Palo Alto Networks Vulnerabilities API
Device vulnerability tracking operations.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-vulnerabilities-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks IoT Security Vulnerabilities API
description: REST API for managing IoT and OT device security through Palo Alto Networks IoT Security cloud service. Provides device discovery and profiling, risk assessment, alert management, vulnerability tracking, and policy recommendation capabilities. Enables integration with third-party SIEM, SOAR, CMDB, and NAC platforms for automated security workflows. Requires an active IoT Security subscription.
version: '4.0'
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
servers:
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
description: IoT Security API production server.
variables:
customer:
description: Customer-specific tenant identifier.
default: customer-tenant
security:
- keyId: []
accessKey: []
tags:
- name: Vulnerabilities
description: Device vulnerability tracking operations.
paths:
/vulnerability/list:
get:
operationId: listVulnerabilities
summary: Palo Alto Networks List Vulnerabilities
description: Returns a paginated list of known vulnerabilities affecting discovered devices. Vulnerability data is correlated from device profiles, firmware versions, and known CVEs. Includes severity ratings, affected device counts, and remediation guidance.
tags:
- Vulnerabilities
parameters:
- name: customerid
in: query
required: true
description: Customer tenant identifier.
schema:
type: string
example: '458156'
- name: offset
in: query
description: Pagination offset for results.
schema:
type: integer
default: 0
example: 0
- name: pagelength
in: query
description: Number of vulnerability records to return per page.
schema:
type: integer
default: 100
maximum: 1000
example: 100
- name: stime
in: query
description: Start time filter as a Unix epoch timestamp in seconds.
schema:
type: string
example: example-stime
- name: etime
in: query
description: End time filter as a Unix epoch timestamp in seconds.
schema:
type: string
example: example-etime
responses:
'200':
description: Vulnerability list returned successfully.
content:
application/json:
schema:
type: object
properties:
total:
type: integer
description: Total number of vulnerabilities matching the query.
vulnerabilities:
type: array
items:
$ref: '#/components/schemas/Vulnerability'
examples:
ListVulnerabilities200Example:
summary: Default listVulnerabilities 200 response
x-microcks-default: true
value:
total: 171
vulnerabilities:
- id: example-id
cve: example-cve
vulnerability_name: Production Gateway 97
severity: critical
cvss_score: 41.94
deviceid: '527185'
affected_device_count: 436
description: Security rule blocked Security monitoring rule applied.
remediation: example-remediation
first_detected: '2026-01-17T19:27:21Z'
- id: example-id
cve: example-cve
vulnerability_name: Production Gateway 97
severity: critical
cvss_score: 41.94
deviceid: '527185'
affected_device_count: 436
description: Security rule blocked Security monitoring rule applied.
remediation: example-remediation
first_detected: '2026-01-17T19:27:21Z'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/vulnerability/detail:
get:
operationId: getVulnerabilityDetail
summary: Palo Alto Networks Get Vulnerability Details
description: Returns detailed information about a specific vulnerability affecting a device. Includes full CVE information, affected device context, severity scoring, and remediation guidance.
tags:
- Vulnerabilities
parameters:
- name: customerid
in: query
required: true
description: Customer tenant identifier.
schema:
type: string
example: '958434'
- name: deviceid
in: query
required: true
description: Unique device identifier.
schema:
type: string
example: '543948'
- name: vulnerability_name
in: query
required: true
description: Name of the vulnerability to retrieve details for.
schema:
type: string
example: Branch Sensor 56
responses:
'200':
description: Vulnerability details returned successfully.
content:
application/json:
schema:
type: object
properties:
vulnerability:
$ref: '#/components/schemas/Vulnerability'
examples:
GetVulnerabilityDetail200Example:
summary: Default getVulnerabilityDetail 200 response
x-microcks-default: true
value:
vulnerability:
id: example-id
cve: example-cve
vulnerability_name: Production Gateway 97
severity: critical
cvss_score: 41.94
deviceid: '527185'
affected_device_count: 436
description: Security rule blocked Security monitoring rule applied.
remediation: example-remediation
first_detected: '2026-01-17T19:27:21Z'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
responses:
NotFound:
description: The requested resource was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Invalid or missing API keys.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
InternalServerError:
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
BadRequest:
description: Invalid request parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
Vulnerability:
type: object
properties:
id:
type: string
description: Unique vulnerability record identifier.
example: example-id
cve:
type: string
description: CVE identifier (e.g., CVE-2023-12345).
example: example-cve
vulnerability_name:
type: string
description: Vulnerability name.
example: Production Gateway 97
severity:
type: string
enum:
- critical
- high
- medium
- low
- info
description: Vulnerability severity rating.
example: critical
cvss_score:
type: number
format: float
description: CVSS v3 base score.
example: 41.94
deviceid:
type: string
description: Device identifier affected by the vulnerability.
example: '527185'
affected_device_count:
type: integer
description: Number of devices affected by this vulnerability.
example: 436
description:
type: string
description: Vulnerability description.
example: Security rule blocked Security monitoring rule applied.
remediation:
type: string
description: Recommended remediation steps.
example: example-remediation
first_detected:
type: string
format: date-time
description: Timestamp when the vulnerability was first detected.
example: '2026-01-17T19:27:21Z'
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code or type.
example: example-error
message:
type: string
description: Human-readable error message.
example: Monitoring traffic activity network investigation investigation network policy traffic violation rule rule.
securitySchemes:
keyId:
type: apiKey
in: header
name: X-Key-Id
description: IoT Security API key identifier. Generated from the IoT Security portal under Settings > API Keys.
accessKey:
type: apiKey
in: header
name: X-Access-Key
description: IoT Security API access key. Generated alongside the key identifier from the IoT Security portal.