Palo Alto Networks Incidents by Severity API

openapi: 3.2.0
info:
  title: SASE 5G Monitor Service Incidents by Severity API
  version: '1.0'
  description: "The SASE 5G Monitoring Service provides real-time visibility and technical telemetry \nfor enterprise 5G infrastructure within the Strata Cloud Manager (SCM) ecosystem. \nTechnical leads and network analysts utilize these APIs to track subscriber scaling, \nmonitor regional registration trends, and audit network throughput performance.\n\nBy leveraging these endpoints, organizations maintain a continuous feedback loop on \nUser Equipment (UE) activity and regional interconnect health. The service enables \nproactive troubleshooting through incident severity tracking and API performance \nmonitoring, ensuring that global 5G connectivity meets strict service level objectives \nwhile identifying unauthorized traffic or signaling gaps. This spec was created on February 13, 2026. © 2026 Palo Alto Networks, Inc."
servers:
- url: https://stratacloudmanager.paloaltonetworks.com
security:
- BearerAuth: []
tags:
- name: Incidents by Severity
paths:
  /mt/monitor/5g/incidents/count:
    post:
      tags:
      - Incidents by Severity
      summary: Get Incidents By Severity
      description: Returns the count of incidents based on severity levels.
      parameters:
      - name: agg_by
        in: query
        schema:
          type: string
          enum:
          - tenant
        description: Aggregation parameter
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentsCountRequest'
            example:
              properties:
              - property: total_count
              - property: critical_count
              - property: warning_count
              filter:
                rules:
                - property: raised_time
                  operator: last_n_days
                  values:
                  - 7
                - property: status
                  operator: equals
                  values:
                  - Raised
                - property: severity
                  operator: in
                  values:
                  - Critical
                  - Warning
                - property: domain
                  operator: in
                  values:
                  - External
                  - external
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
                data:
                - total_count: 680
                  critical_count: 340
                  warning_count: 0
        '400':
          description: Bad Request
        '401':
          description: Permission Denied
        '500':
          description: Server Error
      operationId: PostMtMonitor5gIncidentsCount
components:
  schemas:
    IncidentsCountRequest:
      type: object
      properties:
        properties:
          type: array
          items:
            type: object
            properties:
              property:
                type: string
        filter:
          type: object
          properties:
            rules:
              type: array
              items:
                type: object
                properties:
                  property:
                    type: string
                  operator:
                    type: string
                  values:
                    type: array
                    items: {}