openapi: 3.2.0
info:
  contact: {}
  description: ' The Threat Prevention API endpoints are available to customers with an active Threat Prevention or Advanced Threat Prevention subscription. List of Threat Prevention API endpoints: 1. Link to [Request Content Release Notes](/threat-vault/api/releasenotes) 2. Link to [Request Threat Metadata](/threat-vault/api/threats) 3. Link to [Request Threat Signature Metadata in Batch Mode](/threat-vault/api/threatsbatch) 4. Link to [Request Threat Signature Release History](/threat-vault/api/threatshistory) 5. Link to [Request CVE Coverage Information](/threat-vault/api/get-cve-coverage) '
  title: Threat Prevention API
  version: '1.0'
servers:
- url: https://api.threatvault.paloaltonetworks.com/service/v1
tags:
- name: Threat Prevention
paths:
  /threats/cve-coverage:
    get:
      summary: Request CVE Coverage Information
      tags:
      - Threat Prevention
      description: Retrieves coverage information for a specified CVE ID.
      operationId: getCVECoverage
      parameters:
      - name: cve_id
        in: query
        description: The CVE ID to retrieve coverage for
        required: true
        schema:
          type: string
          pattern: ^CVE-\d{4}-\d{4,}$
          example: CVE-2021-1647
      security:
      - X-API-KEY: []
      responses:
        '200':
          description: Successful response with CVE coverage information
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    description: Indicates if the request was successful
                    example: true
                  link:
                    type: object
                    properties:
                      next:
                        type:
                        - string
                        - 'null'
                        description: Link to the next page of results
                      previous:
                        type:
                        - string
                        - 'null'
                        description: Link to the previous page of results
                  count:
                    type: integer
                    description: Number of records returned
                    example: 2
                  data:
                    oneOf:
                    - $ref: '#/components/schemas/CoveredCVEResponse'
                    - $ref: '#/components/schemas/CVECoverageInfo'
                  message:
                    type: string
                    description: Message describing the outcome of the request
                    example: Successful
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CVECoverageErrorResponse'
              examples:
                invalidCVE:
                  value:
                    success: false
                    message: 'cve_id: Value is invalid.'
                nonExistentCVE:
                  value:
                    success: false
                    message: CVE ID doesn't exist in NVD database
        '401':
          description: Unauthorized - Invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CVECoverageAPIKeyErrorResponse'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CVECoverageServerErrorResponse'
  /release-notes:
    get:
      description: "A GET request to retrieve the release notes information by type and version.\n\n- Notes:\n  - Any Content release notes before Version 8000 is best effort.\n"
      operationId: releasenotes
      parameters:
      - description: 'The type of the release notes (ex. Content).

          >⚠️ ***Use without quotes***

          '
        in: query
        name: type
        required: true
        schema:
          enum:
          - content
          type: string
      - description: " The release version (ex. 8446) or content version (ex. 8446-6886) of the release notes.\n\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' 'https://api.threatvault.paloaltonetworks.com/service/v1/release-notes?type=content&version=8446-6886'\n```\n\nUse latest for latest release version:\n\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' 'https://api.threatvault.paloaltonetworks.com/service/v1/release-notes?type=content&version=latest'\n```\n "
        in: query
        name: version
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  count:
                    description: The total number of entries found.
                    example: 2
                    type: integer
                  data:
                    description: The data of the response.
                    items:
                      $ref: '#/components/schemas/ReleaseNotesDataList'
                    type: array
                  link:
                    description: The pagination information of the results.
                    items:
                      $ref: '#/components/schemas/Pagination'
                    type: array
                  message:
                    description: Generic response message.
                    example: Successful
                    type: string
                  success:
                    description: The response status.
