Palo Alto Networks Incidents APIs API

openapi: 3.2.0
info:
  title: Unified Incident Framework Incidents APIs API
  version: 3.0.0
  description: "Consolidates security and operational incidents from multiple \nPaloAlto Networks products into a unified management interface. Provides read-only\naccess to search, filter, and analyze incident data across the Strata Cloud\nManager ecosystem. This Open API spec file was created on March 30, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies."
servers:
- url: https://api.strata.paloaltonetworks.com
  description: Production Server
security:
- JWT: []
tags:
- name: Incidents APIs
paths:
  /incidents/v1/search:
    post:
      summary: Incidents List Search
      description: Searches network security incidents with advanced filtering and pagination.
      operationId: searchIncidents
      responses:
        '200':
          description: List of incidents
          content:
            application/json:
              schema:
                type: object
                properties:
                  header:
                    $ref: '#/components/schemas/SearchResponseHeader'
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        updated_time:
                          type: integer
                          format: int64
                          example: 1765468859684
                        severity:
                          type: string
                          example: Informational
                        severity_id:
                          type: integer
                          example: 200
                        status:
                          type: string
                          example: Raised
                        title:
                          type: string
                          example: Tenant has 14 raised alerts
                        priority:
                          type: string
                          example: Not Set
                        priority_id:
                          type: integer
                          example: 0
                        product:
                          type: string
                          example: Prisma Access
                        category:
                          type: string
                          example: Network
                        sub_category:
                          type: string
                          example: ''
                        code:
                          type: string
                          example: INC_AOA_TENANT_ALERTS_NOTIFICATION
                        incident_id:
                          type: string
                          example: 21818c4a-8353-4d9c-ae3e-ae90004d4662
                        raised_time:
                          type: integer
                          format: int64
                          example: 1765468859684
                        cleared_time:
                          type: integer
                          format: int64
                          example: 1765468859684
                        release_state:
                          type: string
                          example: Released
                        incident_type:
                          type: string
                          example: SOURCE_AGGREGATION_INCIDENT
                        designation:
                          type: string
                          example: root
                        acknowledged:
                          type: boolean
                          example: false
                        acknowledged_by:
                          type: string
                          example: John Doe
                        primary_impacted_objects:
                          $ref: '#/components/schemas/ImpactedObjects'
                        related_impacted_objects:
                          $ref: '#/components/schemas/ImpactedObjects'
                        snow_assignee:
                          type: string
                          example: ''
                        snow_priority:
                          type: string
                          example: ''
                        snow_status:
                          type: string
                          example: ''
                        snow_ticket_id:
                          type: string
                          example: ''
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - $ref: '#/components/parameters/PrismaTenantHeader'
      - $ref: '#/components/parameters/PrismaRegionHeader'
      tags:
      - Incidents APIs
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                filter:
                  $ref: '#/components/schemas/FilterObject'
                pagination:
                  $ref: '#/components/schemas/PaginationObject'
            examples:
              FilterWithPagination:
                summary: Filter by Product/Status with Pagination
                value:
                  filter:
                    rules:
                    - property: release_state
                      operator: in
                      values:
                      - Released
                    - property: product
                      operator: in
                      values:
                      - NGFW
                      - Prisma Access
                      - Posture
                    - property: status
                      operator: in
                      values:
                      - Raised
                  pagination:
                    page_size: 50
                    page_number: 1
                    order_by:
                    - property: updated_time
                      order: desc
  /incidents/v1/details/{incident-id}:
    get:
      summary: Incidents Details
      description: Retrieves comprehensive information about a specific network security incident.
      operationId: getIncidentDetails
      responses:
        '200':
          description: Detailed incident information
          content:
            application/json:
              schema:
                type: object
                properties:
                  incident_id:
                    type: string
                    example: 21818c4a-8353-4d9c-ae3e-ae90004d4662
                  title:
                    type: string
                    example: Tenant has 14 raised alerts
                  description:
                    type: string
                    example: This alert triggers if the firewall has detected that a dataplane ethernet interface is down.
                  description_locale_key:
                    type: string
                    example: alert.sig_45de40b0_fdbb_4506_900b_033d4551cdde.description
                  raised_time:
                    type: integer
                    format: int64
                    example: 1765468859684
                  updated_time:
                    type: integer
                    format: int64
                    example: 1765468859684
                  resource_keys:
                    type: string
                    description: JSON string containing resource identifiers.
                    example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}'
                  status:
                    type: string
                    example: Raised
                  remediations:
                    type: string
                    description: Stringified JSON object containing remediation steps for the incident.
