Palo Alto Networks · Schema
AlertModel
Model for Alert
Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR
Properties
| Name | Type | Description |
|---|---|---|
| alertAdditionalInfo | object | |
| alertAttribution | object | |
| alertCount | integer | |
| alertRules | array | |
| alertTime | integer | Timestamp when alert was last reopened for resource update, or the same as **firstSeen** if there are no status changes. |
| dismissalDuration | string | Dismissal Duration |
| dismissalNote | string | Dismissal note |
| dismissalUntilTs | integer | Dismiss until this timestamp |
| dismissedBy | string | Dismissed by |
| eventOccurred | integer | Timestamp when the event occurred. Set only for Audit Event policies. |
| firstSeen | integer | Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp) |
| history | array | |
| id | string | Alert ID |
| lastSeen | integer | Timestamp when alert status was last updated. |
| lastUpdated | integer | Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes. |
| metadata | object | Raw JSON metadata for the alert |
| policy | object | |
| policyId | string | Policy ID |
| reason | string | Reason |
| resource | object | |
| riskDetail | object | |
| saveSearchId | string | Saved Search ID |
| status | string | Status |
| triggeredBy | string | Triggered By |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-alert-model-schema.json",
"title": "AlertModel",
"description": "Model for Alert",
"x-generated": "2026-10-03",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/palo-alto-networks-alerts-api-openapi.yml#/components/schemas/AlertModel",
"properties": {
"alertAdditionalInfo": {
"additionalProperties": {
"type": "string"
},
"type": "object"
},
"alertAttribution": {
"$ref": "#/$defs/AlertAttributionModel"
},
"alertCount": {
"format": "int64",
"type": "integer"
},
"alertRules": {
"items": {
"$ref": "#/$defs/PolicyScanConfigModel"
},
"type": "array"
},
"alertTime": {
"description": "Timestamp when alert was last reopened for resource update, or the same as **firstSeen** if there are no status changes.",
"format": "int64",
"type": "integer"
},
"dismissalDuration": {
"description": "Dismissal Duration",
"type": "string"
},
"dismissalNote": {
"description": "Dismissal note",
"type": "string"
},
"dismissalUntilTs": {
"description": "Dismiss until this timestamp",
"format": "int64",
"type": "integer"
},
"dismissedBy": {
"description": "Dismissed by",
"type": "string"
},
"eventOccurred": {
"description": "Timestamp when the event occurred. Set only for Audit Event policies.",
"format": "int64",
"type": "integer"
},
"firstSeen": {
"description": "Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)",
"format": "int64",
"type": "integer"
},
"history": {
"items": {
"$ref": "#/$defs/HistoryModel"
},
"type": "array"
},
"id": {
"description": "Alert ID",
"type": "string"
},
"lastSeen": {
"description": "Timestamp when alert status was last updated.",
"format": "int64",
"type": "integer"
},
"lastUpdated": {
"description": "Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.",
"format": "int64",
"type": "integer"
},
"metadata": {
"description": "Raw JSON metadata for the alert",
"type": "object"
},
"policy": {
"$ref": "#/$defs/PolicyModel"
},
"policyId": {
"description": "Policy ID",
"type": "string"
},
"reason": {
"description": "Reason",
"readOnly": true,
"type": "string"
},
"resource": {
"$ref": "#/$defs/CloudResourceModel"
},
"riskDetail": {
"allOf": [
{
"$ref": "#/$defs/RiskDetailModel"
},
{
