Palo Alto Networks · Schema
Device
Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR
Properties
| Name | Type | Description |
|---|---|---|
| id | string | Unique identifier |
| externalId | string | External identifier |
| status | string | Device status |
| firstSeen | string | First seen time |
| lastSeen | string | Last seen time |
| osType | string | Operating System type |
| osVersion | string | OS Version |
| osDisplayName | string | OS Display Name |
| chromeosVersion | string | ChromeOS version (only for ChromeOS devices) |
| locationMethod | object | |
| arch | string | Architecture |
| nativeArch | string | Native Architecture |
| hostname | string | Hostname |
| model | string | Device Model |
| serialNumber | string | Serial Number |
| mobileVendor | string | Mobile device vendor/manufacturer (e.g., Samsung, Apple) |
| mobileHardware | string | Mobile device hardware identifier (e.g., iPhone14,2, SM-G998B) |
| mobileIsRooted | boolean | Whether the mobile device is rooted/jailbroken |
| macAddresses | array | MAC Addresses |
| screenLockStatus | string | Screen Lock Status |
| diskEncryptionStatus | string | Disk Encryption Status |
| diskEncryptionDetails | object | |
| firewallStatus | string | Firewall Status |
| firewallDetails | object | |
| userAgent | string | User Agent |
| ip | stringnull | IP Address |
| talonExtensionVersion | string | Talon Extension Version |
| browserVersion | string | Browser Version |
| browserBrand | object | |
| deviceType | string | Device Type |
| platform | object | |
| deviceEPP | object | |
| devicePassword | object | |
| crowdstrikeZTA | object | |
| systemIntegrity | object | |
| isRunningOnRemoteSession | boolean | Whether the device is running on a remote session (e.g., RDP, VNC) |
| deviceManagement | object | |
| browserSelfProtectionModule | object | |
| isOSUserAdmin | boolean | OS user is admin |
| isBrowserInstalledAsAdmin | boolean | Browser installed as admin |
| user | object |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-device-schema.json",
"title": "Device",
"x-generated": "2026-10-03",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/palo-alto-networks-devices-api-openapi.yml#/components/schemas/Device",
"type": "object",
"properties": {
"id": {
"type": "string",
"format": "string",
"description": "Unique identifier"
},
"externalId": {
"type": "string",
"format": "string",
"description": "External identifier"
},
"status": {
"type": "string",
"description": "Device status",
"enum": [
"active",
"archived",
"suspended"
]
},
"firstSeen": {
"type": "string",
"format": "date-time",
"description": "First seen time"
},
"lastSeen": {
"type": "string",
"format": "date-time",
"description": "Last seen time"
},
"osType": {
"type": "string",
"description": "Operating System type",
"enum": [
"windows",
"macOS",
"linux",
"ios",
"android",
"unknown"
]
},
"osVersion": {
"type": "string",
"description": "OS Version"
},
"osDisplayName": {
"type": "string",
"description": "OS Display Name"
},
"chromeosVersion": {
"type": "string",
"description": "ChromeOS version (only for ChromeOS devices)"
},
"locationMethod": {
"$ref": "#/$defs/LocationMethod"
},
"arch": {
"type": "string",
"description": "Architecture"
},
"nativeArch": {
"type": "string",
"description": "Native Architecture"
},
"hostname": {
"type": "string",
"description": "Hostname"
},
"model": {
"type": "string",
"description": "Device Model"
},
"serialNumber": {
"type": "string",
"description": "Serial Number"
},
"mobileVendor": {
"type": "string",
"description": "Mobile device vendor/manufacturer (e.g., Samsung, Apple)"
},
"mobileHardware": {
"type": "string",
"description": "Mobile device hardware identifier (e.g., iPhone14,2, SM-G998B)"
},
"mobileIsRooted": {
"type": "boolean",
"description": "Whether the mobile device is rooted/jailbroken"