                    example: true
                    type: boolean
                type: object
          description: Request succeeded
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
      security:
      - X-API-KEY: []
      summary: Request Content Release Notes
      tags:
      - Threat Prevention
  /threats:
    get:
      description: "A GET request to retrieve threat metadata. The nature of the query is determined by the query parameter that you provide on the call to this API. \n- Notes: \n  - Optionally, each query parameter can be used together with the \"type\" query parameter to filter out the results.\n  - Any Antivirus / WildFire release summary information before **February 2020** is best-effort since the information is not available.\n"
      operationId: threats
      parameters:
      - description: 'Query a specific Threat signature by signature ID. '
        in: query
        name: id
        schema:
          type: string
      - description: "Provides the threat signatures metadata by exact match of the signature names.\n\n*Note: IPS threat signatures also support partial match.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?name=Microsoft+PE+File'\n```\n"
        in: query
        name: name
        schema:
          type: string
      - description: "Provides the threat signatures metadata by exact or partial match of the CVE tied to the signatures.\n\n*Valid partial CVE format: CVE-YYYY*\n\n*Valid exact CVE format: CVE-YYYY-NNNN (NNNN can be 4 or more digits)*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?cve=CVE-2020-1234'\n```\nor \n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?cve=CVE-2021'\n```\n"
        in: query
        name: cve
        schema:
          type: string
      - description: "Provides the threat signature metadata by matching the vendor ID tied to the signatures.\n\n*This parameter is only supported for IPS threat signature requests.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?vendor=MS16-095'\n```\n"
        in: query
        name: vendor
        schema:
          type: string
      - description: "Used together with toReleaseDate field. Provides the IPS threat signatures metadata by the release dates range.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8440&toReleaseVersion=8446'\n```\n"
        in: query
        name: fromReleaseDate
        schema:
          type: string
      - description: 'The right boundary of date range query, must use with `fromReleaseDate`. Example can be found in **fromReleaseDate** section '
        in: query
        name: toReleaseDate
        schema:
          type: string
      - description: "Used together with toReleaseVersion field. Provides the IPS threat signatures metadata by the release versions range.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8440&toReleaseVersion=8446'\n```\n"
        in: query
        name: fromReleaseVersion
        schema:
          type: string
      - description: 'The right boundary of version range query, must use with `fromReleaseVersion`. Example can be found in **toReleaseVersion** section '
        in: query
        name: toReleaseVersion
        schema:
          type: string
      - description: "Provides the IPS threat signatures metadata by the release date.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseDate=2021-08-17'\n```\n"
        in: query
        name: releaseDate
        schema:
          type: string
      - description: "Provides the IPS threat signatures metadata by the release version.\n\n*Only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseVersion=8446'\n```\n"
        in: query
        name: releaseVersion
        schema:
          type: string
      - description: "Provides the threat signature metadata based on the threat type. Use together with the other fields to filter out the results.\n>⚠️ ***Use without quotes***\n\n- Options:\n  - antivirus (Provides Antivirus signatures metadata)\n  - dns (Provides DNS signatures metadata)\n  - fileformat (Provides all IPS File-Format signature metadata)\n  - ips (Provides all IPS signature metadata)\n  - rtdns (Provides Real-Time DNS Detection entries metadata)\n  - spyware (Provides all IPS Anti-Spyware signature metadata)\n  - spywarec2 (Provides Spyware C2 signatures metadata)\n  - vulnerability (Provides all IPS Vulnerability Protection signature metadata)\n    \n---\nGet all IPS signatures:\n```    \ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips'\n```\n*Note: This use-case is only supported for IPS threat signatures: fileformat, spyware, vulnerability*\n\n---\nGet all File-Format signatures that were recently updated between Content Version 8590 and Content Version 8594:\n``` \ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseVersion=8590&toReleaseVersion=8594&type=fileformat'\n```\n"
        in: query
        name: type
        schema:
          enum:
          - ips
          - fileformat
          - spyware
          - vulnerability
          - antivirus
          - dns
          - rtdns
          - spywarec2
          type: string
      - description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?sha256=7879722cd37b1c5b2703ea5a1a92a036a96f4a1fc6272b92c197b3a4b17267cc'\n```\n"
        in: query
        name: sha256
        schema:
          type: string
      - description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?md5=ca066f965dfbc5392871d3fa281236cf'\n```\n"
        in: query
        name: md5
        schema:
          type: string
      - description: "The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips&limit=1000'\n```\n"
        in: query
        name: limit
        required: false
        schema:
          type: string
      - description: "The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats?type=ips&limit=1000&offset=1000'\n```\n"
        in: query
        name: offset
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  count:
                    description: The total number of entries found.
                    example: 6
                    type: integer
                  data:
                    description: The data of the response.
                    items:
                      $ref: '#/components/schemas/ThreatDataList'
                    type: array
                  link:
                    description: The pagination information of the results.
                    items:
                      $ref: '#/components/schemas/Pagination'
                    type: array
                  message:
                    description: Generic response message.
                    example: Successful
                    type: string
                  success:
                    description: The response status.