"description": "Risk detail (Deprecated)"
}
]
},
"saveSearchId": {
"description": "Saved Search ID",
"type": "string"
},
"status": {
"description": "Status",
"enum": [
"open",
"dismissed",
"snoozed",
"resolved"
],
"readOnly": true,
"type": "string"
},
"triggeredBy": {
"description": "Triggered By",
"type": "string"
}
},
"type": "object",
"$defs": {
"AlertAttributionModel": {
"description": "Model for AlertAttribution",
"properties": {
"attributionEventList": {
"items": {
"$ref": "#/$defs/AttributionEventModel"
},
"type": "array"
},
"resourceCreatedBy": {
"description": "Resource Created By",
"type": "string"
},
"resourceCreatedOn": {
"description": "Resource Created On",
"format": "int64",
"type": "integer"
}
},
"type": "object"
},
"AlertRuleNotificationConfigModel": {
"description": "Model for Alert Rule Notification Config",
"properties": {
"dayOfMonth": {
"description": "Day of month",
"format": "int32",
"readOnly": true,
"type": "integer"
},
"daysOfWeek": {
"description": "Days of week",
"items": {
"$ref": "#/$defs/WeekDay"
},
"readOnly": true,
"type": "array"
},
"detailedReport": {
"description": "Provide csv detailed report",
"type": "boolean"
},
"enabled": {
"description": "Scan enabled",
"type": "boolean"
},
"frequency": {
"enum": [
"as_it_happens",
"daily",
"weekly",
"monthly"
],
"type": "string"
},
"frequencyFromRRule": {
"description": "Frequency from RRule",
"readOnly": true,
"type": "string"
},
"hourOfDay": {
"description": "Hour of day",
"format": "int32",
"readOnly": true,
"type": "integer"
},
"id": {
"description": "Alert rule notification config ID",
"type": "string"
},
"includeRemediation": {
"description": "Include remediation in detailed report",
"type": "boolean"
},
"lastUpdated": {
"description": "Last Updated",
"format": "int64",
"type": "integer"
},
"last_sent_ts": {
"description": "Time of last notification in milliseconds",
"format": "int64",
"type": "integer"
},
"recipients": {
"description": "* For email notifications: List of unique email addresses to notify\n* For integrations without notification templates: List of integration ids\n* For integrations with notification templates: List of notification template ids\n",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"rruleSchedule": {
"type": "string"
},
"templateId": {
"description": "Template ID",
"type": "string"
},
"timezone": {
"description": "Java time zone ID (e.g. America/Los_Angeles) ",
"readOnly": true,
"type": "string"
},
"type": {
"description": "Integration type",
"enum": [
"email",
"slack",
"splunk",
"amazon_sqs",
"jira",
"microsoft_teams",
"webhook",
"aws_security_hub",
"google_cscc",
"service_now",
"pager_duty",
"azure_service_bus_queue",
"demisto",
"aws_s3",
"snowflake"
],
"type": "string"
},
"withCompression": {
"description": "Compress detailed report",
"type": "boolean"
}
},
"type": "object"
},
"AlertRulePolicyFilter": {
"description": "Model for Alert Rule Policy Filter",
"properties": {
"availablePolicyFilters": {
"description": "List of available Alert Rule Policy Filters",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"cloud.type": {
"description": "Cloud Type Filter",
"items": {
"enum": [
"ALL",
"AWS",
"AZURE",
"GCP",
"ALIBABA_CLOUD",
"OCI",
"IBM"
],
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"policy.complianceStandard": {
"description": "Compliance Standard Filter",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"policy.label": {
"description": "Policy Label Filter",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"policy.severity": {