},
"macAddresses": {
"type": "array",
"items": {
"type": "string"
},
"description": "MAC Addresses"
},
"screenLockStatus": {
"type": "string",
"description": "Screen Lock Status",
"enum": [
"ScreenLockStatusUnknown",
"ScreenLockStatusDisabled",
"ScreenLockStatusEnabled"
]
},
"diskEncryptionStatus": {
"type": "string",
"description": "Disk Encryption Status",
"enum": [
"DiskEncryptionStatusUnknown",
"DiskEncryptionStatusDisabled",
"DiskEncryptionStatusEnabled"
]
},
"diskEncryptionDetails": {
"$ref": "#/$defs/DeviceDiskEncryptionDetails"
},
"firewallStatus": {
"type": "string",
"description": "Firewall Status",
"enum": [
"FireWallStatusUnknown",
"FireWallStatusDisabled",
"FireWallStatusEnabled"
]
},
"firewallDetails": {
"$ref": "#/$defs/DeviceFirewallDetails"
},
"userAgent": {
"type": "string",
"description": "User Agent"
},
"ip": {
"type": [
"string",
"null"
],
"description": "IP Address"
},
"talonExtensionVersion": {
"type": "string",
"description": "Talon Extension Version"
},
"browserVersion": {
"type": "string",
"description": "Browser Version"
},
"browserBrand": {
"$ref": "#/$defs/DeviceBrowserBrand"
},
"deviceType": {
"type": "string",
"description": "Device Type",
"enum": [
"unknown",
"desktop",
"laptop",
"vm",
"smartphone",
"tablet",
"chromebook"
]
},
"platform": {
"$ref": "#/$defs/DevicePlatform"
},
"deviceEPP": {
"$ref": "#/$defs/DeviceEPP"
},
"devicePassword": {
"$ref": "#/$defs/DevicePasswordPosture"
},
"crowdstrikeZTA": {
"$ref": "#/$defs/CrowdstrikeZTAPosture"
},
"systemIntegrity": {
"$ref": "#/$defs/SystemIntegrityPosture"
},
"isRunningOnRemoteSession": {
"type": "boolean",
"description": "Whether the device is running on a remote session (e.g., RDP, VNC)"
},
"deviceManagement": {
"$ref": "#/$defs/DeviceManagement"
},
"browserSelfProtectionModule": {
"$ref": "#/$defs/BrowserSelfProtectionModule"
},
"isOSUserAdmin": {
"type": "boolean",
"description": "OS user is admin"
},
"isBrowserInstalledAsAdmin": {
"type": "boolean",
"description": "Browser installed as admin"
},
"user": {
"$ref": "#/$defs/User"
}
},
"required": [
"id",
"status",
"firstSeen",
"lastSeen",
"osType",
"osDisplayName",
"platform",
"browserBrand",
"arch",
"nativeArch",
"hostname",
"model",
"serialNumber",
"macAddresses",
"screenLockStatus",
"diskEncryptionStatus",
"firewallStatus",
"isBrowserInstalledAsAdmin",
"userAgent",
"talonExtensionVersion",
"browserVersion",
"deviceType",
"osVersion",
"externalId"
],
"$defs": {
"BrowserSelfProtectionModule": {
"type": "object",
"description": "Browser self-protection module",
"properties": {
"windows": {
"type": "object",
"description": "Windows driver info",
"properties": {
"status": {
"$ref": "#/$defs/BrowserSelfProtectionWindowsDriverStatus"
}
}
}
}
},
"BrowserSelfProtectionWindowsDriverStatus": {
"type": "string",
"description": "Windows driver status",
"default": "Unknown",
"enum": [
"Unknown",
"Protected",
"Inactive",
"UnprotectedArmIncompatible",
"UnprotectedUserInstall",
"Unprotected"
]
},
"CrowdstrikeZTAPosture": {
"type": "object",
"required": [
"score",
"sensorScore",
"osScore",
"CID"
],
"properties": {
"score": {
"type": "integer"
},
"sensorScore": {
"type": "integer"
},
"osScore": {
"type": "integer"
},
"CID": {
"type": "string"
}
}
},
"DeviceBrowserBrand": {
"type": "string",
"description": "Browser brand",
"enum": [
"Arc",
"Brave",
"Chrome",
"Edge",
"Opera",
"Dia",
"Comet",
"Prisma Browser",
"Unknown"
]
},
"DeviceDiskEncryptionDetails": {
"type": "object",
"description": "Disk encryption details for the device",
"required": [
"products"
],
"properties": {
"products": {
"type": "array",
"description": "List of disk encryption products detected on the device",
"items": {
"$ref": "#/$defs/DiskEncryptionProduct"
}
}
}
},
"DeviceEPP": {
"type": "object",
"required": [
"products",
"enabled"
],
"properties": {
