openapi: 3.2.0 info: title: Unified Incident Framework Incidents APIs API version: 3.0.0 description: "Consolidates security and operational incidents from multiple \nPaloAlto Networks products into a unified management interface. Provides read-only\naccess to search, filter, and analyze incident data across the Strata Cloud\nManager ecosystem. This Open API spec file was created on March 30, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies." servers: - url: https://api.strata.paloaltonetworks.com description: Production Server security: - JWT: [] tags: - name: Incidents APIs paths: /incidents/v1/search: post: summary: Incidents List Search description: Searches network security incidents with advanced filtering and pagination. operationId: searchIncidents responses: '200': description: List of incidents content: application/json: schema: type: object properties: header: $ref: '#/components/schemas/SearchResponseHeader' data: type: array items: type: object properties: updated_time: type: integer format: int64 example: 1765468859684 severity: type: string example: Informational severity_id: type: integer example: 200 status: type: string example: Raised title: type: string example: Tenant has 14 raised alerts priority: type: string example: Not Set priority_id: type: integer example: 0 product: type: string example: Prisma Access category: type: string example: Network sub_category: type: string example: '' code: type: string example: INC_AOA_TENANT_ALERTS_NOTIFICATION incident_id: type: string example: 21818c4a-8353-4d9c-ae3e-ae90004d4662 raised_time: type: integer format: int64 example: 1765468859684 cleared_time: type: integer format: int64 example: 1765468859684 release_state: type: string example: Released incident_type: type: string example: SOURCE_AGGREGATION_INCIDENT designation: type: string example: root acknowledged: type: boolean example: false acknowledged_by: type: string example: John Doe primary_impacted_objects: $ref: '#/components/schemas/ImpactedObjects' related_impacted_objects: $ref: '#/components/schemas/ImpactedObjects' snow_assignee: type: string example: '' snow_priority: type: string example: '' snow_status: type: string example: '' snow_ticket_id: type: string example: '' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' parameters: - $ref: '#/components/parameters/PrismaTenantHeader' - $ref: '#/components/parameters/PrismaRegionHeader' tags: - Incidents APIs requestBody: required: true content: application/json: schema: type: object properties: filter: $ref: '#/components/schemas/FilterObject' pagination: $ref: '#/components/schemas/PaginationObject' examples: FilterWithPagination: summary: Filter by Product/Status with Pagination value: filter: rules: - property: release_state operator: in values: - Released - property: product operator: in values: - NGFW - Prisma Access - Posture - property: status operator: in values: - Raised pagination: page_size: 50 page_number: 1 order_by: - property: updated_time order: desc /incidents/v1/details/{incident-id}: get: summary: Incidents Details description: Retrieves comprehensive information about a specific network security incident. operationId: getIncidentDetails responses: '200': description: Detailed incident information content: application/json: schema: type: object properties: incident_id: type: string example: 21818c4a-8353-4d9c-ae3e-ae90004d4662 title: type: string example: Tenant has 14 raised alerts description: type: string example: This alert triggers if the firewall has detected that a dataplane ethernet interface is down. description_locale_key: type: string example: alert.sig_45de40b0_fdbb_4506_900b_033d4551cdde.description raised_time: type: integer format: int64 example: 1765468859684 updated_time: type: integer format: int64 example: 1765468859684 resource_keys: type: string description: JSON string containing resource identifiers. example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}' status: type: string example: Raised remediations: type: string description: Stringified JSON object containing remediation steps for the incident. example: '{"remediations":[{"dynamic_content":{"steps":[{"title":"How to renew a locally generated certificate :","subSteps":[{"title":" ","description":"Select the certificate to be renewed in the following section: Device > Certificate Management > Certificates."}]}]}}]}' detail: type: string description: Stringified JSON array containing detailed alert information. example: '{"severity":"SEVERITY_S20","concern_level":"CONCERN_LEVEL_RAISED"}' alerts: type: array items: type: object properties: alert_id: type: string example: 0a887db4-d760-4dc2-bb14-04c5e120b811 processed_alert_id: type: string example: 0a887db4-d760-4dc2-bb14-04c5e120b811 severity: type: string example: Critical state: type: string example: Raised title: type: string example: Alert title updated_time: type: integer format: int64 example: 1765468859684 domain: type: string example: External inc_prop: type: integer example: 0 ctx_only_alert: type: boolean example: false code: type: string example: AL_AOA_TENANT_ALERTS_NOTIFICATION resource_keys: type: string description: JSON string containing resource identifiers. example: '{"tenant_id": "24072002", "sub_tenant_id": "24072002"}' release_state: type: string example: Released incident_type: type: string example: SOURCE_AGGREGATION_INCIDENT incident_code: type: string example: INC_AOA_TENANT_ALERTS_NOTIFICATION incident_settings_id: type: string example: INC_AOA_TENANT_ALERTS_NOTIFICATION severity_id: type: integer example: 200 severity: type: string example: Informational priority: type: string example: Not Set release_state: type: string example: Released product: type: string example: Prisma Access resource_context: type: string description: Stringified JSON object containing contextual