"description": "Policy Severity Filter",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
}
},
"type": "object"
},
"AttributionEventModel": {
"description": "Model for AttributionEvent",
"properties": {
"event": {
"description": "Event",
"type": "string"
},
"event_ts": {
"description": "Event Timestamp",
"format": "int64",
"type": "integer"
},
"username": {
"description": "Username",
"type": "string"
}
},
"type": "object"
},
"CloudResourceModel": {
"description": "Model for Cloud Resource",
"properties": {
"account": {
"description": "Account",
"type": "string"
},
"accountId": {
"description": "Account ID",
"type": "string"
},
"additionalInfo": {
"allOf": [
{
"$ref": "#/$defs/JsonNode"
},
{
"description": "Additional info"
}
]
},
"cloudAccountAncestors": {
"description": "Cloud account ancestors. For GCP.",
"items": {
"type": "string"
},
"readOnly": true,
"type": "array"
},
"cloudAccountGroups": {
"description": "Cloud account groups",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"cloudAccountOwners": {
"description": "Cloud account owners. For Azure and GCP.",
"items": {
"type": "string"
},
"readOnly": true,
"type": "array"
},
"cloudServiceName": {
"description": "Cloud service name",
"readOnly": true,
"type": "string"
},
"cloudType": {
"description": "Cloud type",
"enum": [
"ALL",
"AWS",
"AZURE",
"GCP",
"ALIBABA_CLOUD",
"OCI",
"IBM"
],
"type": "string"
},
"data": {
"description": "Raw JSON data for the resource",
"readOnly": true,
"type": "object"
},
"id": {
"description": "Id",
"type": "string"
},
"name": {
"description": "Name",
"type": "string"
},
"region": {
"description": "Region name",
"type": "string"
},
"regionId": {
"description": "Region API identifier",
"type": "string"
},
"resourceApiName": {
"description": "Resource API name",
"readOnly": true,
"type": "string"
},
"resourceConfigJsonAvailable": {
"type": "boolean"
},
"resourceDetailsAvailable": {
"type": "boolean"
},
"resourceTags": {
"additionalProperties": {
"type": "string"
},
"description": "Resource tags",
"type": "object"
},
"resourceType": {
"description": "Resource type",
"readOnly": true,
"type": "string"
},
"rrn": {
"description": "RRN",
"type": "string"
},
"unifiedAssetId": {
"type": "string"
},
"url": {
"description": "URL",
"type": "string"
}
},
"type": "object"
},
"ComplianceMetadataModel": {
"description": "Model for ComplianceMetadata",
"properties": {
"complianceId": {
"description": "Compliance Section UUID",
"type": "string"
},
"customAssigned": {
"type": "boolean"
},
"policyId": {
"description": "Policy ID",
"type": "string"
},
"requirementDescription": {
"description": "Requirement description",
"type": "string"
},
"requirementId": {
"description": "Requirement ID",
"type": "string"
},
"requirementName": {
"description": "Requirement name",
"type": "string"
},
"sectionDescription": {
"description": "Section name",
"type": "string"
},
"sectionId": {
"description": "Section Id",
"type": "string"
},
"sectionLabel": {
"description": "Section Label",
"type": "string"
},
"standardDescription": {
"description": "Compliance standard description",
"type": "string"
},
"standardId": {
"type": "string"
},
"standardName": {
"description": "Compliance standard name",
"type": "string"
}
},
"type": "object"
},
"HistoryModel": {
"description": "Model for History",
"properties": {
"reason": {
"description": "Reason",
"readOnly": true,
"type": "string"
},
"status": {
"description": "Status",
"enum": [
"OPEN",
"DISMISSED",
"SNOOZED",