"products": {
"type": "array",
"items": {
"$ref": "#/$defs/EPP"
}
},
"enabled": {
"type": "boolean"
}
}
},
"DeviceFirewallDetails": {
"type": "object",
"description": "Firewall details for the device",
"required": [
"products"
],
"properties": {
"products": {
"type": "array",
"description": "List of firewall products detected on the device",
"items": {
"$ref": "#/$defs/FirewallProduct"
}
}
}
},
"DeviceManagement": {
"type": "object",
"required": [
"status",
"systems"
],
"properties": {
"status": {
"type": "string",
"enum": [
"managed",
"unmanaged"
]
},
"systems": {
"type": "array",
"description": "Device Management",
"items": {
"$ref": "#/$defs/DeviceManagementSystem"
}
}
}
},
"DeviceManagementSystem": {
"type": "object",
"properties": {
"system": {
"type": "string",
"enum": [
"ad",
"azureAd",
"intune",
"jamf"
]
},
"details": {
"type": "string"
}
}
},
"DevicePasswordPosture": {
"type": "object",
"required": [
"enabled",
"products"
],
"properties": {
"enabled": {
"type": "boolean"
},
"passwordPolicy": {
"$ref": "#/$defs/DevicePasswordPosturePolicy"
}
}
},
"DevicePasswordPosturePolicy": {
"type": "object",
"required": [
"complexityReq",
"maxPasswordAge",
"minPasswordLength"
],
"properties": {
"complexityReq": {
"type": "boolean"
},
"maxPasswordAge": {
"type": "integer"
},
"minPasswordLength": {
"type": "integer"
}
}
},
"DevicePlatform": {
"type": "string",
"description": "Device platform",
"enum": [
"Desktop Browser",
"Mobile Browser",
"Browser Extension",
"Unknown"
]
},
"DiskEncryptionProduct": {
"type": "object",
"description": "Disk encryption product information",
"required": [
"vendorName",
"productName",
"fullyEncrypted"
],
"properties": {
"vendorName": {
"$ref": "#/$defs/DiskEncryptionVendorName"
},
"productName": {
"type": "string",
"description": "Product name of the disk encryption product"
}
}
},
"DiskEncryptionVendorName": {
"type": "string",
"description": "Disk encryption vendor name",
"enum": [
"2BrightSparks Pte Ltd",
"Acronis",
"Adolix",
"Apimac, software",
"Apple Inc.",
"archicrypt",
"Arcserve (USA), LLC",
"Ashampoo GmbH & Co. KG",
"AVG Technologies CZ, s.r.o.",
"Axantum Software AB",
"AxCrypt AB",
"Beachhead Solutions",
"Becrypt Ltd",
"BeLight Software Ltd.",
"Bitdefender",
"Braincell consult & research GmbH",
"Check Point Software Technologies",
"CipherShed",
"COMODO Security Solutions",
"CoSoSys Ltd.",
"CP-Lab.com",
"Crypto Systems, Inc.",
"Cypherix Software Pvt. Ltd.",
"DATEV eG",
"Dekart",
"Dell Inc.",
"Deltacrypt Technologies Inc",
"DESlock Limited",
"Digital Millenium Inc.",
"DoGoodSoft",
"EgoSecure",
"EGSoftWeb",
"ENC Security Systems",
"Encrypt4all Software",
"ESET",
"Evgeny Korovin",
"EXLADE, Inc.",
"Exosphere Labs, Inc.",
"FileEncryption.org.",
"G Data Software AG",
"GiliSoft International LLC",
"GitHub, Inc.",
"GitLab Inc.",
"Hewlett-Packard",
"Hitek Software LLC",
"HummerStudio",
"IDRIX",
"InterCrypto Ltd",
"Inv Softworks LLC",
"Jetico, Inc.",
"Kaspersky Lab",
"Kovell Ventures Ltd.",
"Kromtech",
"Kruptos 2 Software",
"Lavasoft",
"MadowSoft Software",
"Max Secure Software",
"McAfee, Inc.",
"Microsoft Corporation",
"MicroWorld Technologies Inc.",
"Mnemonic Security Inc.",
"MoRUN.net",
"MSecure Data Labs",
"NCH Software",
"New Softwares.net",
"Nomadesk NV",
"ntldr",
"Packetizer, Inc.",
"Panda Security, S.L.",
"PC Dynamics",
"PDFKey",
"PRIMX",
"R-tools Technology, Inc.",
"Ranquel Technologies",
"RentAnAdviser",
"Rogers",
"Safetica Technologies",
"Sarah Dean",
"SecurStar GmbH",
"SoftWinter",
"Solid Programs",
"Sophos Limited",
"Stoneage Softwares",
"SUSE LINUX GmbH",
"Symantec Corporation",
"TEHTRIS",
"Tesline-Service SRL",
"The Gpg4win Project",
"Trellix",
"Trend Micro, Inc.",
"TrueCrypt Foundation",
"TrustPort, a.s.",
"Utimaco Safeware AG",
"Vassil Arabadjiev",
"WARDWIZ",
"Webminds, Inc.",
"WinEncrypt",
"WinMagic Inc.",
"Zmanda, Inc."