                    example: true
                    type: boolean
                type: object
          description: Request succeeded
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
      security:
      - X-API-KEY: []
      summary: Request Threat Metadata
      tags:
      - Threat Prevention
    post:
      description: "A POST request to retrieve the threats signature metadata by id, name or sample hash (sha256 or md5) in batch mode. Batch limit is 100 entries.\n\n- Notes: \n  - Optionally, each query parameter can be used together with the \"type\" query parameter to filter out the results.\n  - Any Antivirus / WildFire release summary information before **February 2020** is best-effort since the information is not available.\n"
      operationId: threatsbatch
      requestBody:
        content:
          application/json:
            schema:
              properties:
                id:
                  description: "Provides the threat signatures metadata by exact match of the signature ids.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"id\": [\"280392504\"]}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
                  items:
                    type: string
                  type: array
                md5:
                  description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"md5\": [\"ca066f965dfbc5392871d3fa281236cf\"]}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
                  items:
                    type: string
                  type: array
                name:
                  description: "Provides the threat signatures metadata by exact match of the signature names.\n    \n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"name\": [\"Microsoft PE File\"]}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
                  items:
                    type: string
                  type: array
                sha256:
                  description: "Provides the file information and threat signatures that match the hash of the sample.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"sha256\": [\"7879722cd37b1c5b2703ea5a1a92a036a96f4a1fc6272b92c197b3a4b17267cc\"]}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
                  items:
                    type: string
                  type: array
                type:
                  description: "Provides the threat signature metadata based on the threat type. Use together with the other fields to filter out the results.\n>⚠️ ***Use without quotes***\n\n- Options:\n  - antivirus (Provides Antivirus signatures metadata)\n  - dns (Provides DNS signatures metadata)\n  - fileformat (Provides all IPS File-Format signature metadata)\n  - ips (Provides all IPS signature metadata)\n  - rtdns (Provides Real-Time DNS Detection entries metadata)\n  - spyware (Provides all IPS Anti-Spyware signature metadata)\n  - spywarec2 (Provides Spyware C2 signatures metadata)\n  - vulnerability (Provides all IPS Vulnerability Protection signature metadata)\n        \n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"id\": [\"280392504\"], \"type\":\"antivirus\"}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats'\n```\n"
                  enum:
                  - ips
                  - fileformat
                  - spyware
                  - vulnerability
                  - antivirus
                  - dns
                  - rtdns
                  - spywarec2
                  type: string
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  count:
                    description: The total number of entries found.
                    example: 1
                    type: integer
                  data:
                    description: 'The data of the response. '
                    items:
                      $ref: '#/components/schemas/GetThreatBatchList'
                    type: array
                  link:
                    description: The pagination information of the results.
                    items:
                      $ref: '#/components/schemas/Pagination'
                    type: array
                  message:
                    description: Generic response message.
                    example: Successful
                    type: string
                  success:
                    description: The response status.
                    example: true
                    type: boolean
                type: object
          description: Request succeeded
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
      security:
      - X-API-KEY: []
      summary: Request Threat Signature Metadata in Batch Mode
      tags:
      - Threat Prevention
  /threats/history:
    get:
      description: "A GET request to retrieve the threats signature release history by id and package type.\n\n- Notes:\n  - The retention policy of **Antivirus** release history data is for **1 year** (only the last 1 year of release history data will be available).\n  - The retention policy of **WildFire** release history data is for **30 days** (only the last 30 days of release history data will be available).\n  - Any Antivirus / WildFire release history information before **Version 4140** is best-effort since the information is not available.\n  - The Antivirus / WildFire version field in the responses before **Version 4140** is in the format of **XXXX** (ex. \"version\": \"4140\") and after that the format is **XXXX-YYYY** (ex. \"version\": \"4141-4637\").\n  - The Antivirus / WildFire release time before **Version 4140** is the package start building time as the actual release time is not available.\n"
      operationId: threatshistory
      parameters:
      - description: "Provides the threat signature metadata based on the threat type.\n>⚠️ ***Use without quotes***\n\n- Options:\n  - antivirus (Provides Antivirus signature release information)\n  - wildfire (Provides WildFire signature release information)\n"
        in: query
        name: type
        required: true
        schema:
          enum:
          - antivirus
          - wildfire
          type: string
      - description: "Provides the threat signature release history by matching the signature id in the releases.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus'\n```\n"
        in: query
        name: id
        required: true
        schema:
          type: string
      - description: "The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&limit=3'\n```\n"
        in: query
        name: limit
        required: false
        schema:
          type: string
      - description: "The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&limit=3&offset=3'\n```\n"
        in: query
        name: offset
        required: false
        schema:
          type: string
      - description: "The order in which the results to be returned.\n>⚠️ ***Use without quotes***\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=280392504&type=antivirus&order=desc'\n```\n"
        in: query
        name: order
        required: false
        schema:
          enum:
          - asc
          - desc
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  count:
                    description: The total number of entries found.
