Palo Alto Networks Threat Prevention API
The Threat Prevention API from Palo Alto Networks — 6 operation(s) for threat prevention.
OpenAPI Specification
openapi: 3.2.0
info:
contact: {}
description: ' The Threat Prevention API endpoints are available to customers with an active Threat Prevention or Advanced Threat Prevention subscription. List of Threat Prevention API endpoints: 1. Link to [Request Content Release Notes](/threat-vault/api/releasenotes) 2. Link to [Request Threat Metadata](/threat-vault/api/threats) 3. Link to [Request Threat Signature Metadata in Batch Mode](/threat-vault/api/threatsbatch) 4. Link to [Request Threat Signature Release History](/threat-vault/api/threatshistory) 5. Link to [Request CVE Coverage Information](/threat-vault/api/get-cve-coverage) '
title: Threat Prevention API
version: '1.0'
servers:
- url: https://api.threatvault.paloaltonetworks.com/service/v1
tags:
- name: Threat Prevention
paths:
/threats/cve-coverage:
get:
summary: Request CVE Coverage Information
tags:
- Threat Prevention
description: Retrieves coverage information for a specified CVE ID.
operationId: getCVECoverage
parameters:
- name: cve_id
in: query
description: The CVE ID to retrieve coverage for
required: true
schema:
type: string
pattern: ^CVE-\d{4}-\d{4,}$
example: CVE-2021-1647
security:
- X-API-KEY: []
responses:
'200':
description: Successful response with CVE coverage information
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
description: Indicates if the request was successful
example: true
link:
type: object
properties:
next:
type:
- string
- 'null'
description: Link to the next page of results
previous:
type:
- string
- 'null'
description: Link to the previous page of results
count:
type: integer
description: Number of records returned
example: 2
data:
oneOf:
- $ref: '#/components/schemas/CoveredCVEResponse'
- $ref: '#/components/schemas/CVECoverageInfo'
message:
type: string
description: Message describing the outcome of the request
example: Successful
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/CVECoverageErrorResponse'
examples:
invalidCVE:
value:
success: false
message: 'cve_id: Value is invalid.'
nonExistentCVE:
value:
success: false
message: CVE ID doesn't exist in NVD database
'401':
description: Unauthorized - Invalid API key
content:
application/json:
schema:
$ref: '#/components/schemas/CVECoverageAPIKeyErrorResponse'
'500':
description: Server error
content:
application/json:
schema:
$ref: '#/components/schemas/CVECoverageServerErrorResponse'
/release-notes:
get:
description: "A GET request to retrieve the release notes information by type and version.\n\n- Notes:\n - Any Content release notes before Version 8000 is best effort.\n"
operationId: releasenotes
parameters:
- description: 'The type of the release notes (ex. Content).
>⚠️ ***Use without quotes***
'
in: query
name: type
required: true
schema:
enum:
- content
type: string
- description: " The release version (ex. 8446) or content version (ex. 8446-6886) of the release notes.\n\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' 'https://api.threatvault.paloaltonetworks.com/service/v1/release-notes?type=content&version=8446-6886'\n```\n\nUse latest for latest release version:\n\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' 'https://api.threatvault.paloaltonetworks.com/service/v1/release-notes?type=content&version=latest'\n```\n "
in: query
name: version
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
properties:
count:
description: The total number of entries found.
example: 2
type: integer
data:
description: The data of the response.
items:
$ref: '#/components/schemas/ReleaseNotesDataList'
type: array
link:
description: The pagination information of the results.
items:
$ref: '#/components/schemas/Pagination'
type: array
message:
description: Generic response message.
example: Successful
type: string
success:
description: The response status.
example: true
type: boolean
type: object
description: Request succeeded
headers:
X-Day-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per day.
example: 2000
schema:
type: integer
X-Day-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one day).
schema:
type: integer
X-Day-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one day) resets.
schema:
type: integer
X-Minute-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per minute.
