The Incidents APIs API from Palo Alto Networks — 2 operation(s) for incidents apis.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-incidents-apis-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Unified Incident Framework Incidents APIs API
version: 3.0.0
description: 'Consolidates security and operational incidents from multiple
PaloAlto Networks products into a unified management interface.'
servers:
- url: https://api.strata.paloaltonetworks.com
description: Production Server
security:
- JWT: []
tags:
- name: Incidents APIs
paths:
/incidents/v1/search:
post:
summary: Incidents List Search
description: Searches network security incidents with advanced filtering and pagination.
operationId: searchIncidents
responses:
'200':
description: List of incidents
content:
application/json:
schema:
type: object
properties:
header:
$ref: '#/components/schemas/SearchResponseHeader'
data:
type: array
items:
type: object
properties:
updated_time:
type: integer
format: int64
example: 1765468859684
severity:
type: string
example: Informational
severity_id:
type: integer
example: 200
status:
type: string
example: Raised
title:
type: string
example: Tenant has 14 raised alerts
priority:
type: string
example: Not Set
priority_id:
type: integer
example: 0
product:
type: string
example: Prisma Access
category:
type: string
example: Network
sub_category:
type: string
example: ''
code:
type: string
example: INC_AOA_TENANT_ALERTS_NOTIFICATION
incident_id:
type: string
example: 21818c4a-8353-4d9c-ae3e-ae90004d4662
raised_time:
type: integer
format: int64
example: 1765468859684
cleared_time:
type: integer
format: int64
example: 1765468859684
release_state:
type: string
example: Released
incident_type:
type: string
example: SOURCE_AGGREGATION_INCIDENT
designation:
type: string
example: root
acknowledged:
type: boolean
example: false
acknowledged_by:
type: string
example: John Doe
primary_impacted_objects:
$ref: '#/components/schemas/ImpactedObjects'
related_impacted_objects:
$ref: '#/components/schemas/ImpactedObjects'
snow_assignee:
type: string
example: ''
snow_priority:
type: string
example: ''
snow_status:
type: string
example: ''
snow_ticket_id:
type: string
example: ''
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
parameters:
- $ref: '#/components/parameters/PrismaTenantHeader'
- $ref: '#/components/parameters/PrismaRegionHeader'
tags:
- Incidents APIs
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
filter:
$ref: '#/components/schemas/FilterObject'
pagination:
$ref: '#/components/schemas/PaginationObject'
examples:
FilterWithPagination:
summary: Filter by Product/Status with Pagination
value:
filter:
rules:
- property: release_state
operator: in
values:
- Released
- property: product
operator: in
values:
- NGFW
- Prisma Access
- Posture
- property: status
operator: in
values:
- Raised
pagination:
page_size: 50
page_number: 1
order_by:
- property: updated_time
order: desc
/incidents/v1/details/{incident-id}:
get:
summary: Incidents Details
description: Retrieves comprehensive information about a specific network security incident.
operationId: getIncidentDetails
responses:
'200':
description: Detailed incident information
content:
application/json:
schema:
type: object
properties:
incident_id:
type: string
example: 21818c4a-8353-4d9c-ae3e-ae90004d4662
title:
type: string
example: Tenant has 14 raised alerts
description:
type: string
example: This alert triggers if the firewall has detected that a dataplane ethernet interface is down.
description_locale_key:
type: string
example: alert.sig_45de40b0_fdbb_4506_900b_033d4551cdde.description
raised_time:
type: integer
format: int64
example: 1765468859684
updated_time:
type: integer
format: int64
example: 1765468859684
resource_keys:
type: string
description: JSON string containing resource identifiers.
example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}'
status:
type: string
example: Raised
remediations:
type: string
description: Stringified JSON object containing remediation steps for the incident.
example: '{"remediations":[{"dynamic_content":{"steps":[{"title":"How to renew a locally generated certificate :","subSteps":[{"title":" ","description":"Select the certificate to be renewed in the following section: Device > Certificate Management > Certificates."}]}]}}]}'
detail:
type: string
description: Stringified JSON array containing detailed alert information.
example: '{"severity":"SEVERITY_S20","concern_level":"CONCERN_LEVEL_RAISED"}'
alerts:
type: array
items:
type: object
properties:
alert_id:
type: string
example: 0a887db4-d760-4dc2-bb14-04c5e120b811
processed_alert_id:
type: string
example: 0a887db4-d760-4dc2-bb14-04c5e120b811
severity:
type: string
example: Critical
state:
type: string
example: Raised
title:
type: string
example: Alert title
updated_time:
type: integer
format: int64
example: 1765468859684
domain:
type: string
example: External
inc_prop:
type: integer
example: 0
ctx_only_alert:
type: boolean
example: false
code:
type: string
example: AL_AOA_TENANT_ALERTS_NOTIFICATION
resource_keys:
type: string
description: JSON string containing resource identifiers.
example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}'
release_state:
type: string
example: Released
incident_type:
type: string
example: SOURCE_AGGREGATION_INCIDENT
incident_code:
type: string
example: INC_AOA_TENANT_ALERTS_NOTIFICATION
incident_settings_id:
type: string
example: INC_AOA_TENANT_ALERTS_NOTIFICATION
severity_id:
type: integer
example: 200
severity:
type: string
example: Informational
priority:
type: string
example: Not Set
release_state:
type: string
example: Released
product:
type: string
example: Prisma Access
resource_context:
type: string
description: Stringified JSON object containing contextual resource information for the incident.
