Palo Alto Networks

Palo Alto Networks Vulnerabilities API

Device vulnerability tracking operations.

GitHub OpenAPI
Business capability
Vulnerability Management BC-620.40

Operations 2

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /vulnerability/list List vulnerabilities on IoT devices · Palo Alto Networks List Vulnerabilities #
Ask an LLM
“Which known vulnerabilities affect my discovered IoT devices?”
“Can I list vulnerabilities seen within a date range?”
Tell an agent
List vulnerabilities for customer {customerid}.
Show vulnerabilities for tenant {customerid} between {stime} and {etime}.
GET /vulnerability/detail Get vulnerability details for a device · Palo Alto Networks Get Vulnerability Details #
Ask an LLM
“What is the CVE detail and remediation for a vulnerability on one device?”
“How severe is a particular vulnerability on a specific device?”
Tell an agent
Get vulnerability {vulnerability_name} details on device {deviceid} for customer {customerid}.
Show remediation guidance for {vulnerability_name} on device {deviceid} (tenant {customerid}).

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-vulnerabilities-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-vulnerabilities-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-vulnerabilities-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks IoT Security Vulnerabilities API
  description: REST API for managing IoT and OT device security through Palo Alto Networks IoT Security cloud service. Provides device discovery and profiling, risk assessment, alert management, vulnerability tracking, and policy recommendation capabilities. Enables integration with third-party SIEM, SOAR, CMDB, and NAC platforms for automated security workflows. Requires an active IoT Security subscription.
  version: '4.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
  description: IoT Security API production server.
  variables:
    customer:
      description: Customer-specific tenant identifier.
      default: customer-tenant
security:
- keyId: []
  accessKey: []
tags:
- name: Vulnerabilities
  description: Device vulnerability tracking operations.
paths:
  /vulnerability/list:
    get:
      operationId: listVulnerabilities
      summary: Palo Alto Networks List Vulnerabilities
      description: Returns a paginated list of known vulnerabilities affecting discovered devices. Vulnerability data is correlated from device profiles, firmware versions, and known CVEs. Includes severity ratings, affected device counts, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '458156'
      - name: offset
        in: query
        description: Pagination offset for results.
        schema:
          type: integer
          default: 0
        example: 0
      - name: pagelength
        in: query
        description: Number of vulnerability records to return per page.
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      - name: stime
        in: query
        description: Start time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-stime
      - name: etime
        in: query
        description: End time filter as a Unix epoch timestamp in seconds.
        schema:
          type: string
        example: example-etime
      responses:
        '200':
          description: Vulnerability list returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of vulnerabilities matching the query.
                  vulnerabilities:
                    type: array
                    items:
                      $ref: '#/components/schemas/Vulnerability'
              examples:
                ListVulnerabilities200Example:
                  summary: Default listVulnerabilities 200 response
                  x-microcks-default: true
                  value:
                    total: 171
                    vulnerabilities:
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
                    - id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /vulnerability/detail:
    get:
      operationId: getVulnerabilityDetail
      summary: Palo Alto Networks Get Vulnerability Details
      description: Returns detailed information about a specific vulnerability affecting a device. Includes full CVE information, affected device context, severity scoring, and remediation guidance.
      tags:
      - Vulnerabilities
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '958434'
      - name: deviceid
        in: query
        required: true
        description: Unique device identifier.
        schema:
          type: string
        example: '543948'
      - name: vulnerability_name
        in: query
        required: true
        description: Name of the vulnerability to retrieve details for.
        schema:
          type: string
        example: Branch Sensor 56
      responses:
        '200':
          description: Vulnerability details returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  vulnerability:
                    $ref: '#/components/schemas/Vulnerability'
              examples:
                GetVulnerabilityDetail200Example:
                  summary: Default getVulnerabilityDetail 200 response
                  x-microcks-default: true
                  value:
                    vulnerability:
                      id: example-id
                      cve: example-cve
                      vulnerability_name: Production Gateway 97
                      severity: critical
                      cvss_score: 41.94
                      deviceid: '527185'
                      affected_device_count: 436
                      description: Security rule blocked Security monitoring rule applied.
                      remediation: example-remediation
                      first_detected: '2026-01-17T19:27:21Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Invalid or missing API keys.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          description: Unique vulnerability record identifier.
          example: example-id
        cve:
          type: string
          description: CVE identifier (e.g., CVE-2023-12345).
          example: example-cve
        vulnerability_name:
          type: string
          description: Vulnerability name.
          example: Production Gateway 97
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
          description: Vulnerability severity rating.
          example: critical
        cvss_score:
          type: number
          format: float
          description: CVSS v3 base score.
          example: 41.94
        deviceid:
          type: string
          description: Device identifier affected by the vulnerability.
          example: '527185'
        affected_device_count:
          type: integer
          description: Number of devices affected by this vulnerability.
          example: 436
        description:
          type: string
          description: Vulnerability description.
          example: Security rule blocked Security monitoring rule applied.
        remediation:
          type: string
          description: Recommended remediation steps.
          example: example-remediation
        first_detected:
          type: string
          format: date-time
          description: Timestamp when the vulnerability was first detected.
          example: '2026-01-17T19:27:21Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code or type.
          example: example-error
        message:
          type: string
          description: Human-readable error message.
          example: Monitoring traffic activity network investigation investigation network policy traffic violation rule rule.
  securitySchemes:
    keyId:
      type: apiKey
      in: header
      name: X-Key-Id
      description: IoT Security API key identifier. Generated from the IoT Security portal under Settings > API Keys.
    accessKey:
      type: apiKey
      in: header
      name: X-Access-Key
      description: IoT Security API access key. Generated alongside the key identifier from the IoT Security portal.