                    example: 3
                    type: integer
                  data:
                    description: 'The data of the response. '
                    items:
                      $ref: '#/components/schemas/ThreatHistoryDataList'
                    type: array
                  link:
                    description: The pagination information of the results.
                    items:
                      $ref: '#/components/schemas/Pagination'
                    type: array
                  message:
                    description: Generic response message.
                    example: Successful
                    type: string
                  success:
                    description: The response status.
                    example: true
                    type: boolean
                type: object
          description: Request succeeded
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
      security:
      - X-API-KEY: []
      summary: Request Threat Signature Release History
      tags:
      - Threat Prevention
  /edl:
    get:
      operationId: edl
      description: 'A GET request to retrieve the predefined external dynamic lists by name and version.

        '
      parameters:
      - name: name
        in: query
        required: false
        schema:
          type: string
          enum:
          - panw-known-ip-list
          - panw-highrisk-ip-list
          - panw-torexit-ip-list
          - panw-bulletproof-ip-list
        description: "Provides the EDL by the name.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?name=panw-known-ip-list&version=latest'\n```\n"
      - name: ipaddr
        in: query
        required: false
        schema:
          type: string
        description: "Provides the EDLs containing the IP address.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?ipaddr=192.0.2.0'\n```\n"
      - name: version
        in: query
        required: false
        schema:
          type: string
        description: "Provides the EDL by the specific AV package version.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?name=panw-highrisk-ip-list&version=4024'\n```\n\nUse \"latest\" for latest release version:\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?ipaddr=192.0.2.0&version=latest'\n```\n"
      - name: listformat
        in: query
        required: false
        schema:
          type: string
          enum:
          - array
        description: "Optional field to provide more convenient way to ingest the EDL.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?name=panw-known-ip-list&version=latest&listformat=array'\n```\n"
      - name: limit
        in: query
        required: false
        schema:
          type: string
        description: "Optional parameter. The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?name=panw-known-ip-list&version=latest&limit=5'\n```\n"
      - name: offset
        in: query
        required: false
        schema:
          type: string
        description: "Optional parameter. The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/edl?name=panw-torexit-ip-list&version=latest&limit=5&offset=5'\n```\n"
      responses:
        '200':
          description: Request succeeded
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    items:
                      $ref: '#/components/schemas/GetEdlSuccessResponse'
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response message.
                    example: Error message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
      security:
      - X-API-KEY: []
      summary: Request Predefined EDL Content
      tags:
      - Threat Prevention
  /ip-feed:
    get:
      operationId: ip_feed
      security:
      - X-API-KEY: []
      summary: Request IP Feed Information
      tags:
      - Threat Prevention
      description: 'A GET request to retrieve the IP feed information by name, IP address or IP address range.

        '
      parameters:
      - name: name
        in: query
        required: false
        schema:
          type: string
          enum:
          - malicious
          - high-risk
        description: "Provides the IP feed entries by the feed name.\n\n*Note: Returns only entries with 'released' status that exist in the Threat Intelligence database.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed?name=malicious'\n```\n"
      - name: ipaddr
        in: query
        required: false
        schema:
          type: string
        description: "Provides the IP feed information by IP address.\n\n*Note:*\n*Always returns a result.*\n*Returns feed information if IP Address exists in the Threat Intelligence database, \notherwise returns only the Geolocation and Autonomous System information.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed?ipaddr=193.189.116.210'\n```\n"
      - name: fromipaddr
        in: query
        required: false
        schema:
          type: string
        description: "Used together with `toipaddr` field. Provides the IP feed entries based on IP address range.\n\n*Note: Returns entries with 'released', 'disabled' or 'expired' status that exist in the Threat Intelligence database.*\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed?fromipaddr=185.130.5.207&toipaddr=185.130.5.236'\n```\n"
      - name: toipaddr
        in: query
        required: false
        schema:
          type: string
        description: 'The right boundary of date range query, must use with `toipaddr`.


