Palo Alto Networks Report API
Operations for generating and retrieving scan job reports for static and dynamic.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-report-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Report API
version: '1.0'
description: 'Operations tagged Report across 3 of this provider''s published API definitions: palo-alto-networks-report-api-openapi.yml, palo-alto-prisma-airs-redteam-data-plane-dp-openapi-openapi.yaml, palo-alto-wildfire-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
- url: https://wildfire.paloaltonetworks.com/publicapi
description: WildFire global cloud (US).
- url: https://wildfire.{region}.paloaltonetworks.com/publicapi
description: WildFire regional cloud endpoint.
variables:
region:
description: Regional deployment (e.g., eu, jp).
default: eu
tags:
- name: Report
description: Retrieve detailed analysis reports and supporting files.
paths:
/get/report:
post:
operationId: getReport
summary: Palo Alto Networks Get Analysis Report
description: Retrieves the full WildFire analysis report for a sample identified by its MD5 or SHA-256 hash. Reports include behavioral analysis, network activity, file system changes, registry modifications, and process information. Reports are available in XML or PDF format.
tags:
- Report
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- apikey
- hash
- format
properties:
apikey:
type: string
description: WildFire API key for authentication.
hash:
type: string
description: MD5 or SHA-256 hash of the analyzed sample.
format:
type: string
enum:
- xml
- pdf
description: Report output format.
type:
type: string
description: Hash type. If omitted, WildFire auto-detects based on hash length.
enum:
- md5
- sha256
examples:
GetReportRequestExample:
summary: Default getReport request
x-microcks-default: true
value:
apikey: example-apikey
hash: example-hash
format: pdf
type: sha256
responses:
'200':
description: Analysis report returned successfully.
content:
application/xml:
schema:
$ref: '#/components/schemas/AnalysisReport'
examples:
GetReport200Example:
summary: Default getReport 200 response
x-microcks-default: true
value:
wildfire:
version: 2.3.1
file_info:
file_stype: standard
size: 531
md5: fe002567a9904394d4ceafd8a4fb3f00
sha256: 59258b8b3904457b736c4ebf1128de54a88068379c519afe5c7cae56cb75cd1e
create_time: '2025-07-04T20:04:29Z'
task_info:
report: example-report
application/pdf:
schema:
type: string
format: binary
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
/get/sample:
post:
operationId: getSample
summary: Palo Alto Networks Download Sample
description: Downloads the original sample file identified by its hash. Only available for samples where the verdict is malware or grayware. Requires an API key with sample download permissions.
tags:
- Report
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- apikey
- hash
properties:
apikey:
type: string
description: WildFire API key with sample download permissions.
hash:
type: string
description: MD5 or SHA-256 hash of the sample to download.
type:
type: string
enum:
- md5
- sha256
examples:
GetSampleRequestExample:
summary: Default getSample request
x-microcks-default: true
value:
apikey: example-apikey
hash: example-hash
type: md5
responses:
'200':
description: Sample file returned successfully.
content:
application/octet-stream:
schema:
type: string
format: binary
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
/get/pcap:
post:
operationId: getPcap
summary: Palo Alto Networks Get PCAP File
description: Downloads the network packet capture (PCAP) file recorded during sandbox analysis of the specified sample. PCAP files contain the network traffic generated by the malware during detonation.
tags:
- Report
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- apikey
- hash
- platform
properties:
apikey:
type: string
description: WildFire API key for authentication.
hash:
type: string
description: MD5 or SHA-256 hash of the analyzed sample.
type:
type: string
enum:
- md5
- sha256
platform:
type: string
description: Analysis platform identifier (e.g., 100 for Windows XP, 200 for Windows 7, 400 for Android).
examples:
GetPcapRequestExample:
summary: Default getPcap request
x-microcks-default: true
value:
apikey: example-apikey
hash: example-hash
type: md5
platform: example-platform
responses:
'200':
description: PCAP file returned successfully.
content:
application/octet-stream:
schema:
type: string
format: binary
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
/v1/report/static/{job_id}/list-attacks:
get:
tags:
- Report
summary: List attacks for a scan
description: List attacks with filtering and pagination.
