Deep Instinct Authentication

generated: '2026-08-01'
method: searched
source: >-
  https://portal.deepinstinct.com/.well-known/oauth-authorization-server (probed) +
  https://github.com/pvz01/deepinstinct-rest-api-wrapper +
  https://xsoar.pan.dev/docs/reference/integrations/deep-instinct
note: >-
  Deep Instinct publishes no public OpenAPI, so 0-working/derive-authentication.py had no spec to read.
  This profile is assembled from two real sources: the live OAuth discovery documents on
  portal.deepinstinct.com, and the published third-party integration documentation for the DSX
  management REST API (Palo Alto XSOAR, D3 Security, plus the community Python wrapper), all of which
  agree the DSX API authenticates with a console-issued API key.
summary:
  types: [oauth2, apiKey]
  oauth2_flows: [authorizationCode]
  api_key_in: [header]
  surfaces: 2
schemes:
- name: portal-mcp-oauth
  type: oauth2
  applies_to: Deep Instinct Portal MCP Server (https://portal.deepinstinct.com/mcp)
  model: OAuth 2.1
  issuer: https://portal.deepinstinct.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://portal.deepinstinct.com/oauth/authorize
    tokenUrl: https://portal.deepinstinct.com/oauth/token
    scopes: [mcp:read, mcp:write]
  grant_types: [authorization_code, refresh_token]
  pkce: true
  code_challenge_methods: [S256]
  token_endpoint_auth_methods: [client_secret_post]
  dynamic_client_registration: https://portal.deepinstinct.com/oauth/register
  revocation_endpoint: https://portal.deepinstinct.com/oauth/revoke
  bearer_methods_supported: [header]
  sources:
  - well-known/deep-instinct-oauth-authorization-server.json
  - well-known/deep-instinct-oauth-protected-resource.json
- name: dsx-api-key
  type: apiKey
  in: header
  applies_to: Deep Instinct DSX Management REST API (https://<tenant-fqdn>/api/v1)
  issuance: >-
    Generated by an administrator inside the DSX management console; scoped to that tenant appliance.
    Deep Instinct's own API reference is served from the tenant host at https://<fqdn>/api/v1 and is not
    anonymously reachable, so the exact header name is not recorded here rather than guessed.
  parameter_name: null
  parameter_name_confidence: unknown
  sources:
  - https://xsoar.pan.dev/docs/reference/integrations/deep-instinct
  - https://docs.d3security.com/integration-docs/integration-docs/deep-instinct-v2
  - https://github.com/pvz01/deepinstinct-rest-api-wrapper
docs:
  mcp: https://portal.deepinstinct.com/mcp
  rest: https://portal.deepinstinct.com/
  rest_note: >-
    The DSX REST API reference is a Swagger UI served per tenant at https://<your-fqdn>/api/v1/;
    customer-facing documentation lives behind the Deep Instinct customer portal login.
gaps:
- No public, anonymously reachable authentication documentation for the DSX REST API.
- No OpenAPI declaring securitySchemes for either surface.
- No security.txt, no OpenID Connect discovery document on any Deep Instinct host.