]
},
"EPP": {
"type": "object",
"required": [
"name",
"version",
"state"
],
"properties": {
"name": {
"type": "string"
},
"version": {
"type": "string"
},
"state": {
"type": "string"
}
}
},
"FirewallProduct": {
"type": "object",
"description": "Firewall product information",
"required": [
"vendorName",
"productName",
"enabled"
],
"properties": {
"vendorName": {
"$ref": "#/$defs/FirewallVendorName"
},
"productName": {
"type": "string",
"description": "Product name of the firewall"
},
"enabled": {
"type": "boolean",
"description": "Whether the firewall is enabled"
}
}
},
"FirewallVendorName": {
"type": "string",
"description": "Firewall vendor name",
"enum": [
"Agnitum Ltd.",
"NETGATE Technologies s.r.o.",
"ParetoLogic, Inc.",
"LANDESK Software, Inc.",
"AT&T",
"Bitdefender",
"Mysecuritywin",
"G Data Software AG",
"Max Secure Software",
"AhnLab, Inc.",
"AVG Technologies CZ, s.r.o.",
"Symantec Corporation",
"Kaspersky Lab",
"Avira GmbH",
"Panda Security, S.L.",
"Webroot Software, Inc.",
"Quick Heal Technologies (P) Ltd.",
"nProtect, Inc.",
"F-Secure Corporation",
"ThreatTrack Security, Inc.",
"McAfee, Inc.",
"eEye Digital Security",
"Arcabit",
"BeyondTrust, Inc.",
"Telefónica S.A.",
"GEN-X Technologies",
"K7 Computing Pvt Ltd",
"Faronics Corporation",
"TELUS",
"Kingsoft Corporation",
"BiniSoft.org",
"GFI Software Ltd.",
"TG Soft S.a.s.",
"Scandium Security Inc.",
"Datpol",
"Tech Guard Technologies",
"NCP engineering GmbH",
"SoftSphere Technologies",
"Quick Guard Technologies",
"Emsisoft Ltd",
"Datalink Industrial Corporation",
"COMODO Security Solutions",
"MicroWorld Technologies Inc.",
"AVAST Software a.s.",
"ESET",
"Beijing Rising Information Technology Co., Ltd.",
"Smart Heal",
"Rogers",
"Check Point Software Technologies",
"CellSecurity",
"AS3 Soft4U",
"Ates Software & Internet Technologies",
"MSecure Data Labs",
"SGA SOLUTIONS",
"ALLIT Service, LLC.",
"adaware",
"SentinelOne",
"CrowdStrike, Inc.",
"CSIS Security Group",
"SOURCENEXT CORPORATION",
"Microsoft Corporation",
"SecureMix LLC",
"Swiss security laboratory.",
"AsiaInfo, Inc.",
"INCA Internet Co., Ltd.",
"ESTsoft Corp.",
"Sunrise Antivirus",
"Hauri, Inc.",
"SecuraShield India Pvt. Ltd.",
"NIFTY Corporation",
"Trend Micro, Inc.",
"Fujitsu Services Ltd.",
"LogMeIn, Inc.",
"Stormshield",
"Palo Alto Networks, Inc.",
"Chili Security",
"Sophos Limited",
"NortonLifeLock Inc",
"Massachusetts Institute of Technology",
"WatchGuard Technologies Inc",
"Beijing Huorong Network Technology Co., Ltd.",
"Le Minh Thanh",
"Qi An Xin Group",
"Avast Software s.r.o.",
"TEHTRIS",
"Avira Operations GmbH & Co. KG",
"WithSecure Corporation",
"Musarubra US LLC.",
"GoTo, Inc.",
"INCA Internet Co.,Ltd.",
"SECURA WEB DATA LABS PVT LTD",
"Broadcom",
"Gen Digital Inc.",
"Actipace Private Limited",
"Siyano Labs Pvt. Ltd.",
"Bkav Corporation",
"CMC InfoSec",
"Total Defense, Inc.",
"TrustPort, a.s.",
"Fortinet Inc.",
"Avanquest Software",
"Doctor Web, Ltd.",
"Security Software Limited",
