Palo Alto Networks

Palo Alto Networks Investigations API

Investigation management.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /investigations/{id} Get an investigation's details · Palo Alto Networks Get Investigation #
Ask an LLM
“What's in the war room and playbook status of a specific investigation?”
“Which incidents are linked to an investigation?”
Tell an agent
Get investigation {id} with its war room entries.
Show the playbook status for investigation {id}.
POST /investigation/add Start an investigation on an incident · Palo Alto Networks Create Investigation #
Ask an LLM
“How do I open a new investigation on an existing incident?”
“Can one incident have more than one investigation?”
Tell an agent
Create an investigation for incident {incidentId}.
Start investigation {name} on incident {incidentId}.

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-investigations-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-investigations-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-investigations-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Cortex XSOAR REST Investigations API
  description: REST API for the Cortex XSOAR (formerly Demisto) security orchestration, automation, and response (SOAR) platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/cortex/docs/xsoar/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://{xsoar-server}
  description: Cortex XSOAR server endpoint.
  variables:
    xsoar-server:
      description: Hostname or IP address of the Cortex XSOAR server.
      default: xsoar.example.com
security:
- apiKey: []
tags:
- name: Investigations
  description: Investigation management.
paths:
  /investigations/{id}:
    get:
      operationId: getInvestigation
      summary: Palo Alto Networks Get Investigation
      description: Returns the full details of an investigation including all war room entries, playbook status, and associated incidents.
      tags:
      - Investigations
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the investigation.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Investigation returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Investigation'
              examples:
                GetInvestigation200Example:
                  summary: Default getInvestigation 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Agent 49
                    status: 611
                    incidentId: '613705'
                    created: '2025-05-10T09:56:48Z'
                    modified: '2026-07-27T07:59:00Z'
                    entries:
                    - id: example-id
                      investigationId: '215099'
                      type: 140
                      user: example-user
                      created: '2024-07-22T09:20:31Z'
                      modified: '2025-02-16T15:12:04Z'
                      contents: example-contents
                      humanReadable: example-humanReadable
                      tags:
                      - production
                      - pci-scope
                    playbookId: '207029'
                    runningPlaybooks:
                    - example-runningPlaybooks_item
                    - example-runningPlaybooks_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /investigation/add:
    post:
      operationId: createInvestigation
      summary: Palo Alto Networks Create Investigation
      description: Creates a new investigation attached to an existing incident. Multiple investigations can be created for a single incident to track separate analytical threads.
      tags:
      - Investigations
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - incidentId
              properties:
                incidentId:
                  type: string
                  description: ID of the incident to attach the investigation to.
                name:
                  type: string
                  description: Optional name for the investigation.
            examples:
              CreateInvestigationRequestExample:
                summary: Default createInvestigation request
                x-microcks-default: true
                value:
                  incidentId: '974282'
                  name: Primary Gateway 48
      responses:
        '200':
          description: Investigation created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Investigation'
              examples:
                CreateInvestigation200Example:
                  summary: Default createInvestigation 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Agent 49
                    status: 611
                    incidentId: '613705'
                    created: '2025-05-10T09:56:48Z'
                    modified: '2026-07-27T07:59:00Z'
                    entries:
                    - id: example-id
                      investigationId: '215099'
                      type: 140
                      user: example-user
                      created: '2024-07-22T09:20:31Z'
                      modified: '2025-02-16T15:12:04Z'
                      contents: example-contents
                      humanReadable: example-humanReadable
                      tags:
                      - production
                      - pci-scope
                    playbookId: '207029'
                    runningPlaybooks:
                    - example-runningPlaybooks_item
                    - example-runningPlaybooks_item
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Entry:
      type: object
      description: A war room entry in a Cortex XSOAR investigation.
      properties:
        id:
          type: string
          readOnly: true
          example: example-id
        investigationId:
          type: string
          example: '215099'
        type:
          type: integer
          description: 'Entry type: 1 (Note), 2 (Download), 3 (File), 4 (Error), 5 (Pinned), 6 (UserManagement), 7 (Image), 8 (PlaygroundCommand), 9 (PlaybookStatusNote), 10 (Canvas), 11 (Widget), 12 (Summary), 13 (Section), 14 (Table).'
          example: 140
        user:
          type: string
          description: Username of the user who created the entry.
          example: example-user
        created:
          type: string
          format: date-time
          example: '2024-07-22T09:20:31Z'
        modified:
          type: string
          format: date-time
          example: '2025-02-16T15:12:04Z'
        contents:
          type: string
          description: Entry content text.
          example: example-contents
        humanReadable:
          type: string
          description: Human-readable formatted content.
          example: example-humanReadable
        tags:
          type: array
          items:
            type: string
          example:
          - production
          - pci-scope
    Investigation:
      type: object
      description: A Cortex XSOAR investigation containing war room entries and playbook state.
      properties:
        id:
          type: string
          readOnly: true
          example: example-id
        name:
          type: string
          example: Corporate Agent 49
        status:
          type: integer
          example: 611
        incidentId:
          type: string
          example: '613705'
        created:
          type: string
          format: date-time
          example: '2025-05-10T09:56:48Z'
        modified:
          type: string
          format: date-time
          example: '2026-07-27T07:59:00Z'
        entries:
          type: array
          items:
            $ref: '#/components/schemas/Entry'
          example:
          - id: example-id
            investigationId: '215099'
            type: 140
            user: example-user
            created: '2024-07-22T09:20:31Z'
            modified: '2025-02-16T15:12:04Z'
            contents: example-contents
            humanReadable: example-humanReadable
            tags:
            - production
            - pci-scope
        playbookId:
          type: string
          example: '207029'
        runningPlaybooks:
          type: array
          items:
            type: string
          example:
          - example-runningPlaybooks_item
          - example-runningPlaybooks_item
    ErrorResponse:
      type: object
      properties:
        id:
          type: string
          example: example-id
        status:
          type: integer
          example: 19
        title:
          type: string
          example: Corporate Gateway 74
        detail:
          type: string
          example: example-detail
        error:
          type: string
          example: example-error
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: Authorization
      description: Cortex XSOAR API key. Generate from Settings > Integrations > API Keys in the XSOAR console. Pass the key directly as the Authorization header value (no Bearer prefix required for standard API keys).