resource information for the incident. example: '{"cluster_id":100251836,"site_name":"SC-Brazil"}' category: type: string example: Network and Traffic sub_category: type: string example: Interface designation: type: string example: root acknowledged: type: boolean example: false acknowledged_by: type: string example: John Doe snow_assignee: type: string example: '' snow_priority: type: string example: '' snow_status: type: string example: '' snow_ticket_id: type: string example: '' primary_impacted_objects: $ref: '#/components/schemas/ImpactedObjects' related_impacted_objects: $ref: '#/components/schemas/ImpactedObjects' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' parameters: - $ref: '#/components/parameters/PrismaTenantHeader' - $ref: '#/components/parameters/PrismaRegionHeader' - name: incident-id in: path required: true description: The unique identifier of the incident. schema: type: string tags: - Incidents APIs components: schemas: FilterObject: type: object properties: rules: type: array items: $ref: '#/components/schemas/FilterRule' ImpactedObjects: type: object properties: agent_ids: type: array example: [] items: type: string aggr_locations: type: array example: [] items: type: string app_names: type: array example: [] items: type: string asn_org_names: type: array example: [] items: type: string auth_server_profiles: type: array example: [] items: type: string auth_servers: type: array example: [] items: type: string bgp_peer_names: type: array example: [] items: type: string certificate_names: type: array example: [] items: type: string cluster_names: type: array example: [] items: type: string cves: type: array example: [] items: type: string device_ids: type: array example: [] items: type: string directory_ids: type: array example: [] items: type: string dns_servers: type: array example: [] items: type: string gp_versions: type: array example: [] items: type: string gre_tunnel_names: type: array example: [] items: type: string host_names: type: array example: [] items: type: string ike_gateway_names: type: array example: [] items: type: string interfaces: type: array example: [] items: type: string licenses: type: array example: [] items: type: string link_names: type: array example: [] items: type: string locations: type: array example: [] items: type: string log_receivers: type: array example: [] items: type: string nat_policies: type: array example: [] items: type: string packages: type: array example: [] items: type: string roles: type: array example: [] items: type: string security_checks: type: array example: [] items: type: string security_objects: type: array example: [] items: type: string security_types: type: array example: [] items: type: string sha256s: type: array example: [] items: type: string site_names: type: array example: [] items: type: string slots: type: array example: [] items: type: string spn_names: type: array example: [] items: type: string theaters: type: array example: [] items: type: string tunnel_names: type: array example: [] items: type: string user_locations: type: array example: [] items: type: string zones: type: array example: [] items: type: string PaginationObject: type: object properties: page_size: type: integer example: 25 page_number: type: integer example: 1 order_by: type: array items: type: object properties: property: type: string example: updated_time order: type: string example: desc enum: - asc - desc ErrorResponse: type: object properties: errorCode: type: string example: REST10001 message: type: string example: Unexpected server error details: type: string example: Failed to process request FieldListItem: type: object properties: property: type: string example: updated_time alias: type: string example: updated_time dataType: type: string example: timestamp dataClass: type: string example: timestamp sequence: type: string example: '1' type: type: string example: timestamp FilterRule: type: object properties: property: type: string example: status operator: type: string example: in values: type: array items: type: string example: - Raised SearchResponseHeader: type: object properties: createdAt: type: string format: date-time example: '2026-03-12T19:38:43Z' dataCount: type: integer example: 50 requestId: type: string example: af683747-79af-46bb-b2f1-54d050c4eaab queryInput: type: object properties: time_range: type: string example: last 180 day(s) event_time: type: object properties: from: type: string format: date-time example: '2025-09-13T00:00:00Z' to: type: string format: date-time example: '2026-03-12T19:37:59Z' from_epoch: type: integer format: int64 example: 1757721600000 to_epoch: type: integer format: int64 example: 1773344279000 isResourceDataOverridden: type: boolean example: false fieldList: type: array items: $ref: '#/components/schemas/FieldListItem' status: type: object properties: subCode: type: integer example: 200 pagination: type: object properties: current_page: type: integer example: 1 order_by: type: array items: type: object properties: property: type: string example: updated_time order: type: string enum: - asc - desc next_page: type: integer example: 2 page_count: type: integer example: 7 total_count: type: integer example: 318 page_size: type: integer example: 50 name: type: string example: netsec/incidents/incidents_list cache_operation: type: string example: IGNORED parameters: PrismaRegionHeader: in: header name: X-PANW-Region description: The region for request(e.g., americas, europe, uk, au etc). required: true schema: type: string PrismaTenantHeader: in: header name: prisma-tenant description: The tenant and sub-tenant ID identifier (e.g., tenant_id:sub_tenant_id). required: false schema: type: string securitySchemes: JWT: type: http description: JWT authentication with bearer token scheme: bearer bearerFormat: Bearer [token]