \"Tag = 'Needs Escalation'\"\n- \"Status in ('New','open','under_investigation')\"\n- \"UrlDomain = 'dlptest.com'\"\n- \"Channel = 'PRISMA_ACCESS' AND DataProfile in ('11995030','11995033')\"\n"
example: Tag = 'Needs Escalation'
time_range:
type: string
enum:
- HOUR_1
- HOUR_3
- HOUR_24
- DAY_7
- DAY_30
- DAY_90
- CUSTOM
start_time:
type: integer
format: int64
writeOnly: true
description: Required when time_range is CUSTOM. Start time as Unix timestamp in milliseconds(ms).
end_time:
type: integer
format: int64
writeOnly: true
description: Required when time_range is CUSTOM. End time as Unix timestamp in milliseconds(ms).
columns:
type: array
items:
type: string
writeOnly: true
description: Optional columns to include in the response
sort_by:
type: string
writeOnly: true
description: Optional field to sort by
sort_order:
type: string
writeOnly: true
description: Optional sort order (asc/desc)
max_rows:
type: integer
format: int32
writeOnly: true
example: 10000
description: Maximum number of rows to return (optional, e.g., 1000)
token:
type: string
required:
- time_range
IncidentUpdateResults:
type: object
properties:
success:
type: integer
format: int32
error:
$ref: '#/components/schemas/ErrorInfo'
DataPattern:
type: object
properties:
id:
type: string
name:
type: string
type:
type: string
technique:
type: string
language:
type: string
category_score:
type: integer
format: int32
high_confidence_frequency:
type: integer
format: int32
medium_confidence_frequency:
type: integer
format: int32
low_confidence_frequency:
type: integer
format: int32
sub_category_score:
type: integer
format: int32
total_detection_frequency:
type: integer
format: int32
total_strict_detection_frequency:
type: integer
format: int32
strict_detection_frequency:
type: integer
format: int32
detection_frequency:
type: integer
format: int32
weighted_frequency:
type: integer
format: int32
version:
type: integer
format: int32
IncidentDetailResponse:
type: object
properties:
rows:
type: array
items:
$ref: '#/components/schemas/IncidentDetailEntity'
status:
type: string
enum:
- READY
- PENDING
status_description:
type: string
query_token:
type: string
IncidentInventoryResponse:
type: object
properties:
rows:
type: array
items:
$ref: '#/components/schemas/IncidentInventoryEntity'
status:
type: string
enum:
- READY
- PENDING
status_description:
type: string
query_token:
type: string
total_rows:
type: integer
format: int64
EndpointOsInfo:
type: object
properties:
dlp_client_version:
type: string
gp_version:
type: string
os_type:
type: string
os_version:
type: string
IncidentUpdateDetails:
type: object
properties:
notes:
type: string
assignee_id:
type: string
assignee_email:
type: string
assignee_display_name:
type: string
resolved_by:
type: string
resolution_status:
type: string
priority:
type: integer
format: int32
tag:
type: string
Policy:
type: object
properties:
policy_id:
type: string
policy_type:
type: string
policy_version:
type: string
IncidentInventoryRequest:
type: object
properties:
filter:
type: string
description: "Filter expression string\n<br>Operators supported: =, in and AND\n<br>Pattern: {FilterName} = {value} or {FilterName} in ({value1}, {value2}, ...)\n<br>Supported FilterName values:\n- Action: Filter by action taken (e.g., 'block', 'allow')\n- ApplicationName: Filter by application name\n- Asset: Filter by asset name\n- AssigneeId: Filter by assignee user ID\n- AssigneeName: Filter by assignee display name\n- Channel: Filter by channel (e.g., 'PRISMA_ACCESS', 'NGFW')\n- DataPattern: Filter by detection types/data patterns (e.g., 'SSN', 'Credit Card')\n- DataProfile: Filter by data profile ID\n- Destination: Filter by destination\n- IncidentId: Filter by specific incident ID\n- Priority: Filter by priority level (numeric values 1-5)\n- ReportId: Filter by report ID\n- Severity: Filter by severity level\n - 5 = Critical\n - 4 = High\n - 3 = Medium\n - 2 = Low\n - 1 = Informational\n- Source: Filter by source\n- Region: Filter by region (e.g., 'US', 'EU', 'UK', 'SG', 'IN', 'AU', 'CA', 'JP')\n- Status: Filter by incident status (e.g., 'New', 'open', 'under_investigation', 'closed')\n- UrlDomain: Filter by URL domain\n- Tag: Filter by incident tags\n\nExamples:\n- \"Tag = 'Needs Escalation'\"\n- \"Status in ('New','open','under_investigation')\"\n- \"UrlDomain = 'dlptest.com'\"\n- \"Channel = 'PRISMA_ACCESS' AND DataProfile in ('11995030','11995033')\"\n"
example: Tag = 'Needs Escalation'
minLength: 1
time_range:
type: string
enum:
- HOUR_1
- HOUR_3
- HOUR_24
- DAY_7
- DAY_30
- DAY_90
- CUSTOM
start_time:
type: integer
format: int64
writeOnly: true
description: Required when time_range is CUSTOM. Start time as Unix timestamp in milliseconds(ms).
end_time:
type: integer
format: int64
writeOnly: true
description: Required when time_range is CUSTOM. Start time as Unix timestamp in milliseconds(ms).
columns:
type: array
items:
type: string
writeOnly: true
description: Optional columns to include in the response
sort_by:
type: string
writeOnly: true
description: Optional field to sort by
sort_order:
type: string
writeOnly: true
description: Optional sort order (asc/desc)
page_size:
type: integer
format: int32
writeOnly: true
description: Size for pagination
max_rows:
type: integer
format: int32
writeOnly: true
example: 10000
description: Maximum number of rows to return (optional, e.g., 1000)
required:
- time_range
DeviceInfo:
type: object
properties:
id:
type: string
name:
type: string
ip:
type: string
serial_number:
type: string
loggedin_users:
type: array
items:
type: string
securitySchemes:
JWTAuth:
scheme: bearer
type: http