          Example can be found in **toipaddr** section

          '
      - name: limit
        in: query
        required: false
        schema:
          type: string
        description: "Optional parameter. The maximum number of results to return in each page.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed?name=high-risk&limit=3'\n```\n"
      - name: offset
        in: query
        required: false
        schema:
          type: string
        description: "Optional parameter. The starting position of the query in relation to the complete set of the unpaginated results.\n\n---\n```\ncurl -v -H 'X-API-KEY: API_KEY' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed?name=high-risk&limit=10&offset=10'\n```\n"
      responses:
        '200':
          description: Request succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIpFeedSuccessResponse'
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response messa message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response messa message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
    post:
      operationId: ip_feed_batch
      security:
      - X-API-KEY: []
      summary: Request IP Feed Information in Batch Mode
      tags:
      - Threat Prevention
      description: 'A POST request to retrieve the IP feed information by IP address. Batch limit is 100 entries.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                ipaddr:
                  type: array
                  description: "Provides the IP feed information by a list of IP addresses. Limit is 100.\n\n---\n```\ncurl -v -X POST -H 'X-API-KEY: API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"ipaddr\": [\"185.130.5.200\", \"185.130.5.201\", \"185.130.5.202\", \"185.130.5.203\", \"185.130.5.204\", \"185.130.5.205\", \"185.130.5.206\", \"185.130.5.207\", \"185.130.5.208\", \"185.130.5.209\", \"185.130.5.210\"]}' \\\n  'https://api.threatvault.paloaltonetworks.com/service/v1/ip-feed'\n```\n"
                  items:
                    type: string
      responses:
        '200':
          description: Request succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIpFeedSuccessResponse'
          headers:
            X-Day-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per day.
              example: 2000
              schema:
                type: integer
            X-Day-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one day).
              schema:
                type: integer
            X-Day-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one day) resets.
              schema:
                type: integer
            X-Minute-RateLimit-Limit:
              description: The maximum number of requests that the user is permitted to make per minute.
              example: 200
              schema:
                type: integer
            X-Minute-RateLimit-Remaining:
              description: The number of requests remaining in the current rate limit window (one minute).
              schema:
                type: integer
            X-Minute-RateLimit-Reset:
              description: The epoch timestamp at which the current rate limit window (one minute) resets.
              schema:
                type: integer
        4XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response messa message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Client related error response
        5XX:
          content:
            application/json:
              schema:
                properties:
                  message:
                    description: Generic response messa message.
                    type: string
                  success:
                    description: The response status.
                    example: false
                    type: boolean
                type: object
          description: Server related error response
components:
  schemas:
    VulnerabilitySignature:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the vulnerability signature
          example: '90207'
        name:
          type: string
          description: Name of the vulnerability
          example: Microsoft Windows Defender Remote Code Execution Vulnerability
        description:
          type: string
          description: Detailed description of the vulnerability
          example: Microsoft Windows Defender is prone to a remote code execution vulnerability while parsing certain crafted PE files.
        category:
          type: string
          description: Category of the vulnerability
          example: code-execution
        min_version:
          type: string
          description: Minimum version affected
          example: 8.1.0
        max_version:
          type: string
          description: Maximum version affected, empty if no upper bound
          example: ''
        severity:
          type: string
          description: Severity level of the vulnerability
          example: high
        default_action:
          type: string
          description: Default action to take when detected
          example: reset-both
        cve:
          type: array
          items:
            type: string
          description: List of related CVE IDs
          example:
          - CVE-2021-1647
        vendor:
          type: array
          items:
            type: string
          description: List of vendors affected
          example: []
        reference:
          type: array
          items:
            type: string
          description: List of reference URLs
          example:
          - https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2021-1647
        status:
          type: string
          description: Current status of the signature
          example: released
        details:
          type: object
          properties:
            change_data:
              type: string
              description: Information about changes
              example: new coverage
        ori_release_version:
          type: string
          description: Original release version
          example: '8364'
        latest_release_version:
          type: string
          description: Latest release version
          example: '8364'
        ori_release_time:
          type: string
          format: date-time
          description: Original release timestamp
          example: 2021-01-12 10:40:13+00:00
        latest_release_time:
          type: string
          format: date-time
          description: Latest release timestamp
          example: 2021-01-12 10:40:13+00:00
    CVECoverageErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
          description: Error message
          example: 'cve_id: Value is invalid.'
      required:
      - success
      - message
    ReleaseNotesDataList:
      type: object
      properties:
        release_version:
          type: integer
          description: The release version of the update.
          example: 8446
        content_version:
          type: string
          description: The content version of the update.
          example: 8446-6886
        type:
          type: string
          description: The type of the release notes.
          example: content
        json_data:
          type: array
          description: The release notes information.
          items:
            type: object
            properties:
              notes:
                type: array
                description: General notices and reminders.
              applications:
                type: array
                description: The APP-ID updates in the release notes.
              decoders:
                type: array
                description: The decoder updates in the release notes.
