Palo Alto Networks

Palo Alto Networks Scripts API

Script execution and results retrieval.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /scripts/run_script Run a library script on endpoints · Palo Alto Networks Execute Script on Endpoints #
Ask an LLM
“Can I run a remediation script on several endpoints at once?”
“How do I collect forensic data from an endpoint with a script from the library?”
Tell an agent
Run the library script described in {request_data} on the target endpoints.
Execute a script on endpoints with request {request_data} and return the action ID.
POST /scripts/get_script_execution_results Get results of a script run · Palo Alto Networks Get Script Execution Results #
Ask an LLM
“What output did my script produce on each endpoint?”
“Can I fetch script results using the action ID from the run?”
Tell an agent
Get the script execution results for request {request_data}.
Show output of the script run identified in {request_data}.

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-scripts-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-scripts-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-scripts-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Cortex XDR REST Scripts API
  description: REST API for the Cortex XDR extended detection and response platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/cortex/docs/xdr/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api-{fqdn}/public_api/v1
  description: Cortex XDR tenant API endpoint.
  variables:
    fqdn:
      description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
      default: example.xdr.us.paloaltonetworks.com
security:
- xdrAuth: []
tags:
- name: Scripts
  description: Script execution and results retrieval.
paths:
  /scripts/run_script:
    post:
      operationId: runScript
      summary: Palo Alto Networks Execute Script on Endpoints
      description: Executes a script from the script library on one or more endpoints. Scripts can perform remediation actions, collect forensic data, or run custom commands. Returns an action ID for polling execution status.
      tags:
      - Scripts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - script_uid
                  properties:
                    script_uid:
                      type: string
                      description: Unique identifier of the script from the script library.
                    endpoint_ids:
                      type: array
                      items:
                        type: string
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    parameters_values:
                      type: object
                      description: Script parameter key-value pairs.
                      additionalProperties: true
                    timeout:
                      type: integer
                      description: Script execution timeout in seconds.
                      default: 600
            examples:
              RunScriptRequestExample:
                summary: Default runScript request
                x-microcks-default: true
                value:
                  request_data:
                    script_uid: '595817'
                    endpoint_ids:
                    - '221362'
                    - '707960'
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    - field: example-field
                      operator: lte
                      value: example-value
                    parameters_values: {}
                    timeout: 600
      responses:
        '200':
          description: Script execution initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      action_id:
                        type: string
                        description: Action ID to poll for script execution results.
              examples:
                RunScript200Example:
                  summary: Default runScript 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      action_id: '583622'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /scripts/get_script_execution_results:
    post:
      operationId: getScriptExecutionResults
      summary: Palo Alto Networks Get Script Execution Results
      description: Retrieves the execution results and output for a previously initiated script run identified by the action ID.
      tags:
      - Scripts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - action_id
                  properties:
                    action_id:
                      type: string
                      description: Action ID returned by the run_script endpoint.
            examples:
              GetScriptExecutionResultsRequestExample:
                summary: Default getScriptExecutionResults request
                x-microcks-default: true
                value:
                  request_data:
                    action_id: '766787'
      responses:
        '200':
          description: Script execution results returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      action_id:
                        type: string
                      status:
                        type: string
                        enum:
                        - PENDING
                        - IN_PROGRESS
                        - COMPLETED_SUCCESSFULLY
                        - FAILED
                        - TIMEOUT
                        - CANCELED
                      results:
                        type: array
                        items:
                          type: object
                          properties:
                            endpoint_id:
                              type: string
                            endpoint_name:
                              type: string
                            endpoint_status:
                              type: string
                            domain:
                              type: string
                            ip_address:
                              type: string
                            is_isolated:
                              type: string
                            standard_output:
                              type: string
                            standard_error:
                              type: string
                            retrieved_files:
                              type: integer
                            return_value:
                              type: integer
              examples:
                GetScriptExecutionResults200Example:
                  summary: Default getScriptExecutionResults 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      action_id: '941630'
                      status: TIMEOUT
                      results:
                      - endpoint_id: '625820'
                        endpoint_name: Branch Sensor 63
                        endpoint_status: running
                        domain: portal.test-corp.net
                        ip_address: 10.32.174.246
                        is_isolated: example-is_isolated
                        standard_output: example-standard_output
                        standard_error: example-standard_error
                        retrieved_files: 667
                        return_value: 543
                      - endpoint_id: '670746'
                        endpoint_name: Production Gateway 55
                        endpoint_status: running
                        domain: mail.acme-systems.org
                        ip_address: 10.171.214.174
                        is_isolated: example-is_isolated
                        standard_output: example-standard_output
                        standard_error: example-standard_error
                        retrieved_files: 653
                        return_value: 89
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Filter:
      type: object
      description: A filter criterion for querying XDR resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on (e.g., incident_id, status, severity).
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          description: Comparison operator.
          example: lte
        value:
          description: Filter value. Use an array for the "in" operator, a string or integer for others.
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 782
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 270
            err_msg: example-err_msg
            err_extra: example-err_extra
  securitySchemes:
    xdrAuth:
      type: apiKey
      in: header
      name: x-xdr-hmac-v2
      description: 'Cortex XDR uses a custom HMAC-SHA256 authentication scheme. Each request requires four headers: x-xdr-auth-id (API key ID), x-xdr-nonce (64-character random string), x-xdr-timestamp (Unix epoch milliseconds), and x-xdr-hmac-v2 (SHA-256 hash of apikey + nonce + timestamp). Generate API keys from Cortex XDR Settings > Configurations > API Keys.'