                    example: '{"remediations":[{"dynamic_content":{"steps":[{"title":"How to renew a locally generated certificate :","subSteps":[{"title":" ","description":"Select the certificate to be renewed in the following section: Device > Certificate Management > Certificates."}]}]}}]}'
                  detail:
                    type: string
                    description: Stringified JSON array containing detailed alert information.
                    example: '{"severity":"SEVERITY_S20","concern_level":"CONCERN_LEVEL_RAISED"}'
                  alerts:
                    type: array
                    items:
                      type: object
                      properties:
                        alert_id:
                          type: string
                          example: 0a887db4-d760-4dc2-bb14-04c5e120b811
                        processed_alert_id:
                          type: string
                          example: 0a887db4-d760-4dc2-bb14-04c5e120b811
                        severity:
                          type: string
                          example: Critical
                        state:
                          type: string
                          example: Raised
                        title:
                          type: string
                          example: Alert title
                        updated_time:
                          type: integer
                          format: int64
                          example: 1765468859684
                        domain:
                          type: string
                          example: External
                        inc_prop:
                          type: integer
                          example: 0
                        ctx_only_alert:
                          type: boolean
                          example: false
                        code:
                          type: string
                          example: AL_AOA_TENANT_ALERTS_NOTIFICATION
                        resource_keys:
                          type: string
                          description: JSON string containing resource identifiers.
                          example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}'
                        release_state:
                          type: string
                          example: Released
                  incident_type:
                    type: string
                    example: SOURCE_AGGREGATION_INCIDENT
                  incident_code:
                    type: string
                    example: INC_AOA_TENANT_ALERTS_NOTIFICATION
                  incident_settings_id:
                    type: string
                    example: INC_AOA_TENANT_ALERTS_NOTIFICATION
                  severity_id:
                    type: integer
                    example: 200
                  severity:
                    type: string
                    example: Informational
                  priority:
                    type: string
                    example: Not Set
                  release_state:
                    type: string
                    example: Released
                  product:
                    type: string
                    example: Prisma Access
                  resource_context:
                    type: string
                    description: Stringified JSON object containing contextual resource information for the incident.
                    example: '{"cluster_id":100251836,"site_name":"SC-Brazil"}'
                  category:
                    type: string
                    example: Network and Traffic
                  sub_category:
                    type: string
                    example: Interface
                  designation:
                    type: string
                    example: root
                  acknowledged:
                    type: boolean
                    example: false
                  acknowledged_by:
                    type: string
                    example: John Doe
                  snow_assignee:
                    type: string
                    example: ''
                  snow_priority:
                    type: string
                    example: ''
                  snow_status:
                    type: string
                    example: ''
                  snow_ticket_id:
                    type: string
                    example: ''
                  primary_impacted_objects:
                    $ref: '#/components/schemas/ImpactedObjects'
                  related_impacted_objects:
                    $ref: '#/components/schemas/ImpactedObjects'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters:
      - $ref: '#/components/parameters/PrismaTenantHeader'
      - $ref: '#/components/parameters/PrismaRegionHeader'
      - name: incident-id
        in: path
        required: true
        description: The unique identifier of the incident.