                example:
                - improved ...
              data_correlation:
                type: array
                description: The Data Correlation Object updates in the release notes.
                items:
                  type: object
                  properties:
                    new:
                      type: array
                      description: List of new entries.
                    modified:
                      type: array
                      description: List of modified entries.
                    deleted:
                      type: array
                      description: List of deleted entries.
              file_type:
                type: array
                description: The File-Format updates in the release notes.
                items:
                  type: object
                  properties:
                    new:
                      type: array
                      description: List of new entries.
                    modified:
                      type: array
                      description: List of modified entries.
                    disabled:
                      type: array
                      description: List of disabled entries.
              spyware:
                type: array
                description: The Anti-Spyware updates in the release notes.
              vulnerability:
                type: array
                description: The Vulnerability Protection updates in the release notes.
                items:
                  type: object
                  properties:
                    new:
                      type: array
                      description: List of new entries.
                      items:
                        type: object
                        properties:
                          severity:
                            type: string
                            description: The severity of the threat.
                            example: high
                          pan_id:
                            type: integer
                            description: The unique id of the signature.
                            example: 30515
                          attack_name:
                            type: string
                            description: The name of the signature.
                            example: File Loading
                          cve:
                            type: string
                            description: The CVE (Common Vulnerabilities and Exposures) of the threat.
                            example: ''
                          vendor:
                            type: string
                            description: The vulnerability identifier issued by vendor on advisories.
                            example: ''
                          action:
                            type: string
                            description: The default action when the signature is triggered.
                            example: reset-both
                          change_data:
                            type: string
                            description: Additional information about the updated signature.
                            example: updated action to ....
                          min_version:
                            type: string
                            description: The PAN-OS minimum version.
                            example: 8.1.0
                          max_version:
                            type: string
                            description: The PAN-OS maximum version.
                            example: 9.1.0
                    modified:
                      type: array
                      items:
                        type: object
                        properties:
                          severity:
                            type: string
                            description: The severity of the threat.
                            example: high
                          pan_id:
                            type: integer
                            description: The unique id of the signature.
                            example: 30077
                          attack_name:
                            type: string
                            description: The name of the signature.
                            example: Vulnerability
                          cve:
                            type: string
                            description: The CVE (Common Vulnerabilities and Exposures) of the threat.
                            example: CVE-2006-3942, CVE-2006-1314
                          vendor:
                            type: string
                            description: The vulnerability identifier issued by vendor on advisories.
                            example: MS06-063
                          action:
                            type: string
                            description: The default action when the signature is triggered.
                            example: reset-server
                          change_data:
                            type: string
                            description: Additional information about the updated signature.
                            example: updated action to ....
                          min_version:
                            type: string
                            description: The PAN-OS minimum version.
                            example: 8.1.0
                          max_version:
                            type: string
                            description: The PAN-OS maximum version.
                            example: ''
                    disabled:
                      type: array
                      description: List of disabled entries.
    AntivirusSignature:
      type: object
      properties:
        name:
          type: string
          description: Name of the antivirus signature
          example: Virus/Win32.CVE-2021-1647.a
        severity:
          type: string
          description: Severity level of the signature
          example: medium
        type:
          type: string
          description: Type identifier
          example: '0'
        subtype:
          type: string
          description: Subtype of the signature
          example: virus
        description:
          type: string
          description: Human-readable description of the signature
          example: This signature detected Virus/Win32.CVE-2021-1647.a
        action:
          type: string
          description: Action to take when detected
          example: ''
        id:
          type: string
          description: Unique identifier for the signature
          example: '396564186'
        create_time:
          type: string
          format: date-time
          description: Creation timestamp of the signature
          example: 2021-01-11 12:00:48-08:00
        status:
          type: string
          description: Current status of the signature
          example: active
        related_sha256_hashes:
          type: array
          items:
            type: string
          description: SHA256 hashes of related files
          example:
          - 2084858ba68c50881ce80605202febdcd8bd9d62f652f5ee9f9a0809f4b44956
        release:
          type: object
          properties:
            antivirus:
              type: object
              properties:
                first_release_version:
                  type: string
                  description: First version where this signature was released
                  example: '3592'
                first_release_time:
                  type: string
                  format: date-time
                  description: Timestamp of first release
                  example: 2021-01-11 13:34:50+00:00
                last_release_version:
                  type: string
                  description: Latest version where this signature was released
                  example: '5169'
                last_release_time:
                  type: string
                  format: date-time
                  description: Timestamp of latest release
                  example: 2025-04-29 11:00:05+00:00
                in_current_release:
                  type: boolean
                  description: Whether this signature is in the current release
                  example: true
            wildfire:
              type: object
              properties:
                first_release_version:
                  type: string
                  description: First WildFire version where this signature was released
                  example: '524540'
                first_release_time:
                  type: string
                  format: date-time
                  description: Timestamp of first WildFire release
                  example: 2021-01-15 10:46:18+00:00
                last_release_version:
                  type: string
                  description: Latest WildFire version where this signature was released
                  example: '973990'
                last_release_time:
                  type: string
                  format: date-time
                  description: Timestamp of latest WildFire release
                  example: 2025-04-29 23:17:11+00:00
                in_current_release:
                  type: boolean
                  description: Whether this signature is in the current WildFire release
                  example: false
    CVECoverageAPIKeyErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
          description: Error message
          example: 'X-API-KEY: Value is invalid.'