operationId: list_attacks_v1_report_static__job_id__list_attacks_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: limit
in: query
required: false
schema:
type: integer
maximum: 100
minimum: 1
description: Number of attacks to return (1-100)
default: 50
title: Limit
description: Number of attacks to return (1-100)
- name: skip
in: query
required: false
schema:
type: integer
minimum: 0
description: Number of attacks to skip for pagination
default: 0
title: Skip
description: Number of attacks to skip for pagination
- name: attack_status
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/AttackStatus'
- type: 'null'
description: Filter by attack processing status
title: Attack Status
description: Filter by attack processing status
- name: attack_type
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/AttackType'
- type: 'null'
description: Filter by attack type
title: Attack Type
description: Filter by attack type
- name: category
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/Category'
- type: 'null'
description: Filter by attack category
title: Category
description: Filter by attack category
- name: sub_category
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/SecuritySubCategory'
- $ref: '#/components/schemas/SafetySubCategory'
- $ref: '#/components/schemas/BrandSubCategory'
- type: 'null'
description: Filter by attack subcategory
title: Sub Category
description: Filter by attack subcategory
- name: compliance
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/ComplianceSubCategory'
- type: 'null'
description: Filter by compliance framework
title: Compliance
description: Filter by compliance framework
- name: threat
in: query
required: false
schema:
anyOf:
- type: boolean
- type: 'null'
description: '[Deprecated: use status] Filter by threat status'
title: Threat
description: '[Deprecated: use status] Filter by threat status'
- name: severity
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/SeverityFilter'
- type: 'null'
description: Filter by severity level
title: Severity
description: Filter by severity level
- name: status
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/StatusQueryParam'
- type: 'null'
description: 'Filter by status: SUCCESSFUL, FAILED, ERROR'
title: Status
description: 'Filter by status: SUCCESSFUL, FAILED, ERROR'
- name: attack_modality
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/AttackModality'
- type: 'null'
description: 'Filter by attack modality: FILE (document attacks) or TEXT (text-only)'
title: Attack Modality
description: 'Filter by attack modality: FILE (document attacks) or TEXT (text-only)'
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/AttackListResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/static/{job_id}/attack/{attack_id}:
get:
tags:
- Report
summary: Get attack details
description: Get detailed attack information including outputs and framework techniques.
operationId: get_attack_detail_v1_report_static__job_id__attack__attack_id__get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: attack_id
in: path
required: true
schema:
type: string
format: uuid
title: Attack Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/AttackDetailResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/static/{job_id}/report:
get:
tags:
- Report
summary: Get attack library report
description: Get attack library report for a job. Raises ForbiddenError if report is partially complete and locked.
operationId: get_attack_report_v1_report_static__job_id__report_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/StaticJobReportSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/static/{job_id}/runtime-policy-config:
get:
tags:
- Report
summary: Get attack library runtime security profile
description: Get Runtime security profile for a static job.
operationId: get_static_runtime_security_policy_config_v1_report_static__job_id__runtime_policy_config_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/RuntimeSecurityProfileResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/static/{job_id}/remediation:
get:
tags:
- Report
summary: Get attack library scan remediation
description: Get other remediation measures for a static job.
operationId: get_static_remediations_v1_report_static__job_id__remediation_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/RemediationResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/{job_id}/report:
get:
tags:
- Report
summary: Get agent scan report
description: Get dynamic job report for a job.
operationId: get_dynamic_job_report_v1_report_dynamic__job_id__report_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/DynamicJobReportSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/{job_id}/runtime-policy-config:
get:
tags:
- Report
summary: Get agent scan runtime security profile
description: Get Runtime security profile for a dynamic job.
operationId: get_dynamic_runtime_security_policy_config_v1_report_dynamic__job_id__runtime_policy_config_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/RuntimeSecurityProfileResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/{job_id}/remediation:
get:
tags:
- Report
summary: Get agent scan remediation
description: Get other remediation measures for a dynamic job.
operationId: get_dynamic_remediations_v1_report_dynamic__job_id__remediation_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/RemediationResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/{job_id}/list-goals:
get:
tags:
- Report
summary: List agent scan goals
description: Get the goals for a job.
operationId: list_dynamic_job_goals_v1_report_dynamic__job_id__list_goals_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: skip
in: query
required: false
schema:
type: integer
minimum: 0
description: Number of goals to skip for pagination
default: 0
title: Skip
description: Number of goals to skip for pagination
- name: limit
in: query
required: false
schema:
type: integer
maximum: 100
minimum: 1
description: Number of goals to return (1-100)
default: 20
title: Limit
description: Number of goals to return (1-100)
- name: count
in: query
required: false
schema:
type: boolean
description: Include total count of goals
default: true
title: Count
description: Include total count of goals
- name: status
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/StatusQueryParam'
- type: 'null'
description: Filter by status
title: Status
description: Filter by status
- name: goal_type
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/GoalTypeQueryParam'
- type: 'null'
description: Filter by goal type
title: Goal Type
description: Filter by goal type
- name: search
in: query
required: false
schema:
anyOf:
- type: string
- type: 'null'
description: Search string to filter goals
title: Search
description: Search string to filter goals
- name: goal_category
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/GoalCategory'
- type: 'null'
description: Filter by goal category
title: Goal Category
description: Filter by goal category
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/GoalListResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/{job_id}/goal/{goal_id}/list-streams:
get:
tags:
- Report
summary: List agent scan goal deatils
description: Get streams for a specific goal in a job.
operationId: list_dynamic_job_streams_v1_report_dynamic__job_id__goal__goal_id__list_streams_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: goal_id
in: path
required: true
schema:
type: string
format: uuid
title: Goal Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/StreamListResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/dynamic/stream/{stream_id}:
get:
tags:
- Report
summary: List agent scan stream details
operationId: get_stream_detail_v1_report_dynamic_stream__stream_id__get
parameters:
- name: stream_id
in: path
required: true
schema:
type: string
format: uuid
title: Stream Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/StreamDetailResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
description: Get detailed stream information including iteration data for a specific stream.
