Palo Alto Networks

Palo Alto Networks Statistics API

Network access and DNS query statistics.

GitHub OpenAPI

Operations 1

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /stats/network Get DNS and network access statistics · Palo Alto Networks Get Network Access Statistics #
Ask an LLM
“How many DNS queries did a customer environment make over a time window?”
“Can I get network access statistics for a single domain?”
Tell an agent
Get network stats for customer {customerid} from {stime} to {etime}.
Show DNS stats for {domain} for customer {customerid} between {stime} and {etime}.

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-statistics-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-statistics-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-statistics-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks DNS Security Statistics API
  description: REST API for querying DNS domain categorization and threat intelligence from Palo Alto Networks DNS Security cloud service. Beta release. Provides domain category lookups, risk level assessments, DNS security category verdicts, and network access statistics. Enables security teams to investigate suspicious domains, enrich security events with DNS threat intelligence, and automate domain-based threat hunting workflows. Requires an active DNS Security subscription.
  version: 1.0-beta
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.dns.service.paloaltonetworks.com/v1
  description: DNS Security API production server.
security:
- dnsApiKey: []
tags:
- name: Statistics
  description: Network access and DNS query statistics.
paths:
  /stats/network:
    get:
      operationId: getNetworkStats
      summary: Palo Alto Networks Get Network Access Statistics
      description: Returns DNS query and network access statistics for a customer's environment within a specified time range. Supports filtering by domain to return per-domain statistics. Useful for monitoring DNS query volumes, identifying anomalous lookup patterns, and generating compliance reports on DNS Security policy enforcement activity.
      tags:
      - Statistics
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer ID for which to return network statistics.
        schema:
          type: string
        example: '509945'
      - name: domain
        in: query
        required: false
        description: Filter statistics to a specific domain. When omitted, aggregate statistics for all domains are returned.
        schema:
          type: string
        example: api.test-corp.net
      - name: stime
        in: query
        required: true
        description: Start time for the statistics period in ISO 8601 format or Unix epoch seconds.
        schema:
          type: string
        example: example-stime
      - name: etime
        in: query
        required: true
        description: End time for the statistics period in ISO 8601 format or Unix epoch seconds.
        schema:
          type: string
        example: example-etime
      responses:
        '200':
          description: Network access statistics returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkStats'
              examples:
                GetNetworkStats200Example:
                  summary: Default getNetworkStats 200 response
                  x-microcks-default: true
                  value:
                    customerid: '251301'
                    period:
                      start: example-start
                      end: example-end
                    total_queries: 301
                    blocked_queries: 169
                    allowed_queries: 331
                    sinkholed_queries: 260
                    top_queried_domains:
                    - domain: vpn.acme-systems.org
                      query_count: 57
                      dns_security_category: advanced
                    category_breakdown:
                    - category: custom
                      count: 310
                      percentage: 40.54
        '400':
          description: Invalid query parameters or time range.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetNetworkStats400Example:
                  summary: Default getNetworkStats 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security monitoring rule detected on threat network suspicious.
                    request_id: 583d1742-dcda-461e-a765-4a0c8e530ab5
        '401':
          description: Invalid or missing X-DNS-API-APIKEY header.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetNetworkStats401Example:
                  summary: Default getNetworkStats 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security monitoring rule detected on threat network suspicious.
                    request_id: 583d1742-dcda-461e-a765-4a0c8e530ab5
        '403':
          description: DNS Security subscription not active.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetNetworkStats403Example:
                  summary: Default getNetworkStats 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security monitoring rule detected on threat network suspicious.
                    request_id: 583d1742-dcda-461e-a765-4a0c8e530ab5
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetNetworkStats500Example:
                  summary: Default getNetworkStats 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security monitoring rule detected on threat network suspicious.
                    request_id: 583d1742-dcda-461e-a765-4a0c8e530ab5
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    NetworkStats:
      type: object
      properties:
        customerid:
          type: string
          description: Customer ID for which statistics are returned.
          example: '251301'
        period:
          type: object
          properties:
            start:
              type: string
              description: Start of the statistics period.
              example: example-start
            end:
              type: string
              description: End of the statistics period.
              example: example-end
          example:
            start: example-start
            end: example-end
        total_queries:
          type: integer
          description: Total DNS queries processed during the period.
          example: 301
        blocked_queries:
          type: integer
          description: DNS queries blocked by DNS Security policy.
          example: 169
        allowed_queries:
          type: integer
          description: DNS queries allowed by DNS Security policy.
          example: 331
        sinkholed_queries:
          type: integer
          description: DNS queries redirected to sinkhole.
          example: 260
        top_queried_domains:
          type: array
          description: Most frequently queried domains during the period.
          items:
            type: object
            properties:
              domain:
                type: string
                example: api.example.com
              query_count:
                type: integer
                example: 628
              dns_security_category:
                type: string
                example: standard
          example:
          - domain: vpn.acme-systems.org
            query_count: 57
            dns_security_category: advanced
        category_breakdown:
          type: array
          description: Query counts grouped by DNS Security category.
          items:
            type: object
            properties:
              category:
                type: string
                example: custom
              count:
                type: integer
                example: 698
              percentage:
                type: number
                format: float
                example: 66.42
          example:
          - category: custom
            count: 310
            percentage: 40.54
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Security monitoring rule detected on threat network suspicious.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 583d1742-dcda-461e-a765-4a0c8e530ab5
  securitySchemes:
    dnsApiKey:
      type: apiKey
      in: header
      name: X-DNS-API-APIKEY
      description: DNS Security API key. Requires an active DNS Security subscription associated with a Palo Alto Networks support account. Obtain from the DNS Security portal under API settings.