        schema:
          type: string
      tags:
      - Incidents APIs
components:
  schemas:
    FilterObject:
      type: object
      properties:
        rules:
          type: array
          items:
            $ref: '#/components/schemas/FilterRule'
    ImpactedObjects:
      type: object
      properties:
        agent_ids:
          type: array
          example: []
          items:
            type: string
        aggr_locations:
          type: array
          example: []
          items:
            type: string
        app_names:
          type: array
          example: []
          items:
            type: string
        asn_org_names:
          type: array
          example: []
          items:
            type: string
        auth_server_profiles:
          type: array
          example: []
          items:
            type: string
        auth_servers:
          type: array
          example: []
          items:
            type: string
        bgp_peer_names:
          type: array
          example: []
          items:
            type: string
        certificate_names:
          type: array
          example: []
          items:
            type: string
        cluster_names:
          type: array
          example: []
          items:
            type: string
        cves:
          type: array
          example: []
          items:
            type: string
        device_ids:
          type: array
          example: []
          items:
            type: string
        directory_ids:
          type: array
          example: []
          items:
            type: string
        dns_servers:
          type: array
          example: []
          items:
            type: string
        gp_versions:
          type: array
          example: []
          items:
            type: string
        gre_tunnel_names:
          type: array
          example: []
          items:
            type: string
        host_names:
          type: array
          example: []
          items:
            type: string
        ike_gateway_names:
          type: array
          example: []
          items:
            type: string
        interfaces:
          type: array
          example: []
          items:
            type: string
        licenses:
          type: array
          example: []
          items:
            type: string
        link_names:
          type: array
          example: []
          items:
            type: string
        locations:
          type: array
          example: []
          items:
            type: string
        log_receivers:
          type: array
          example: []
          items:
            type: string
        nat_policies:
          type: array
          example: []
          items:
            type: string
        packages:
          type: array
          example: []
          items:
            type: string
        roles:
          type: array
          example: []
          items:
            type: string
        security_checks:
          type: array
          example: []
          items:
            type: string
        security_objects:
          type: array
          example: []
          items:
            type: string
        security_types:
          type: array
          example: []
          items:
            type: string
        sha256s:
          type: array
          example: []
          items:
            type: string
        site_names:
          type: array
          example: []
          items:
            type: string
        slots:
          type: array
          example: []
          items:
            type: string
        spn_names:
          type: array
          example: []
          items:
            type: string
        theaters:
          type: array
          example: []
          items:
            type: string
        tunnel_names:
          type: array
          example: []
          items:
            type: string
        user_locations:
          type: array
          example: []
          items:
            type: string
        zones:
          type: array
          example: []
          items:
            type: string
    PaginationObject:
      type: object
      properties:
        page_size:
          type: integer
          example: 25
        page_number:
          type: integer
          example: 1
        order_by:
          type: array
          items:
            type: object
            properties:
              property:
                type: string
                example: updated_time
              order:
                type: string
                example: desc
                enum:
                - asc
                - desc
    ErrorResponse:
      type: object
      properties:
        errorCode:
          type: string
          example: REST10001
        message:
          type: string
          example: Unexpected server error
        details:
          type: string
          example: Failed to process request
    FieldListItem:
      type: object
      properties:
        property:
          type: string
          example: updated_time
        alias:
          type: string
          example: updated_time
        dataType:
          type: string
          example: timestamp
        dataClass:
          type: string
          example: timestamp
        sequence:
          type: string
          example: '1'
        type:
          type: string
          example: timestamp
    FilterRule:
      type: object
      properties:
        property:
          type: string
          example: status
        operator:
          type: string
          example: in
        values:
          type: array
          items:
            type: string
          example:
          - Raised
    SearchResponseHeader:
      type: object
      properties:
        createdAt:
          type: string
          format: date-time
          example: '2026-03-12T19:38:43Z'
        dataCount:
          type: integer
          example: 50
        requestId:
          type: string
          example: af683747-79af-46bb-b2f1-54d050c4eaab
        queryInput:
          type: object
          properties:
            time_range:
              type: string
              example: last 180 day(s)
            event_time:
              type: object
              properties:
                from:
                  type: string
                  format: date-time
                  example: '2025-09-13T00:00:00Z'
                to:
                  type: string
                  format: date-time
                  example: '2026-03-12T19:37:59Z'
                from_epoch:
                  type: integer
                  format: int64
                  example: 1757721600000
                to_epoch:
                  type: integer
                  format: int64
                  example: 1773344279000
        isResourceDataOverridden:
          type: boolean
          example: false
        fieldList:
          type: array
          items:
            $ref: '#/components/schemas/FieldListItem'
        status:
          type: object
          properties:
            subCode:
              type: integer
              example: 200
        pagination:
          type: object
          properties:
            current_page:
              type: integer
              example: 1
            order_by:
              type: array
              items:
                type: object
                properties:
                  property:
                    type: string
                    example: updated_time
                  order:
                    type: string
                    enum:
                    - asc
                    - desc
            next_page:
              type: integer
              example: 2
            page_count:
              type: integer
              example: 7
            total_count:
              type: integer
              example: 318
            page_size:
              type: integer
              example: 50
        name:
          type: string
          example: netsec/incidents/incidents_list
        cache_operation:
          type: string
          example: IGNORED
  parameters:
    PrismaRegionHeader:
      in: header
      name: X-PANW-Region
      description: The region for request(e.g., americas, europe, uk, au etc).
      required: true
      schema:
        type: string
    PrismaTenantHeader:
      in: header
      name: prisma-tenant
      description: The tenant and sub-tenant ID identifier (e.g., tenant_id:sub_tenant_id).
      required: false
      schema:
        type: string
  securitySchemes:
    JWT:
      type: http
      description: JWT authentication with bearer token
      scheme: bearer
      bearerFormat: Bearer [token]