Palo Alto Networks Hosts API
{'$ref': 'desc/hosts/hosts.md'}
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-hosts-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Hosts API
x-refined-note:
- x-description-source differs across the merged source definitions and was not carried
version: '1.0'
description: 'Operations tagged Hosts across 6 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json, palo-alto-networks-hosts-api-openapi.yml, palo-alto-prisma-cloud-compute-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://{console}/api/v1
description: Prisma Cloud Compute Console API.
variables:
console:
default: console.example.com
description: Address of the Prisma Cloud Compute Console. For SaaS deployments, use the address provided in Prisma Cloud under Compute > Manage > System > Utilities.
tags:
- name: Hosts
description: Hosts. 5 operations in this definition.
x-description-source: desc/hosts/hosts.md
paths:
/api/v34.03/hosts:
get:
description: 'Get Host Scan Results. GET /api/v34.03/hosts on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_shared.ImageScanResult'
description: ''
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: get-hosts
summary: Get Host Scan Results
x-description-source: desc/hosts/get.md
/api/v34.03/hosts/download:
get:
description: 'Download Host Scan Results. GET /api/v34.03/hosts/download on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
description: OK
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: get-hosts-download
summary: Download Host Scan Results
x-description-source: desc/hosts/download_get.md
/api/v34.03/hosts/evaluate:
post:
description: 'Resolve Hosts. POST /api/v34.03/hosts/evaluate on the Hosts API. Takes an optional request body. Documented responses: 200.'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/api.ResolveImagesReq'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/api.ResolveImagesResp'
description: ResolveImagesResp represents the images resolution API output
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorCI
operationId: post-hosts-evaluate
summary: Resolve Hosts
x-description-source: desc/hosts/evaluate_get.md
/api/v34.03/hosts/info:
get:
description: 'Get Host Information. GET /api/v34.03/hosts/info on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_shared.HostInfo'
description: ''
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorRuntimeHosts
operationId: get-hosts-info
summary: Get Host Information
x-description-source: desc/hosts/info_get.md
/api/v34.03/hosts/scan:
post:
description: 'Start a Host Scan. POST /api/v34.03/hosts/scan on the Hosts API. Documented responses: 200.'
responses:
'200':
description: OK
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: post-hosts-scan
summary: Start a Host Scan
x-description-source: desc/hosts/scan_post.md
/api/v34.04/hosts:
get:
description: 'Get Host Scan Results. GET /api/v34.04/hosts on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_shared.ImageScanResult'
description: ''
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: get-hosts
summary: Get Host Scan Results
x-description-source: desc/hosts/get.md
/api/v34.04/hosts/download:
get:
description: 'Download Host Scan Results. GET /api/v34.04/hosts/download on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
description: OK
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: get-hosts-download
summary: Download Host Scan Results
x-description-source: desc/hosts/download_get.md
/api/v34.04/hosts/evaluate:
post:
description: 'Resolve Hosts. POST /api/v34.04/hosts/evaluate on the Hosts API. Takes an optional request body. Documented responses: 200.'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/api.ResolveImagesReq'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/api.ResolveImagesResp'
description: ResolveImagesResp represents the images resolution API output
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorCI
operationId: post-hosts-evaluate
summary: Resolve Hosts
x-description-source: desc/hosts/evaluate_get.md
/api/v34.04/hosts/info:
get:
description: 'Get Host Information. GET /api/v34.04/hosts/info on the Hosts API. Takes 16 query parameters. Documented responses: 200.'
parameters:
- description: 'Offsets the result to a specific report count. Offset starts from 0.
'
in: query
name: offset
schema:
type: integer
- description: 'Limit is the amount to fix.
'
in: query
name: limit
schema:
type: integer
- description: 'Sorts the result using a key.
'
in: query
name: sort
schema:
type: string
- description: 'Sorts the result in reverse order.
'
in: query
name: reverse
schema:
type: boolean
- description: 'Filters the result based on hostnames.
'
in: query
name: hostname
schema:
description: 'Filters the result based on hostnames.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on OS distribution names.
'
in: query
name: distro
schema:
description: 'Filters the result based on OS distribution names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Provides the minimal image data. Information about vulnerabilities, compliance, and extended image metadata are skipped.
Default is false.
'
in: query
name: compact
schema:
type: boolean
- description: 'Filters the result based on cluster names.
