Palo Alto Networks Vulnerabilities API

openapi: 3.2.0
info:
  title: Palo Alto Networks Vulnerabilities API
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
  version: '1.0'
  description: 'Operations tagged Vulnerabilities across 2 of this provider''s published API definitions: palo-alto-iot-security-api-openapi-original.yml, palo-alto-networks-vulnerabilities-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
  description: IoT Security API production server.
  variables:
    customer:
      description: Customer-specific tenant identifier.
      default: customer-tenant
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: Vulnerabilities
  description: Device vulnerability tracking operations.
paths:
  /vulnerability/list:
    get:
      operationId: listVulnerabilities
      summary: Palo Alto Networks List Vulnerabilities
      description: Returns a paginated list of known vulnerabilities affecting discovered devices. Vulnerability data is correlated from device profiles, firmware versions, and known CVEs. Includes severity ratings, affected device counts, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '458156'
      - name: offset
        in: query
        description: Pagination offset for results.
        schema:
          type: integer
          default: 0
        example: 0
      - name: pagelength
        in: query
        description: Number of vulnerability records to return per page.
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      - name: stime
        in: query
        description: Start time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-stime
      - name: etime
        in: query
        description: End time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-etime
      responses:
        '200':
          description: Vulnerability list returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of vulnerabilities matching the query.
                  vulnerabilities:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
              examples:
                ListVulnerabilities200Example:
                  summary: Default listVulnerabilities 200 response
                  x-microcks-default: true
                  value:
                    total: 171
                    vulnerabilities:
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - keyId: []
        accessKey: []
    servers:
    - url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
      description: IoT Security API production server.
      variables:
        customer:
          description: Customer-specific tenant identifier.
          default: customer-tenant
  /vulnerability/detail:
    get:
      operationId: getVulnerabilityDetail
      summary: Palo Alto Networks Get Vulnerability Details
      description: Returns detailed information about a specific vulnerability affecting a device. Includes full CVE information, affected device context, severity scoring, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '958434'
      - name: deviceid
        in: query
        required: true
        description: Unique device identifier.
        schema:
          type: string
        example: '543948'
      - name: vulnerability_name
        in: query
        required: true
        description: Name of the vulnerability to retrieve details for.
        schema:
          type: string
        example: Branch Sensor 56
      responses:
        '200':
          description: Vulnerability details returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  vulnerability:
                    $ref: '#/components/schemas/Vulnerability'
              examples:
                GetVulnerabilityDetail200Example:
                  summary: Default getVulnerabilityDetail 200 response
                  x-microcks-default: true
                  value:
                    vulnerability:
                      id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - keyId: []
        accessKey: []
    servers:
    - url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
      description: IoT Security API production server.
      variables:
        customer:
          description: Customer-specific tenant identifier.
          default: customer-tenant
components:
  responses:
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or missing API keys.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          description: Unique vulnerability record identifier.
          example: example-id
        cve:
          type: string
          description: CVE identifier (e.g., CVE-2023-12345).
          example: example-cve
        vulnerability_name:
          type: string
          description: Vulnerability name.
          example: Production Gateway 97
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
          description: Vulnerability severity rating.
          example: critical
        cvss_score:
          type: number
          format: float
          description: CVSS v3 base score.
          example: 41.94
        deviceid:
          type: string
          description: Device identifier affected by the vulnerability.
          example: '527185'
        affected_device_count:
          type: integer
          description: Number of devices affected by this vulnerability.
          example: 436
        description:
          type: string
          description: Vulnerability description.
          example: Security rule blocked Security monitoring rule applied.
        remediation:
          type: string
          description: Recommended remediation steps.
          example: example-remediation
        first_detected:
          type: string
          format: date-time
          description: Timestamp when the vulnerability was first detected.
          example: '2026-01-17T19:27:21Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code or type.
          example: example-error
        message:
          type: string
          description: Human-readable error message.
          example: Monitoring traffic activity network investigation investigation network policy traffic violation rule rule.
  securitySchemes:
    keyId:
      type: apiKey
      in: header
      name: X-Key-Id
      description: IoT Security API key identifier. Generated from the IoT Security portal under Settings > API Keys.
    accessKey:
      type: apiKey
      in: header
      name: X-Access-Key
      description: IoT Security API access key. Generated alongside the key identifier from the IoT Security portal.
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-iot-security-api-openapi-original.yml
- palo-alto-networks-vulnerabilities-api-openapi.yml