Palo Alto Networks Feeds API

{'$ref': 'desc/feeds/feeds.md'}

Documentation GitHub OpenAPI

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/v34.03/feeds/custom/custom-vulnerabilities Get custom vulnerability feed (v34.03) · Get Custom Vulnerability Feed #

Ask an LLM

“Which custom vulnerability rules are defined in the older v34.03 Prisma Cloud Compute feed endpoint?”

“Can I still read my custom vulnerabilities feed through API version 34.03?”

Tell an agent

Get the custom vulnerability feed using the v34.03 API.

Show my custom vulnerability rules from the 34.03 feeds endpoint.

PUT /api/v34.03/feeds/custom/custom-vulnerabilities Replace custom vulnerability rules (v34.03) · Update Custom Vulnerability Feed #

Ask an LLM

“How do I push custom vulnerability rules through the v34.03 feeds API?”

“Does updating the custom vulnerability feed on API 34.03 need the feed digest?”

Tell an agent

Replace the custom vulnerability rules with {rules} using API v34.03.

Update custom vulnerability feed {_id} on the 34.03 endpoint with rules {rules}.

GET /api/v34.03/feeds/custom/malware Get custom malware feed (v34.03) · Get Custom Malware Feed #

Ask an LLM

“Which custom malware signatures are in my feed via the older v34.03 API?”

“Can I read the custom malware feed through API version 34.03?”

Tell an agent

Get the custom malware feed using the v34.03 API.

Show my custom malware signatures from the 34.03 feeds endpoint.

PUT /api/v34.03/feeds/custom/malware Replace custom malware signatures (v34.03) · Update Custom Malware Feed #

Ask an LLM

“Can I upload custom malware signatures through the v34.03 feeds API?”

“Can I set the custom malware feed's modified time on API 34.03?”

Tell an agent

Replace the custom malware feed with signatures {feed} using API v34.03.

Update custom malware feed {_id} on the 34.03 endpoint with {feed}.

GET /api/v34.04/feeds/custom/custom-vulnerabilities Get custom vulnerability feed (v34.04) · Get Custom Vulnerability Feed #

Ask an LLM

“What custom vulnerability rules does my Prisma Cloud Compute console hold on the current v34.04 API?”

“How do I read the custom vulnerabilities feed with API version 34.04?”

Tell an agent

Get the custom vulnerability feed from the v34.04 API.

List custom vulnerability rules via the current 34.04 endpoint.

PUT /api/v34.04/feeds/custom/custom-vulnerabilities Replace custom vulnerability rules (v34.04) · Update Custom Vulnerability Feed #

Ask an LLM

“What's the way to update my custom vulnerability rules on the v34.04 API?”

“Can I overwrite the custom vulnerability feed's rule list with API 34.04?”

Tell an agent

Set the custom vulnerability rules to {rules} via the v34.04 API.

Overwrite custom vulnerability feed {_id} through the 34.04 endpoint using {rules}.

GET /api/v34.04/feeds/custom/malware Get custom malware feed (v34.04) · Get Custom Malware Feed #

Ask an LLM

“What custom malware signatures are loaded on the current v34.04 API?”

“Where do I fetch my own malware signatures on API version 34.04?”

Tell an agent

Get the custom malware feed from the v34.04 API.

List custom malware signatures via the current 34.04 endpoint.

PUT /api/v34.04/feeds/custom/malware Replace custom malware signatures (v34.04) · Update Custom Malware Feed #

Ask an LLM

“How do I add my own malware signatures with the v34.04 feeds API?”

“Can I overwrite the whole custom malware feed on API 34.04?”

Tell an agent

Set the custom malware signatures to {feed} via the v34.04 API.

Overwrite custom malware feed {_id} through the 34.04 endpoint using {feed}.

Specifications

⚙

OpenAPI

https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-feeds-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-feeds-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Palo Alto Networks Feeds API
  x-description-source: desc/intro.md
  version: '1.0'
  description: 'Operations tagged Feeds across 2 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json. Each path carries the servers of the definition it was published in.'
tags:
- name: Feeds
  description: Feeds. 4 operations in this definition.
  x-description-source: desc/feeds/feeds.md
paths:
  /api/v34.03/feeds/custom/custom-vulnerabilities:
    get:
      description: 'Get Custom Vulnerability Feed. GET /api/v34.03/feeds/custom/custom-vulnerabilities on the Feeds API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/vuln.CustomVulnerabilities'
          description: 'CustomVulnerabilities is a collection of custom vulnerabilities