"BullGuard Ltd.",
"HDD Labs. Inc",
"EarthLink, Inc.",
"Roboscan Inc",
"Thirtyseven4",
"PC Security Shield",
"CA, Inc.",
"Privacyware/PWI, Inc.",
"Károly Pados",
"PeerBlock, LLC",
"ProgrammerWorld.Net",
"Jetico, Inc.",
"Tiny Software Inc.",
"Sphinx Software",
"Defender Pro",
"Soft4Ever",
"Lavasoft",
"Norman AS",
"PC Tools Software",
"Apple Inc."
]
},
"LocationMethod": {
"type": "string",
"description": "Location detection method",
"enum": [
"GeoIp",
"Location services",
"Unknown"
]
},
"SystemIntegrityPosture": {
"type": "object",
"required": [
"status",
"services"
],
"properties": {
"status": {
"$ref": "#/$defs/SystemIntegrityPostureStatus"
},
"services": {
"$ref": "#/$defs/SystemIntegrityPostureServices"
}
}
},
"SystemIntegrityPostureServices": {
"type": "object",
"properties": {
"driversSigningEnforcement": {
"type": "boolean"
},
"kernelDebugger": {
"type": "boolean"
},
"secureBoot": {
"type": "boolean"
},
"SIP": {
"type": "boolean"
},
"gatekeeper": {
"type": "boolean"
}
}
},
"SystemIntegrityPostureStatus": {
"type": "string",
"description": "System integrity status",
"enum": [
"pass",
"fail",
"unknown"
]
},
"User": {
"type": "object",
"properties": {
"id": {
"type": "string",
"format": "string",
"description": "Unique identifier"
},
"externalId": {
"type": "string",
"format": "string",
"description": "External identifier"
},
"email": {
"type": "string",
"description": "Email"
},
"lastSeen": {
"type": "string",
"format": "date-time",
"description": "Last seen time"
},
"firstSeen": {
"type": "string",
"format": "date-time",
"description": "First seen time"
},
"name": {
"type": "string",
"description": "Name"
},
"profilePictureURL": {
"type": "string",
"description": "Profile Picture URL"
},
"deletedTime": {
"type": "string",
"format": "date-time",
"description": "Deleted Time"
},
"status": {
"$ref": "#/$defs/UserStatus"
},
"provider": {
"type": "string",
"description": "Provider",
"enum": [
"saml",
"local",
"oidc"
]
},
"deviceIds": {
"type": "array",
"description": "Device IDs",
"items": {
"type": "string"
}
},
"userGroups": {
"type": "array",
"description": "User Groups",
"items": {
"$ref": "#/$defs/UserGroup"
}
}
},
"required": [
"id",
"email",
"lastSeen",
"firstSeen",
"name",
"profilePictureURL",
"deletedTime",
"status",
"provider",
"externalId"
]
},
"UserGroup": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier"
},
"name": {
"type": "string",
"description": "Name"
},
"lastUpdated": {
"type": "string",
"format": "date-time",
"description": "Last updated"
},
"createdAt": {
"type": "string",
"format": "date-time",
"description": "Created at"
},
"provider": {
"type": "string",
"enum": [
"sso",
"local"
],
"description": "Provider"
}
},
"required": [
"id",
"name"
]
},
"UserStatus": {
"type": "string",
"description": "User status",
"enum": [
"active",
"suspended"
]
}
}
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/palo-alto-networks-device"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.