      required:
      - success
      - message
    EdlDataList:
      type: object
      properties:
        version:
          type: string
          description: The version of the release.
          example: '4030'
        name:
          type: string
          description: The name of the predefined EDL.
          example: panw-known-ip-list
        ipaddr:
          type: string
          description: The IP address.
          example: 192.0.2.0
    CoveredCVEResponse:
      type: object
      properties:
        cve_id:
          type: string
          description: The CVE identifier
          example: CVE-2021-1647
        cve_status:
          type: string
          enum:
          - cve_covered
          description: Status of coverage for this CVE
        nvd_link:
          type: string
          description: Link to the NVD database entry for this CVE
          example: https://nvd.nist.gov/vuln/detail/CVE-2021-1647
        antivirus:
          type: array
          items:
            $ref: '#/components/schemas/AntivirusSignature'
          description: Antivirus signatures related to this CVE
        vulnerability:
          type: array
          items:
            $ref: '#/components/schemas/VulnerabilitySignature'
          description: Vulnerability protection signatures related to this CVE
      required:
      - cve_id
      - cve_status
      - nvd_link
    Pagination:
      type: object
      properties:
        next:
          type: string
          description: The URL of previous page with results.
        previous:
          type: string
          description: The URL of next page with results.
    GetIpFeedSuccessResponse:
      type: object
      properties:
        success:
          type: boolean
          description: The response status.
          example: true
        link:
          type: array
          description: The pagination information of the results.
          items:
            $ref: '#/components/schemas/Pagination'
        count:
          type: integer
          description: The total number of entries found.
          example: 1
        data:
          type: array
          description: The data of the response.
          items:
            $ref: '#/components/schemas/IpFeedDataList'
        message:
          type: string
          description: Generic response message.
          example: Successful
    IpFeedDataList:
      type: object
      properties:
        ipaddr:
          type: string
          description: The IP address.
          example: 2.59.154.102
        name:
          type: string
          description: The name of the IP Feed entry.
          example: High Risk IP Feed
        status:
          type: string
          description: The status of the IP Feed entry.
          example: released
        release:
          type: object
          description: The release information.
          properties:
            first_release_version:
              type: string
              description: The release version when the IP Feed was released.
              example: '3566'
            first_release_time:
              type: string
              description: The release time when the IP Feed was released.
              example: '2020-12-16T23:40:24Z'
      geo:
        type: string
        description: The geolocation information of the IP address.
        example: JP (Japan)
      asn:
        type: string
        description: The Autonomous System information of the IP address.
        example: 136526 (ALLCLOUD-AS-AP ALLCLOUD LIMITED, HK)
        geo:
          type: string
          description: The geolocation information of the IP address.
          example: JP (Japan)
        asn:
          type: string
          description: The Autonomous System information IP address.
          example: 136526 (ALLCLOUD-AS-AP ALLCLOUD LIMITED, HK)
    ThreatDataList:
      type: object
      properties:
        fileformat:
          type: array
          description: List of File-Format signatures.
        spyware:
          type: array
          description: List of Anti-Spyware signatures.
        vulnerability:
          type: array
          description: List of Vulnerability Protection signatures.
          items:
            type: object
            properties:
              id:
                type: string
                description: The unique id of the signature.
                example: '30135'
              name:
                type: string
                description: The name of the signature.
                example: Name of the threat
              description:
                type: string
                description: The description of the signature.
                example: Description of the threat ...
              category:
                type: string
                description: The threat category of the signature.
                example: code-execution
              min_version:
                type: string
                description: The PAN-OS minimum version.
                example: 8.1.0
              max_version:
                type: string
                description: The PAN-OS maximum version.