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/{job_id}/download:
get:
tags:
- Report
summary: Download report
description: Download report files for a job.
operationId: download_report_v1_report__job_id__download_get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: file_format
in: query
required: true
schema:
$ref: '#/components/schemas/FileFormat'
description: Format of the report file (CSV, JSON, or ALL)
description: Format of the report file (CSV, JSON, or ALL)
responses:
200:
description: Successful Response
content:
application/json:
schema: {}
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/{job_id}/generate-partial-report:
post:
tags:
- Report
summary: Generate partial scan report
description: 'Unlock a partial report by consuming a quota credit. This endpoint: - Validates the job is PARTIALLY_COMPLETE - Consumes 1 quota credit of the job type - Unlocks the report for viewing **Returns:** - Updated job information with unlocked report'
operationId: generate_partial_job_report_v1_report__job_id__generate_partial_report_post
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
responses:
200:
description: Successful Response
content:
application/json:
schema: {}
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
/v1/report/static/{job_id}/attack-multi-turn/{attack_id}:
get:
tags:
- Report
summary: Get multi-turn attack details
description: Get detailed multi-turn attack information including outputs and framework techniques.
operationId: get_attack_multi_turn_detail_v1_report_static__job_id__attack_multi_turn__attack_id__get
parameters:
- name: job_id
in: path
required: true
schema:
type: string
format: uuid
title: Job Id
- name: attack_id
in: path
required: true
schema:
type: string
format: uuid
title: Attack Id
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/AttackMultiTurnDetailResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
security:
- bearerAuth: []
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane
components:
responses:
Forbidden:
description: Valid API key but insufficient permissions for the requested operation (e.g., sample download requires elevated permissions).
content:
application/xml:
schema:
$ref: '#/components/schemas/ErrorResponse'
BadRequest:
description: Malformed request, missing required parameters, or invalid API key format.
content:
application/xml:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Missing API key or API key is invalid.
content:
application/xml:
schema:
$ref: '#/components/schemas/ErrorResponse'
NotFound:
description: No analysis result found for the specified hash.
content:
application/xml:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
AnalysisReport:
type: object
description: Detailed WildFire analysis report including behavioral analysis, network activity, and system changes observed during sandbox execution.
properties:
wildfire:
type: object
properties:
version:
type: string
example: 7.4.8
file_info:
type: object
properties:
file_stype:
type: string
example: standard
size:
type: integer
example: 922
md5:
type: string
example: db68a8bb1f10612a7b71092b35e4a545
sha256:
type: string
example: 51031294c848b48ea0dc621ed7f3a86a61174866d4df7f6f379875b2415e918c
create_time:
type: string
format: date-time
example: '2025-09-02T12:12:51Z'
example:
file_stype: standard
size: 897
md5: cb973a5cae8352a4a0e24ef1084a3b40
sha256: 33e4e05c75f8845fc07508f405087c2628fafecb25faffccdd91728a00239652
create_time: '2024-11-03T13:49:56Z'
task_info:
type: object
properties:
report:
oneOf:
- $ref: '#/components/schemas/SandboxReport'
- type: array
items:
$ref: '#/components/schemas/SandboxReport'
example: example-report
example:
report: example-report
example:
version: 2.3.1
file_info:
file_stype: standard
size: 531
md5: fe002567a9904394d4ceafd8a4fb3f00
sha256: 59258b8b3904457b736c4ebf1128de54a88068379c519afe5c7cae56cb75cd1e
create_time: '2025-07-04T20:04:29Z'
task_info:
report: example-report
ErrorResponse:
type: object
description: Error response returned when a request fails.
properties:
error:
type: object
properties:
error-message:
type: string
description: Human-readable error message.
example: example-error-message
example:
error-message: example-error-message
SandboxReport:
type: object
description: Analysis results from a single sandbox execution environment.
properties:
platform:
type: string
description: Platform identifier (e.g., 100 for Windows XP SP3).
example: example-platform
software:
type: string
description: Sandbox software environment.
example: example-software
version:
type: string
example: 10.9.8
summary:
type: object
properties:
'@verdict':
type: string
enum:
- benign
- malware
- grayware
- phishing
example: grayware
example:
'@verdict': grayware
network:
# --- truncated at 32 KB (97 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-report-api-openapi.yml