Palo Alto Networks

Palo Alto Networks Submit API

File, URL, and link submission for malware analysis.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 3

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /submit/file Submit a file to WildFire for malware analysis · Palo Alto Networks Submit File for Analysis #
Ask an LLM
“How do I check whether a suspicious executable or Office document is malware?”
“Which file types can WildFire detonate in its sandbox?”
Tell an agent
Submit file {file} to WildFire for malware analysis.
Detonate {file} in the WildFire sandbox and analyze its behavior.
POST /submit/url Submit a URL to WildFire for phishing analysis · Palo Alto Networks Submit URL for Analysis #
Ask an LLM
“Can WildFire tell me if a website is phishing or serving malware?”
“What happens when I send a web page URL to WildFire for analysis?”
Tell an agent
Submit URL {url} to WildFire for phishing and malware analysis.
Have WildFire visit {url} and analyze the page and its downloads.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-submit-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-submit-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-submit-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks WildFire Submit API
  description: Cloud-based REST API for submitting files, URLs, and links to the Palo Alto Networks WildFire sandbox for advanced malware analysis.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/wildfire/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://wildfire.paloaltonetworks.com/publicapi
  description: WildFire global cloud (US).
- url: https://wildfire.{region}.paloaltonetworks.com/publicapi
  description: WildFire regional cloud endpoint.
  variables:
    region:
      description: Regional deployment (e.g., eu, jp).
      default: eu
tags:
- name: Submit
  description: File, URL, and link submission for malware analysis.
paths:
  /submit/file:
    post:
      operationId: submitFile
      summary: Palo Alto Networks Submit File for Analysis
      description: Submits a file to WildFire for malware analysis. The file is executed in an isolated sandbox environment and analyzed for malicious behavior. Supported file types include PE executables, DLLs, Office documents, PDFs, APKs, and scripts. Returns a SHA-256 hash and upload status. Poll /get/verdict for the analysis result.
      tags:
      - Submit
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
              - apikey
              - file
              properties:
                apikey:
                  type: string
                  description: WildFire API key for authentication.
                file:
                  type: string
                  format: binary
                  description: The file to submit for analysis (max 100 MB).
            examples:
              SubmitFileRequestExample:
                summary: Default submitFile request
                x-microcks-default: true
                value:
                  apikey: example-apikey
                  file: example-file
      responses:
        '200':
          description: File submitted successfully.
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/SubmitResponse'
              examples:
                SubmitFile200Example:
                  summary: Default submitFile 200 response
                  x-microcks-default: true
                  value:
                    upload-file-info:
                      filename: Primary Firewall 60
                      filetype: standard
                      fileurl: example-fileurl
                      md5: e80837f90fb511c2a14570a6acc47263
                      sha256: b4ed4912613bb347504a26b57f498c5ea2364a7174f06253e7336aeac148a038
                      size: 806
                      url: https://mail.acme-systems.org/3910a3
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /submit/url:
    post:
      operationId: submitUrl
      summary: Palo Alto Networks Submit URL for Analysis
      description: Submits a URL to WildFire for phishing and malware analysis. WildFire visits the URL in an isolated browser environment and analyzes the page content and any downloaded files for malicious behavior.
      tags:
      - Submit
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - apikey
              - url
              properties:
                apikey:
                  type: string
                  description: WildFire API key for authentication.
                url:
                  type: string
                  description: URL to submit for analysis (must be a valid HTTP or HTTPS URL).
            examples:
              SubmitUrlRequestExample:
                summary: Default submitUrl request
                x-microcks-default: true
                value:
                  apikey: example-apikey
                  url: https://mail.example.com/063e82
      responses:
        '200':
          description: URL submitted successfully.
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/SubmitResponse'
              examples:
                SubmitUrl200Example:
                  summary: Default submitUrl 200 response
                  x-microcks-default: true
                  value:
                    upload-file-info:
                      filename: Primary Firewall 60
                      filetype: standard
                      fileurl: example-fileurl
                      md5: e80837f90fb511c2a14570a6acc47263
                      sha256: b4ed4912613bb347504a26b57f498c5ea2364a7174f06253e7336aeac148a038
                      size: 806
                      url: https://mail.acme-systems.org/3910a3
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /submit/link:
    post:
      operationId: submitLink
      summary: Palo Alto Networks Submit Link for Analysis
      description: Submits a hyperlink for WildFire analysis. Similar to URL submission but intended for links extracted from email bodies or documents.
      tags:
      - Submit
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - apikey
              - link
              properties:
                apikey:
                  type: string
                  description: WildFire API key for authentication.
                link:
                  type: string
                  description: Link to submit for analysis.
            examples:
              SubmitLinkRequestExample:
                summary: Default submitLink request
                x-microcks-default: true
                value:
                  apikey: example-apikey
                  link: https://portal.acme-systems.org/87b216
      responses:
        '200':
          description: Link submitted successfully.
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/SubmitResponse'
              examples:
                SubmitLink200Example:
                  summary: Default submitLink 200 response
                  x-microcks-default: true
                  value:
                    upload-file-info:
                      filename: Primary Firewall 60
                      filetype: standard
                      fileurl: example-fileurl
                      md5: e80837f90fb511c2a14570a6acc47263
                      sha256: b4ed4912613bb347504a26b57f498c5ea2364a7174f06253e7336aeac148a038
                      size: 806
                      url: https://mail.acme-systems.org/3910a3
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Unauthorized:
      description: Missing API key or API key is invalid.
      content:
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: An internal server error occurred.
      content:
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Valid API key but insufficient permissions for the requested operation (e.g., sample download requires elevated permissions).
      content:
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request, missing required parameters, or invalid API key format.
      content:
        application/xml:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    SubmitResponse:
      type: object
      description: Response returned after successfully submitting a file, URL, or link.
      properties:
        upload-file-info:
          type: object
          properties:
            filename:
              type: string
              description: Original filename of the submitted file.
              example: Staging Agent 09
            filetype:
              type: string
              description: Detected file type.
              example: advanced
            fileurl:
              type: string
              description: URL of the submitted link or URL sample.
              example: example-fileurl
            md5:
              type: string
              description: MD5 hash of the submitted file.
              example: c3b5353b5e324afe11011c986fdff25e
            sha256:
              type: string
              description: SHA-256 hash of the submitted file.
              example: 6e459dbe581619c17119c4b6902f58ba424ef03b271bedcfdbc0431b7912882c
            size:
              type: integer
              description: File size in bytes.
              example: 334
            url:
              type: string
              description: Submitted URL value.
              example: https://login.example.com/8d2a5c
          example:
            filename: Primary Firewall 60
            filetype: standard
            fileurl: example-fileurl
            md5: e80837f90fb511c2a14570a6acc47263
            sha256: b4ed4912613bb347504a26b57f498c5ea2364a7174f06253e7336aeac148a038
            size: 806
            url: https://mail.acme-systems.org/3910a3
    ErrorResponse:
      type: object
      description: Error response returned when a request fails.
      properties:
        error:
          type: object
          properties:
            error-message:
              type: string
              description: Human-readable error message.
              example: example-error-message
          example:
            error-message: example-error-message