example: 200
schema:
type: integer
X-Minute-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one minute).
schema:
type: integer
X-Minute-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one minute) resets.
schema:
type: integer
4XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Client related error response
5XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Server related error response
security:
- X-API-KEY: []
summary: Request Content Release Notes
tags:
- Threat Prevention
/threats:
get:
description: "A GET request to retrieve threat metadata. The nature of the query is determined by the query parameter that you provide on the call to this API. \n- Notes: \n - Optionally, each query parameter can be used together with the \"type\" query parameter to filter out the results.\n - Any Antivirus / WildFire release summary information before **February 2020** is best-effort since the information is not available.\n"
operationId: threats
parameters:
- description: 'Query a specific Threat signature by signature ID. '
in: query
name: id
schema:
type: string
- description: "Provides the threat signatures metadata by exact match of the signature names.\n\n*Note: IPS threat signatures also support partial match.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?name=Microsoft+PE+File'\n```\n"
in: query
name: name
schema:
type: string
- description: "Provides the threat signatures metadata by exact or partial match of the CVE tied to the signatures.\n\n*Valid partial CVE format: CVE-YYYY*\n\n*Valid exact CVE format: CVE-YYYY-NNNN (NNNN can be 4 or more digits)*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?cve=CVE-2020-1234'\n```\nor \n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?cve=CVE-2021'\n```\n"
in: query
name: cve
schema:
type: string
- description: "Provides the threat signature metadata by matching the vendor ID tied to the signatures.\n\n*This parameter is only supported for IPS threat signature requests.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?vendor=MS16-095'\n```\n"
in: query
name: vendor
schema:
type: string
- description: "Used together with toReleaseDate field. Provides the IPS threat signatures metadata by the release dates range.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8440&toReleaseVersion=8446'\n```\n"
in: query
name: fromReleaseDate
schema:
type: string
- description: 'The right boundary of date range query, must use with `fromReleaseDate`. Example can be found in **fromReleaseDate** section '
in: query
name: toReleaseDate
schema:
type: string
- description: "Used together with toReleaseVersion field. Provides the IPS threat signatures metadata by the release versions range.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8440&toReleaseVersion=8446'\n```\n"
in: query
name: fromReleaseVersion
schema:
type: string
- description: 'The right boundary of version range query, must use with `fromReleaseVersion`. Example can be found in **toReleaseVersion** section '
in: query
name: toReleaseVersion
schema:
type: string
- description: "Provides the IPS threat signatures metadata by the release date.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseDate=2021-08-17'\n```\n"
in: query
name: releaseDate
schema:
type: string
- description: "Provides the IPS threat signatures metadata by the release version.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseVersion=8446'\n```\n"
in: query
name: releaseVersion
schema:
type: string
- description: "Provides the threat signature metadata based on the threat type. Use together with the other fields to filter out the results.\n>⚠️ ***Use without quotes***\n\n- Options:\n - antivirus (Provides Antivirus signatures metadata)\n - dns (Provides DNS signatures metadata)\n - fileformat (Provides all IPS File-Format signature metadata)\n - ips (Provides all IPS signature metadata)\n - rtdns (Provides Real-Time DNS Detection entries metadata)\n - spyware (Provides all IPS Anti-Spyware signature metadata)\n - spywarec2 (Provides Spyware C2 signatures metadata)\n - vulnerability (Provides all IPS Vulnerability Protection signature metadata)\n \n---\nGet all IPS signatures:\n``` \ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips'\n```\n*Note: This use-case is only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\nGet all File-Format signatures that were recently updated between Content Version 8590 and Content Version 8594:\n``` \ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8590&toReleaseVersion=8594&type=fileformat'\n```\n"
in: query
name: type
schema:
enum:
- ips
- fileformat
- spyware
- vulnerability
- antivirus
- dns
- rtdns
- spywarec2
type: string
- description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?sha256=7879722cd37b1c5b2703ea5a1a92a036a96f4a1fc6272b92c197b3a4b17267cc'\n```\n"
in: query
name: sha256
schema:
type: string
- description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?md5=ca066f965dfbc5392871d3fa281236cf'\n```\n"
in: query
name: md5
schema:
type: string
- description: "The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips&limit=1000'\n```\n"
in: query
name: limit
required: false
schema:
type: string
- description: "The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips&limit=1000&offset=1000'\n```\n"
in: query
name: offset
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
properties:
count:
description: The total number of entries found.