"PENDING_RESOLUTION",
"RESOLVED"
],
"readOnly": true,
"type": "string"
}
},
"type": "object"
},
"JsonNode": {
"properties": {
"array": {
"type": "boolean"
},
"bigDecimal": {
"type": "boolean"
},
"bigInteger": {
"type": "boolean"
},
"binary": {
"type": "boolean"
},
"boolean": {
"type": "boolean"
},
"containerNode": {
"type": "boolean"
},
"double": {
"type": "boolean"
},
"float": {
"type": "boolean"
},
"floatingPointNumber": {
"type": "boolean"
},
"int": {
"type": "boolean"
},
"integralNumber": {
"type": "boolean"
},
"long": {
"type": "boolean"
},
"missingNode": {
"type": "boolean"
},
"nodeType": {
"enum": [
"ARRAY",
"BINARY",
"BOOLEAN",
"MISSING",
"NULL",
"NUMBER",
"OBJECT",
"POJO",
"STRING"
],
"type": "string"
},
"null": {
"type": "boolean"
},
"number": {
"type": "boolean"
},
"object": {
"type": "boolean"
},
"pojo": {
"type": "boolean"
},
"short": {
"type": "boolean"
},
"textual": {
"type": "boolean"
},
"valueNode": {
"type": "boolean"
}
},
"type": "object"
},
"PolicyModel": {
"description": "Model for Policy",
"properties": {
"cloudType": {
"description": "Cloud type (Required for config policies). Not case-sensitive. Default is **ALL**.",
"enum": [
"ALL",
"AWS",
"AZURE",
"GCP",
"ALIBABA_CLOUD",
"OCI",
"IBM"
],
"type": "string"
},
"complianceMetadata": {
"description": "List of compliance data. Each item has compliance standard, requirement, and/or section information.",
"items": {
"$ref": "#/$defs/ComplianceMetadataModel"
},
"type": "array"
},
"createdBy": {
"description": "Created by",
"readOnly": true,
"type": "string"
},
"createdOn": {
"description": "Created on this timestamp",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"deleted": {
"description": "Deleted",
"readOnly": true,
"type": "boolean"
},
"description": {
"description": "Policy description",
"type": "string"
},
"enabled": {
"description": "true=enabled. false=disabled.",
"type": "boolean"
},
"findingTypes": {
"description": "Finding Type",
"items": {
"type": "string"
},
"type": "array"
},
"labels": {
"description": "Labels",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"lastModifiedBy": {
"description": "Last modified by",
"readOnly": true,
"type": "string"
},
"lastModifiedOn": {
"description": "Last modified on this timestamp",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"name": {
"description": "Policy name",
"type": "string"
},
"overridden": {
"description": "Overridden",
"readOnly": true,
"type": "boolean"
},
"policyId": {
"description": "Policy ID",
"readOnly": true,
"type": "string"
},
"policySubTypes": {
"description": "Policy subtype",
"items": {
"enum": [
"run",
"build",
"run_and_build",
"audit",
"data_classification",
"dns",
"malware",
"network_event",
"network",
"ueba",
"permissions",
"network_config",
"identity"
],
"type": "string"
},
"readOnly": true,
"type": "array",
"uniqueItems": true
},
"policyType": {
"description": "Policy type. Policy type **anomaly** is read-only.",
"enum": [
"config",
"network",
"audit_event",
"anomaly",
"data",
"iam",
"workload_vulnerability",
"workload_incident",
"waas_event",
"attack_path"
],
"type": "string"
},
"policyUpi": {
"description": "Policy UPI",
"readOnly": true,
"type": "string"
},
"recommendation": {
"description": "Remediation recommendation",
"type": "string"
},
"remediable": {
"description": "isRemediable",
"readOnly": true,
"type": "boolean"
},
"remediation": {
"allOf": [
{
"$ref": "#/$defs/RemediationModel"
},
{
"description": "Auto remediation info. Available only if policy is remediable."