example: '{"cluster_id":100251836,"site_name":"SC-Brazil"}'
category:
type: string
example: Network and Traffic
sub_category:
type: string
example: Interface
designation:
type: string
example: root
acknowledged:
type: boolean
example: false
acknowledged_by:
type: string
example: John Doe
snow_assignee:
type: string
example: ''
snow_priority:
type: string
example: ''
snow_status:
type: string
example: ''
snow_ticket_id:
type: string
example: ''
primary_impacted_objects:
$ref: '#/components/schemas/ImpactedObjects'
related_impacted_objects:
$ref: '#/components/schemas/ImpactedObjects'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
parameters:
- $ref: '#/components/parameters/PrismaTenantHeader'
- $ref: '#/components/parameters/PrismaRegionHeader'
- name: incident-id
in: path
required: true
description: The unique identifier of the incident.
schema:
type: string
tags:
- Incidents APIs
components:
schemas:
FieldListItem:
type: object
properties:
property:
type: string
example: updated_time
alias:
type: string
example: updated_time
dataType:
type: string
example: timestamp
dataClass:
type: string
example: timestamp
sequence:
type: string
example: '1'
type:
type: string
example: timestamp
SearchResponseHeader:
type: object
properties:
createdAt:
type: string
format: date-time
example: '2026-03-12T19:38:43Z'
dataCount:
type: integer
example: 50
requestId:
type: string
example: af683747-79af-46bb-b2f1-54d050c4eaab
queryInput:
type: object
properties:
time_range:
type: string
example: last 180 day(s)
event_time:
type: object
properties:
from:
type: string
format: date-time
example: '2025-09-13T00:00:00Z'
to:
type: string
format: date-time
example: '2026-03-12T19:37:59Z'
from_epoch:
type: integer
format: int64
example: 1757721600000
to_epoch:
type: integer
format: int64
example: 1773344279000
isResourceDataOverridden:
type: boolean
example: false
fieldList:
type: array
items:
$ref: '#/components/schemas/FieldListItem'
status:
type: object
properties:
subCode:
type: integer
example: 200
pagination:
type: object
properties:
current_page:
type: integer
example: 1
order_by:
type: array
items:
type: object
properties:
property:
type: string
example: updated_time
order:
type: string
enum:
- asc
- desc
next_page:
type: integer
example: 2
page_count:
type: integer
example: 7
total_count:
type: integer
example: 318
page_size:
type: integer
example: 50
name:
type: string
example: netsec/incidents/incidents_list
cache_operation:
type: string
example: IGNORED
PaginationObject:
type: object
properties:
page_size:
type: integer
example: 25
page_number:
type: integer
example: 1
order_by:
type: array
items:
type: object
properties:
property:
type: string
example: updated_time
order:
type: string
example: desc
enum:
- asc
- desc
ImpactedObjects:
type: object
properties:
agent_ids:
type: array
example: []
items:
type: string
aggr_locations:
type: array
example: []
items:
type: string
app_names:
type: array
example: []
items:
type: string
asn_org_names:
type: array
example: []
items:
type: string
auth_server_profiles:
type: array
example: []
items:
type: string
auth_servers:
type: array
example: []
items:
type: string
bgp_peer_names:
type: array
example: []
items:
type: string
certificate_names:
type: array
example: []
items:
type: string
cluster_names:
type: array
example: []
items:
type: string
cves:
type: array
example: []
items:
type: string
device_ids:
type: array
example: []
items:
type: string
directory_ids:
type: array
example: []
items:
type: string
dns_servers:
type: array
example: []
items:
type: string
gp_versions:
type: array
example: []
items:
type: string
gre_tunnel_names:
type: array
example: []
items:
type: string
host_names:
type: array
example: []
items:
type: string
ike_gateway_names:
type: array
example: []
items:
type: string
interfaces:
type: array
example: []
items:
type: string
licenses:
type: array
example: []
items:
type: string
link_names:
type: array
example: []
items:
type: string
locations:
type: array
example: []
items:
type: string
log_receivers:
type: array
example: []
items:
type: string
nat_policies:
type: array
example: []
items:
type: string
packages:
type: array
example: []
items:
type: string
roles:
type: array
example: []
items:
type: string
security_checks:
type: array
example: []
items:
type: string
security_objects:
type: array
example: []
items:
type: string
security_types:
type: array
example: []
items:
type: string
sha256s:
type: array
example: []
items:
type: string
site_names:
type: array
example: []
items:
type: string
slots:
type: array
example: []
items:
type: string
spn_names:
type: array
example: []
items:
type: string
theaters:
type: array
example: []
items:
type: string
tunnel_names:
type: array
example: []
items:
type: string
user_locations:
type: array
example: []
items:
type: string
zones:
type: array
example: []
items:
type: string
FilterRule:
type: object
properties:
property:
type: string
example: status
operator:
type: string
example: in
values:
type: array
items:
type: string
example:
- Raised
FilterObject:
type: object
properties:
rules:
type: array
items:
$ref: '#/components/schemas/FilterRule'
ErrorResponse:
type: object
properties:
errorCode:
type: string
example: REST10001
message:
type: string
example: Unexpected server error
details:
type: string
example: Failed to process request
parameters:
PrismaTenantHeader:
in: header
name: prisma-tenant
description: The tenant and sub-tenant ID identifier (e.g., tenant_id:sub_tenant_id).
required: false
schema:
type: string
PrismaRegionHeader:
in: header
name: X-PANW-Region
description: The region for request(e.g., americas, europe, uk, au etc).
required: true
schema:
type: string
securitySchemes:
JWT:
type: http
description: JWT authentication with bearer token
scheme: bearer
bearerFormat: Bearer [token]