example: 6
type: integer
data:
description: The data of the response.
items:
$ref: '#/components/schemas/ThreatDataList'
type: array
link:
description: The pagination information of the results.
items:
$ref: '#/components/schemas/Pagination'
type: array
message:
description: Generic response message.
example: Successful
type: string
success:
description: The response status.
example: true
type: boolean
type: object
description: Request succeeded
headers:
X-Day-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per day.
example: 2000
schema:
type: integer
X-Day-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one day).
schema:
type: integer
X-Day-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one day) resets.
schema:
type: integer
X-Minute-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per minute.
example: 200
schema:
type: integer
X-Minute-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one minute).
schema:
type: integer
X-Minute-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one minute) resets.
schema:
type: integer
4XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Client related error response
5XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Server related error response
security:
- X-API-KEY: []
summary: Request Threat Metadata
tags:
- Threat Prevention
post:
description: "A POST request to retrieve the threats signature metadata by id, name or sample hash (sha256 or md5) in batch mode. Batch limit is 100 entries.\n\n- Notes: \n - Optionally, each query parameter can be used together with the \"type\" query parameter to filter out the results.\n - Any Antivirus / WildFire release summary information before **February 2020** is best-effort since the information is not available.\n"
operationId: threatsbatch
requestBody:
content:
application/json:
schema:
properties:
id:
description: "Provides the threat signatures metadata by exact match of the signature ids.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n -H 'Content-Type: application/json' \\\n -d '{\"id\": [\"280392504\"]}' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
items:
type: string
type: array
md5:
description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n -H 'Content-Type: application/json' \\\n -d '{\"md5\": [\"ca066f965dfbc5392871d3fa281236cf\"]}' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
items:
type: string
type: array
name:
description: "Provides the threat signatures metadata by exact match of the signature names.\n \n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n -H 'Content-Type: application/json' \\\n -d '{\"name\": [\"Microsoft PE File\"]}' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
items:
type: string
type: array
sha256:
description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n -H 'Content-Type: application/json' \\\n -d '{\"sha256\": [\"7879722cd37b1c5b2703ea5a1a92a036a96f4a1fc6272b92c197b3a4b17267cc\"]}' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
items:
type: string
type: array
type:
description: "Provides the threat signature metadata based on the threat type. Use together with the other fields to filter out the results.\n>⚠️ ***Use without quotes***\n\n- Options:\n - antivirus (Provides Antivirus signatures metadata)\n - dns (Provides DNS signatures metadata)\n - fileformat (Provides all IPS File-Format signature metadata)\n - ips (Provides all IPS signature metadata)\n - rtdns (Provides Real-Time DNS Detection entries metadata)\n - spyware (Provides all IPS Anti-Spyware signature metadata)\n - spywarec2 (Provides Spyware C2 signatures metadata)\n - vulnerability (Provides all IPS Vulnerability Protection signature metadata)\n \n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n -H 'Content-Type: application/json' \\\n -d '{\"id\": [\"280392504\"], \"type\":\"antivirus\"}' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
enum:
- ips
- fileformat
- spyware
- vulnerability
- antivirus
- dns
- rtdns
- spywarec2
type: string
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
count:
description: The total number of entries found.
example: 1
type: integer
data:
description: 'The data of the response. '
items:
$ref: '#/components/schemas/GetThreatBatchList'
type: array
link:
description: The pagination information of the results.
items:
$ref: '#/components/schemas/Pagination'
type: array
message:
description: Generic response message.