}
]
},
"restrictAlertDismissal": {
"description": "Restrict alert dismissal",
"readOnly": true,
"type": "boolean"
},
"rule": {
"allOf": [
{
"$ref": "#/$defs/RuleModel"
},
{
"description": "Policy rule (Contains RQL search query or saved search)"
}
]
},
"ruleLastModifiedOn": {
"description": "Rule last modified on",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"severity": {
"description": "Severity",
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"systemDefault": {
"description": "true = Policy is a Prisma Cloud system default policy",
"readOnly": true,
"type": "boolean"
}
},
"required": [
"name",
"policyType",
"rule",
"severity"
],
"type": "object"
},
"PolicyRiskScoreModel": {
"description": "Model for Policy Risk Score",
"properties": {
"cloudType": {
"description": "Cloud type (Required for config policies). Not case-sensitive. Default is **ALL**.",
"enum": [
"ALL",
"AWS",
"AZURE",
"GCP",
"ALIBABA_CLOUD",
"OCI",
"IBM"
],
"type": "string"
},
"complianceMetadata": {
"description": "List of compliance data. Each item has compliance standard, requirement, and/or section information.",
"items": {
"$ref": "#/$defs/ComplianceMetadataModel"
},
"type": "array"
},
"createdBy": {
"description": "Created by",
"readOnly": true,
"type": "string"
},
"createdOn": {
"description": "Created on this timestamp",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"deleted": {
"description": "Deleted",
"readOnly": true,
"type": "boolean"
},
"description": {
"description": "Policy description",
"type": "string"
},
"enabled": {
"description": "true=enabled. false=disabled.",
"type": "boolean"
},
"findingTypes": {
"description": "Finding Type",
"items": {
"type": "string"
},
"type": "array"
},
"labels": {
"description": "Labels",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
},
"lastModifiedBy": {
"description": "Last modified by",
"readOnly": true,
"type": "string"
},
"lastModifiedOn": {
"description": "Last modified on this timestamp",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"name": {
"description": "Policy name",
"type": "string"
},
"overridden": {
"description": "Overridden",
"readOnly": true,
"type": "boolean"
},
"points": {
"description": "Points",
"type": "string"
},
"policyId": {
"description": "Policy ID",
"readOnly": true,
"type": "string"
},
"policySubTypes": {
"description": "Policy subtype",
"items": {
"enum": [
"run",
"build",
"run_and_build",
"audit",
"data_classification",
"dns",
"malware",
"network_event",
"network",
"ueba",
"permissions",
"network_config",
"identity"
],
"type": "string"
},
"readOnly": true,
"type": "array",
"uniqueItems": true
},
"policyType": {
"description": "Policy type. Policy type **anomaly** is read-only.",
"enum": [
"config",
"network",
"audit_event",
"anomaly",
"data",
"iam",
"workload_vulnerability",
"workload_incident",
"waas_event",
"attack_path"
],
"type": "string"
},
"policyUpi": {
"description": "Policy UPI",
"readOnly": true,
"type": "string"
},
"recommendation": {
"description": "Remediation recommendation",
"type": "string"
},
"remediable": {
"description": "isRemediable",
"readOnly": true,
"type": "boolean"
},
"remediation": {
"allOf": [
{
"$ref": "#/$defs/RemediationModel"
},
{
"description": "Auto remediation info. Available only if policy is remediable."
}
]
},
"restrictAlertDismissal": {
"description": "Restrict alert dismissal",
"readOnly": true,
"type": "boolean"
},
"riskScore": {
"$ref": "#/$defs/ScoreModel"
},
"rule": {
"allOf": [
{
"$ref": "#/$defs/RuleModel"
},
{
"description": "Policy rule (Contains RQL search query or saved search)"
}
]
},
"ruleLastModifiedOn": {
"description": "Rule last modified on",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"severity": {
"description": "Severity",
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"systemDefault": {
"description": "true = Policy is a Prisma Cloud system default policy",
"readOnly": true,
"type": "boolean"
}
},
"required": [
"name",
"policyType",
"rule",
"severity"
],
"type": "object"
},
"PolicyScanConfigModel": {
"description": "Model for Policy Scan Config",
"properties": {
"alertRuleNotificationConfig": {
"description": "List of data for notifications to third-party tools",
"items": {
"$ref": "#/$defs/AlertRuleNotificationConfigModel"
},
"type": "array"
},
"allowAutoRemediate": {