            TBD: this storage usage is not best practice, should be migrate to a 1 document per vulnerability'
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: get-feeds-custom-custom-vulnerabilities
      summary: Get Custom Vulnerability Feed
      x-description-source: desc/feeds/custom-vulnerabilities_get.md
    put:
      description: 'Update Custom Vulnerability Feed. PUT /api/v34.03/feeds/custom/custom-vulnerabilities on the Feeds API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/vuln.CustomVulnerabilities'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: put-feeds-custom-custom-vulnerabilities
      summary: Update Custom Vulnerability Feed
      x-description-source: desc/feeds/custom-vulnerabilities_put.md
  /api/v34.03/feeds/custom/malware:
    get:
      description: 'Get Custom Malware Feed. GET /api/v34.03/feeds/custom/malware on the Feeds API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/shared.CustomMalwareFeed'
          description: CustomMalwareFeed represent the custom malware
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: user
      operationId: get-feeds-custom-malware
      summary: Get Custom Malware Feed
      x-description-source: desc/feeds/malware_get.md
    put:
      description: 'Update Custom Malware Feed. PUT /api/v34.03/feeds/custom/malware on the Feeds API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/shared.CustomMalwareFeed'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: put-feeds-custom-malware
      summary: Update Custom Malware Feed
      x-description-source: desc/feeds/malware_put.md
  /api/v34.04/feeds/custom/custom-vulnerabilities:
    get:
      description: 'Get Custom Vulnerability Feed. GET /api/v34.04/feeds/custom/custom-vulnerabilities on the Feeds API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/vuln.CustomVulnerabilities'
          description: 'CustomVulnerabilities is a collection of custom vulnerabilities

            TBD: this storage usage is not best practice, should be migrate to a 1 document per vulnerability'
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: getApiV3404FeedsCustomCustomVulnerabilities
      summary: Get Custom Vulnerability Feed
      x-description-source: desc/feeds/custom-vulnerabilities_get.md
      x-operation-id-source: normalized
      x-operation-id-original: get-feeds-custom-custom-vulnerabilities
    put:
      description: 'Update Custom Vulnerability Feed. PUT /api/v34.04/feeds/custom/custom-vulnerabilities on the Feeds API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/vuln.CustomVulnerabilities'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: putApiV3404FeedsCustomCustomVulnerabilities
      summary: Update Custom Vulnerability Feed
      x-description-source: desc/feeds/custom-vulnerabilities_put.md
      x-operation-id-source: normalized
      x-operation-id-original: put-feeds-custom-custom-vulnerabilities
  /api/v34.04/feeds/custom/malware:
    get:
      description: 'Get Custom Malware Feed. GET /api/v34.04/feeds/custom/malware on the Feeds API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/shared.CustomMalwareFeed'
          description: CustomMalwareFeed represent the custom malware
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: user
      operationId: getApiV3404FeedsCustomMalware
      summary: Get Custom Malware Feed
      x-description-source: desc/feeds/malware_get.md
      x-operation-id-source: normalized
      x-operation-id-original: get-feeds-custom-malware
    put:
      description: 'Update Custom Malware Feed. PUT /api/v34.04/feeds/custom/malware on the Feeds API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/shared.CustomMalwareFeed'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Feeds
      x-prisma-cloud-target-env:
        permission: systemOperations
      operationId: putApiV3404FeedsCustomMalware
      summary: Update Custom Malware Feed
      x-description-source: desc/feeds/malware_put.md
      x-operation-id-source: normalized
      x-operation-id-original: put-feeds-custom-malware
components:
  schemas:
    shared.CustomMalwareFeed:
      description: CustomMalwareFeed represent the custom malware
      properties:
        _id:
          description: 'ID is the custom feed id.

            '
          type: string
        digest:
          description: 'Digest is an internal digest of the feed.

            '
          type: string
        feed:
          description: 'Feed is the list of custom malware signatures.

            '
          items:
            $ref: '#/components/schemas/shared.Malware'
          type: array
        modified:
          description: 'Modified is the last time the custom feed was modified.

            '
          format: date-time
          type: string
      type: object
    vuln.CustomVulnerabilities:
      description: 'CustomVulnerabilities is a collection of custom vulnerabilities

        TBD: this storage usage is not best practice, should be migrate to a 1 document per vulnerability'
      properties:
        _id:
          description: 'ID is the custom vulnerabilities feed ID.

            '
          type: string
        digest:
          description: 'Digest is the internal custom vulnerabilities feed digest.

            '
          type: string
        rules:
          description: 'Rules is the list of custom vulnerabilities rules.

            '
          items:
            $ref: '#/components/schemas/vuln.CustomVulnerability'
          type: array
      type: object
    vuln.CustomVulnerability:
      description: CustomVulnerability is a user customized vulnerability
      properties:
        _id:
          description: '.

            '
          type: string
        maxVersionInclusive:
          description: '.

            '
          type: string
        md5:
          description: '.

            '
          type: string
        minVersionInclusive:
          description: '.

            '
          type: string
        name:
          description: '.

            '
          type: string
        package:
          description: '.

            '
          type: string
        type:
          $ref: '#/components/schemas/packages.Type'
      type: object
    packages.Type:
      description: Type describes the package type
      enum:
      - - nodejs
        - gem
        - python
        - jar
        - package
        - windows
        - binary
        - nuget
        - go
        - app
        - unknown
      type: string
    shared.Malware:
      description: Malware is an executable and its md5
      properties:
        allowed:
          description: 'Allowed indicates if this signature is on the allowed list.

            '
          type: boolean
        md5:
          description: '.

            '
          type: string
        modified:
          description: 'Modified is the time the malware was added to the DB.

            '
          format: int64
          type: integer
        name:
          description: '.

            '
          type: string
      type: object
x-refined-from:
- palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json
- palo-alto-compute-openapi-34-04-145-sh-openapi.json