example: Successful
type: string
success:
description: The response status.
example: true
type: boolean
type: object
description: Request succeeded
headers:
X-Day-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per day.
example: 2000
schema:
type: integer
X-Day-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one day).
schema:
type: integer
X-Day-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one day) resets.
schema:
type: integer
X-Minute-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per minute.
example: 200
schema:
type: integer
X-Minute-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one minute).
schema:
type: integer
X-Minute-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one minute) resets.
schema:
type: integer
4XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Client related error response
5XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Server related error response
security:
- X-API-KEY: []
summary: Request Threat Signature Metadata in Batch Mode
tags:
- Threat Prevention
/threats/history:
get:
description: "A GET request to retrieve the threats signature release history by id and package type.\n\n- Notes:\n - The retention policy of **Antivirus** release history data is for **1 year** (only the last 1 year of release history data will be available).\n - The retention policy of **WildFire** release history data is for **30 days** (only the last 30 days of release history data will be available).\n - Any Antivirus / WildFire release history information before **Version 4140** is best-effort since the information is not available.\n - The Antivirus / WildFire version field in the responses before **Version 4140** is in the format of **XXXX** (ex. \"version\": \"4140\") and after that the format is **XXXX-YYYY** (ex. \"version\": \"4141-4637\").\n - The Antivirus / WildFire release time before **Version 4140** is the package start building time as the actual release time is not available.\n"
operationId: threatshistory
parameters:
- description: "Provides the threat signature metadata based on the threat type.\n>⚠️ ***Use without quotes***\n\n- Options:\n - antivirus (Provides Antivirus signature release information)\n - wildfire (Provides WildFire signature release information)\n"
in: query
name: type
required: true
schema:
enum:
- antivirus
- wildfire
type: string
- description: "Provides the threat signature release history by matching the signature id in the releases.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus'\n```\n"
in: query
name: id
required: true
schema:
type: string
- description: "The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&limit=3'\n```\n"
in: query
name: limit
required: false
schema:
type: string
- description: "The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&limit=3&offset=3'\n```\n"
in: query
name: offset
required: false
schema:
type: string
- description: "The order in which the results to be returned.\n>⚠️ ***Use without quotes***\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&order=desc'\n```\n"
in: query
name: order
required: false
schema:
enum:
- asc
- desc
type: string
responses:
'200':
content:
application/json:
schema:
properties:
count:
description: The total number of entries found.
example: 3
type: integer
data:
description: 'The data of the response. '
items:
$ref: '#/components/schemas/ThreatHistoryDataList'
type: array
link:
description: The pagination information of the results.
items:
$ref: '#/components/schemas/Pagination'
type: array
message:
description: Generic response message.
example: Successful
type: string
success:
description: The response status.
example: true
type: boolean
type: object
description: Request succeeded
headers:
X-Day-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per day.
example: 2000
schema:
type: integer
X-Day-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one day).
schema:
type: integer
X-Day-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one day) resets.
schema:
type: integer
X-Minute-RateLimit-Limit:
description: The maximum number of requests that the user is permitted to make per minute.
example: 200
schema:
type: integer
X-Minute-RateLimit-Remaining:
description: The number of requests remaining in the current rate limit window (one minute).
schema:
type: integer
X-Minute-RateLimit-Reset:
description: The epoch timestamp at which the current rate limit window (one minute) resets.
schema:
type: integer
4XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Client related error response
5XX:
content:
application/json:
schema:
properties:
message:
description: Generic response message.
example: Error message.
type: string
success:
description: The response status.
example: false
type: boolean
type: object
description: Server related error response
security:
- X-API-KEY: []
summary: Request Threat Signature Release History
tags:
- Threat Prevention
/edl:
get:
operationId: edl
description: 'A GET request to retrieve the predefined external dynamic lists by name and version.
'
parameters:
- name: name
in: query
req
# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-threat-prevention-api-openapi.yml