"description": "Allow Auto-Remediation",
"type": "boolean"
},
"delayNotificationMs": {
"description": "Delay notifications by the specified milliseconds",
"format": "int64",
"type": "integer"
},
"description": {
"description": "Rule/Scan description",
"type": "string"
},
"enabled": {
"description": "Rule/Scan is enabled",
"type": "boolean"
},
"lastModifiedBy": {
"description": "Last modified by",
"readOnly": true,
"type": "string"
},
"lastModifiedOn": {
"description": "Last modified on this date/time in milliseconds",
"format": "int64",
"readOnly": true,
"type": "integer"
},
"name": {
"description": "Rule/Scan name",
"type": "string"
},
"notifyOnDismissed": {
"description": "include dismissed alerts in notification",
"type": "boolean"
},
"notifyOnOpen": {
"description": "include open alerts in notification",
"type": "boolean"
},
"notifyOnResolved": {
"description": "include resolved alerts in notification",
"type": "boolean"
},
"notifyOnSnoozed": {
"description": "include snoozed alerts in notification",
"type": "boolean"
},
"policies": {
"description": "List of specific policies to scan",
"items": {
"type": "string"
},
"type": "array"
},
"policyLabels": {
"description": "Policy labels",
"items": {
"type": "string"
},
"type": "array"
},
"policyScanConfigId": {
"description": "Policy Scan Config ID",
"type": "string"
},
"scanAll": {
"description": "Scan all policies",
"type": "boolean"
},
"target": {
"allOf": [
{
"$ref": "#/$defs/TargetFilterModel"
},
{
"description": "TargetFilter model (target accounts)"
}
]
}
},
"required": [
"name",
"target"
],
"type": "object"
},
"RemediationAction": {
"description": "Action for remediation for data policy.",
"properties": {
"operation": {
"type": "string"
},
"payload": {
"type": "string"
}
},
"type": "object"
},
"RemediationModel": {
"description": "Model for Remediation",
"properties": {
"actions": {
"description": "Policy Action",
"items": {
"$ref": "#/$defs/RemediationAction"
},
"type": "array"
},
"cliScriptTemplate": {
"description": "CLI Script Template",
"type": "string"
},
"description": {
"description": "Description",
"type": "string"
}
},
"type": "object"
},
"ResourceListIdsCollection": {
"description": "Model for holding the lists resource list ids by resource list type",
"properties": {
"computeAccessGroupIds": {
"items": {
"type": "string"
},
"type": "array"
}
},
"type": "object"
},
"RiskDetailModel": {
"description": "Model for Risk Detail",
"properties": {
"policyScores": {
"items": {
"$ref": "#/$defs/PolicyRiskScoreModel"
},
"type": "array"
},
"rating": {
"description": "Rating",
"type": "string"
},
"riskScore": {
"$ref": "#/$defs/ScoreModel"
},
"score": {
"description": "Score",
"type": "string"
}
},
"type": "object"
},
"RuleCriteria": {
"description": "Criteria for Rule",
"properties": {
"classificationResult": {
"description": "Data policy. Required for DLP rule criteria.",
"type": "string"
},
"exposure": {
"description": "File exposure",
"enum": [
"private",
"public",
"conditional"
],
"type": "string"
},
"extension": {
"description": "File extensions",
"items": {
"type": "string"
},
"type": "array",
"uniqueItems": true
}
},
"type": "object"
},
"RuleModel": {
"description": "Model for Rule",
"properties": {
"apiName": {
"description": "API name",
"readOnly": true,
"type": "string"
},
"cloudAccount": {
"description": "Cloud account",
"readOnly": true,
"type": "string"
},
"cloudType": {
"description": "Cloud type",
"readOnly": true,
"type": "string"
},
"criteria": {
"description": "Saved search ID that defines the rule criteria.",
"type": "string"
},
"dataCriteria": {
"allOf": [
{
"$ref": "#/$defs/RuleCriteria"
},
{
"description": "Rule criteria for DLP data policy"
}
]
},
"name": {
"description": "Name",
"type": "string"
},
"parameters": {
"additionalProperties": {
"type": "string"
},
"description": "Parameters (e.g. {\"savedSearch\": \"true\"})",
"type": "object"
},
"resourceIdPath": {
"description": "Resource ID path",
"readOnly": true,
"type": "string"
},
"resourceType": {
"description": "Resource type",
"readOnly": true,
"type": "string"
},
"type": {
"description"
# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/palo-alto-networks-alert-model-schema.json
Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/palo-alto-networks-alert-model"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.