Palo Alto Networks Entries API

openapi: 3.2.0
info:
  title: Palo Alto Networks Entries API
  version: '1.0'
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  description: 'Operations tagged Entries across 2 of this provider''s published API definitions: palo-alto-cortex-xsoar-api-openapi-original.yml, palo-alto-networks-entries-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{xsoar-server}
  description: Cortex XSOAR server endpoint.
  variables:
    xsoar-server:
      description: Hostname or IP address of the Cortex XSOAR server.
      default: xsoar.example.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Entries
  description: Investigation entry (work note) management.
paths:
  /entry:
    post:
      operationId: addEntry
      summary: Palo Alto Networks Add Entry to Investigation
      description: Adds a work note or entry to an investigation's war room. Entries can be notes, commands, files, or other content types. The war room serves as the collaborative workspace for the incident investigation team.
      tags:
      - Entries
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEntryRequest'
            examples:
              AddEntryRequestExample:
                summary: Default addEntry request
                x-microcks-default: true
                value:
                  investigationId: '274080'
                  data: example-data
                  markdown: false
                  tags:
                  - critical-asset
                  - production
      responses:
        '200':
          description: Entry added successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Entry'
              examples:
                AddEntry200Example:
                  summary: Default addEntry 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    investigationId: '215099'
                    type: 140
                    user: example-user
                    created: '2024-07-22T09:20:31Z'
                    modified: '2025-02-16T15:12:04Z'
                    contents: example-contents
                    humanReadable: example-humanReadable
                    tags:
                    - production
                    - pci-scope
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - apiKey: []
    servers:
    - url: https://{xsoar-server}
      description: Cortex XSOAR server endpoint.
      variables:
        xsoar-server:
          description: Hostname or IP address of the Cortex XSOAR server.
          default: xsoar.example.com
components:
  responses:
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    CreateEntryRequest:
      type: object
      required:
      - investigationId
      - data
      properties:
        investigationId:
          type: string
          description: ID of the investigation to add the entry to.
          example: '274080'
        data:
          type: string
          description: Entry content text or command to execute.
          example: example-data
        markdown:
          type: boolean
          description: Whether to render the content as Markdown.
          default: false
          example: false
        tags:
          type: array
          items:
            type: string
          example:
          - critical-asset
          - production
    ErrorResponse:
      type: object
      properties:
        id:
          type: string
          example: example-id
        status:
          type: integer
          example: 19
        title:
          type: string
          example: Corporate Gateway 74
        detail:
          type: string
          example: example-detail
        error:
          type: string
          example: example-error
    Entry:
      type: object
      description: A war room entry in a Cortex XSOAR investigation.
      properties:
        id:
          type: string
          readOnly: true
          example: example-id
        investigationId:
          type: string
          example: '215099'
        type:
          type: integer
          description: 'Entry type: 1 (Note), 2 (Download), 3 (File), 4 (Error), 5 (Pinned), 6 (UserManagement), 7 (Image), 8 (PlaygroundCommand), 9 (PlaybookStatusNote), 10 (Canvas), 11 (Widget), 12 (Summary), 13 (Section), 14 (Table).'
          example: 140
        user:
          type: string
          description: Username of the user who created the entry.
          example: example-user
        created:
          type: string
          format: date-time
          example: '2024-07-22T09:20:31Z'
        modified:
          type: string
          format: date-time
          example: '2025-02-16T15:12:04Z'
        contents:
          type: string
          description: Entry content text.
          example: example-contents
        humanReadable:
          type: string
          description: Human-readable formatted content.
          example: example-humanReadable
        tags:
          type: array
          items:
            type: string
          example:
          - production
          - pci-scope
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: Authorization
      description: Cortex XSOAR API key. Generate from Settings > Integrations > API Keys in the XSOAR console. Pass the key directly as the Authorization header value (no Bearer prefix required for standard API keys).
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-cortex-xsoar-api-openapi-original.yml
- palo-alto-networks-entries-api-openapi.yml