Palo Alto Networks Event Logs API
APIs for Event Logs.
OpenAPI Specification
openapi: 3.2.0
info:
title: TLS Protect Cloud API for Strata Cloud Manager Event Logs API
description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
version: 1.0.0
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Event Logs
description: APIs for Event Logs.
paths:
/v1/activitylogsearch:
post:
description: Request specific event log data that matches your filter criteria and include a total count of entries in the response.
operationId: activitylogs_getByExpression
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ActivityLogFilter'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ActivityLogEntriesResponse'
description: Total count and list of matching log entries.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
summary: Retrieve count and activity log entries
tags:
- Event Logs
/v1/activitylogsearch/export:
post:
description: Request specific event log data that matches your filter criteria. You can even specify the format in the header as either JSON or CSV.
operationId: activitylogs_getAllByExpression
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ActivityLogFilter'
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/ExportedActivityLogEntryInformation'
type: array
text/csv:
schema:
type: string
description: List of matching log entries.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
text/csv:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
text/csv:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
summary: Export filtered event log data to
tags:
- Event Logs
/v1/activitytypes:
get:
description: Retrieve types of activities used for event logging, such as failed login attempts or events that are critical. Learn more about [event logging](https://docs.venafi.cloud/vaas/logging/c-about-activity-logging/).
operationId: activitylogtypes_get
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/ActivityLogType'
type: array
description: Types of activities in event logging; details in response body
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse9'
description: Incomplete or malformed request.
summary: Retrieve types of activities used for
tags:
- Event Logs
components:
schemas:
ActivityLogOrder:
properties:
direction:
$ref: '#/components/schemas/Direction'
field:
description: A field, that will be used for ordering
example: activityDate
type: string
type: object
ActivityLogFilter:
properties:
expression:
$ref: '#/components/schemas/BaseActivityLogFilter'
ordering:
$ref: '#/components/schemas/BaseActivityLogOrdering'
paging:
$ref: '#/components/schemas/Page2'
type: object
NaryOperator:
description: An operator for filtering
enum:
- AND
- OR
example: OR
type: string
ErrorInformation9:
properties:
args:
items:
$ref: '#/components/schemas/AnyValue9'
type: array
code:
format: int32
type: integer
message:
type: string
type: object
BaseActivityLogOrdering:
description: Specify the ordering of a search result
properties:
orders:
items:
$ref: '#/components/schemas/ActivityLogOrder'
type: array
type: object
ActivityLogFilterOperator:
description: An operator for filtering
enum:
- EQ
- LT
- LTE
- GT
- GTE
- IN
example: EQ
type: string
ActivityLogEntriesResponse:
properties:
activityLogEntries:
description: A collection of activity log entries
items:
$ref: '#/components/schemas/ActivityLogEntryInformation'
type: array
count:
description: The number of activity log entries.
example: 2
format: int64
type: integer
type: object
Page2:
description: Specify pagination on the search request
properties:
pageNumber:
description: page number
example: 0
format: int32
type: integer
pageSize:
description: page size
example: 10
format: int32
type: integer
type: object
ActivityLogType:
properties:
key:
type: string
readableName:
type: string
values:
items:
$ref: '#/components/schemas/ActivityLogName'
type: array
type: object
UnaryOperator:
description: An operator for filtering
enum:
- NOT
example: NOT
type: string
ActivityLogFilterOperand:
properties:
operand:
$ref: '#/components/schemas/ActivityLogCondition'
operator:
$ref: '#/components/schemas/UnaryOperator'
type: object
ActivityLogEntryInformation:
properties:
activityDate:
description: The date when a log entry was produced
example: '2023-01-24T09:12:28Z'
format: date-time
type: string
activityName:
description: An activity name
example: Login Succeeded
type: string
activityType:
description: An activity type
example: Authentication
type: string
companyId:
description: UUID of a company
example: 85595df0-8e14-11ed-87e3-755db050f29d
format: uuid
type: string
criticality:
description: An activity criticality
example: 0
format: int32
type: integer
id:
description: UUID of a log entry
example: 2eb29780-9046-11ed-8e50-b994b27d2ece
format: uuid
type: string
message:
description: An activity log message
example: user logged in
type: string
payload:
additionalProperties:
type: string
type: object
tsgId:
description: TSG ID of a company
example: '1234567890'
type: string
type: object
ActivityLogFilterOperands:
properties:
operands:
description: A list of conditions that will be used for filtering
example:
- field: activityType
operator: EQ
value: Authentication
- field: activityName
operator: EQ
value: Login Succeeded
items:
$ref: '#/components/schemas/BaseActivityLogFilter'
type: array
operator:
$ref: '#/components/schemas/NaryOperator'
type: object
Direction:
description: An ordering direction
enum:
- ASC
- DESC
example: DESC
type: string
ExportedActivityLogEntryInformation:
properties:
activityDate:
description: The date when a log entry was produced
example: '2023-01-24T09:12:28Z'
format: date-time
type: string
activityName:
description: An activity name
example: Login Succeeded
type: string
activityType:
description: An activity type
example: Authentication
type: string
criticality:
description: An activity criticality
example: 0
format: int32
type: integer
id:
description: UUID of a log entry
example: 2eb29780-9046-11ed-8e50-b994b27d2ece
format: uuid
type: string
message:
description: An activity log message
example: user logged in
type: string
payload:
additionalProperties:
type: string
type: object
type: object
ErrorResponse9:
properties:
errors:
items:
$ref: '#/components/schemas/ErrorInformation9'
type: array
type: object
ActivityLogCondition:
description: A Condition for filtering
properties:
field:
description: Represents a field for filtering
example: activityType
type: string
operator:
$ref: '#/components/schemas/ActivityLogFilterOperator'
value:
description: represents a field's value
example: Authentication
type: string
values:
description: represents a field's values
example:
- Authentication
- Users
items:
type: string
type: array
type: object
ActivityLogName:
properties:
key:
type: string
readableName:
type: string
type: object
AnyValue9:
description: Can be any value - string, number, boolean, array or object.
BaseActivityLogFilter:
description: Root expression for filtering
oneOf:
- $ref: '#/components/schemas/ActivityLogFilterOperands'
- $ref: '#/components/schemas/ActivityLogFilterOperand'
- $ref: '#/components/schemas/ActivityLogCondition'
type: object
securitySchemes:
scmOAuth:
type: oauth2
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
flows:
clientCredentials:
tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
scopes: {}
scmToken:
type: http
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
scheme: bearer
bearerFormat: JWT