'
in: query
name: clusters
schema:
description: 'Filters the result based on cluster names.
'
items:
$ref: '#/components/schemas/string'
type: array
- description: 'Filters the result based on compliance IDs.
'
in: query
name: complianceIDs
schema:
description: 'Filters the result based on compliance IDs.
'
items:
$ref: '#/components/schemas/int'
type: array
- description: 'Filters the result based on applied compliance rule name.
'
in: query
name: complianceRuleName
schema:
type: string
- description: 'Retrieves the host names that were scanned by the agentless scanner.
'
in: query
name: agentless
schema:
type: boolean
- description: 'Filters only images scanned by CSA.
'
in: query
name: csa
schema:
type: boolean
- description: 'Retrieves the host names that were skipped during an agentless scan.
Default is false.
'
in: query
name: stopped
schema:
type: boolean
- description: 'Filters results by issue type.
'
in: query
name: issueType
schema:
description: IssueType is used to filter scan results by issue type
enum:
- - vulnerabilities
- compliance
- ''
type: string
- description: 'Retrieves the result in the normalized form of low, medium, high, and critical based on vulnerability''s severity level.
Default is false.
'
in: query
name: normalizedSeverity
schema:
type: boolean
- description: 'Filters results by uaiID.
'
in: query
name: uaiID
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/-_shared.HostInfo'
description: ''
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorRuntimeHosts
operationId: get-hosts-info
summary: Get Host Information
x-description-source: desc/hosts/info_get.md
/api/v34.04/hosts/scan:
post:
description: 'Start a Host Scan. POST /api/v34.04/hosts/scan on the Hosts API. Documented responses: 200.'
responses:
'200':
description: OK
default:
description: ''
tags:
- Hosts
x-prisma-cloud-target-env:
permission: monitorHosts
operationId: post-hosts-scan
summary: Start a Host Scan
x-description-source: desc/hosts/scan_post.md
/hosts:
get:
operationId: getHosts
summary: Palo Alto Networks List Host Scan Results
description: Returns vulnerability and compliance scan results for all hosts protected by Prisma Cloud Compute Defenders. Includes OS-level vulnerabilities, installed packages, and compliance check results.
tags:
- Hosts
parameters:
- name: offset
in: query
description: Number of records to skip for pagination.
schema:
type: integer
default: 0
example: 0
- name: limit
in: query
description: Maximum number of records to return.
schema:
type: integer
default: 50
example: 50
- name: search
in: query
description: Search term to filter hosts by hostname.
schema:
type: string
example: example-search
- name: sort
in: query
description: Field to sort results by.
schema:
type: string
enum:
- vulnerabilities
- compliance
- scanTime
example: compliance
- name: reverse
in: query
description: Sort in reverse order.
schema:
type: boolean
default: false
example: false
- name: collections
in: query
description: Filter by collection name.
schema:
type: string
example: example-collections
- name: clusters
in: query
description: Filter by cluster name.
schema:
type: string
example: example-clusters
responses:
'200':
description: Host scan results returned successfully.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Host'
examples:
GetHosts200Example:
summary: Default getHosts 200 response
x-microcks-default: true
value:
- _id: '404955'
hostname: host-4848
scanTime: '2024-04-25T22:09:59Z'
osDistro: example-osDistro
osDistroVersion: 6.6.2
kernelVersion: 8.6.6
cloudMetadata:
provider: aws
accountId: '566631'
region: us-east-1
instanceId: '700233'
vulnerabilities:
- id: example-id
status: deferred
cvss: 13.89
severity: critical
packageName: Branch Policy 65
packageVersion: 2.9.1
fixedVersion: 9.6.0
link: https://api.example.com/9c88b4
description: Monitoring blocked suspicious activity malware traffic Security policy rule configured.
publishedDate: '2026-07-04T20:08:13Z'
vulnerabilitiesCount: 315
vulnerabilityDistribution:
critical: 842
high: 259
medium: 307
low: 195
complianceIssues:
- id: 799
title: Staging Gateway 66
severity: low
cause: example-cause
description: Endpoint endpoint blocked monitoring policy alert network traffic network monitoring applied investigation.
complianceIssuesCount: 960
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'500':
$ref
# --- truncated at 32 KB (193 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-hosts-api-openapi.yml