                example: 11.1.0
              severity:
                type: string
                description: The severity of the threat.
                example: high
              default_action:
                type: string
                description: The default action when the signature is triggered.
                example: alert
              cve:
                type: array
                description: The CVE (Common Vulnerabilities and Exposures) of the threat.
                example:
                - CVE-2007-1204
                - CVE-2021-35393
              vendor:
                type: array
                description: The vulnerability identifier issued by vendor on advisories.
                example:
                - MS07-019
              reference:
                type: array
                description: The public reference of the threat.
                example:
                - Url1
                - Url2
              status:
                type: string
                description: The status of the signature.
                example: released
              details:
                type: object
                description: Any additional details of the signature.
                example: {}
              ori_release_version:
                type: string
                description: The original release version of the signature.
                example: '8451'
              latest_release_version:
                type: string
                description: The latest release version of the signature.
                example: '8451'
              ori_release_time:
                type: string
                description: The original release time of the signature.
                example: '2021-08-31 01:25:04'
              latest_release_time:
                type: string
                description: The latest release time of the signature.
                example: '2021-08-31 01:25:04'
    ThreatHistoryDataList:
      type: object
      properties:
        version:
          type: string
          description: The version of the release.
          example: 4020-4531
        build_time:
          type: string
          description: The time when the package was built.
          example: '2022-03-12T22:23:38Z'
        release_time:
          type: string
          description: The time when the package was released externally.
          example: '2022-03-13T03:02:24Z'
    GetEdlSuccessResponse:
      type: object
      properties:
        success:
          type: boolean
          description: The response status.
          example: true
        link:
          type: array
          description: The pagination information of the results.
          items:
            $ref: '#/components/schemas/Pagination'
        count:
          type: integer
          description: The total number of entries found.
          example: 1
        data:
          type: array
          description: The data of the response.
          items:
            $ref: '#/components/schemas/EdlDataList'
        message:
          type: string
          description: Generic response message.
          example: Successful
    CVECoverageServerErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
          description: Error message
          example: Failed to query Threat Vault API
      required:
      - success
      - message
    GetThreatBatchList:
      type: object
      properties:
        antivirus:
          type: array
          description: List of Antivirus signatures.
          items:
            type: object
            properties:
              id:
                type: string
                description: The unique threat signature id.
                example: '280392504'
              name:
                type: string
                description: The threat signature name.
                example: trojan/Win32 DLL.razy.slo
              severity:
                type: string
                description: 'The threat signature severity.

                  *List: low, informative, medium, high or critical*

                  '
                example: medium
              type:
                type: string
                description: A numerical value describing the type of the threat signature.
                example: '0'
              subtype:
                type: string
                description: The threat signature subtype.
                example: virus
              action:
                type: string
                description: The threat signature default action. This is generally empty for Antivirus signatures.
                example: ''
              description:
                type: string
                description: The threat signature description.
                example: This signature detected trojan/Win32 DLL.razy.slo
              create_time:
                type: string
                description: The threat signature creation time.
                example: '2019-06-19T17:06:12Z'
              status:
                type: string
                description: 'The threat signature creation time.

                  *List: active or inactive*

                  '
                example: active
              related_sha256_hashes:
                type: array
                description: The list of related sha256 hashes for the threat signature.
                items:
                  type: string
                example:
                - 47e3da7e179b755a1ccc8fe8fc506a2fb15baff2c124b15cf2f5e29038f3d1ac
                - 5cd3e058f6049a31a42c292ebb091a1b5ea4bd9c7bc6fed5ac8a33c5fc89924a
              release:
                type: object
                description: The threat signature release information.
                properties:
                  antivirus:
                    type: object
                    description: The threat signature information related to Antivirus package updates.
                    properties:
                      first_release_version:
                        type: string
                        description: The release version when the threat signature was first released with Antivirus package.
                        example: '3017'
                      first_release_time:
                        type: string
                        description: The release time when the threat signature was first released with Antivirus package.
                        example: '2018-03-02T11:06:51Z'
                      last_release_version:
                        type: string
                        description: The release version when the threat signature was last released with Antivirus package.
                        example: '4115'
                      last_release_time:
                        type: string
                        description: The release time when the threat signature was last released with Antivirus package.
                        example: '2022-06-14T13:35:54Z'
                  wildfire:
                    type: object
                    description: The threat signature information related to WildFire package updates.
                    properties:
                      first_release_version:
                        type: string
                        description: The release version when the threat signature was first released with WildFire package.
                        example: '359199'
                      first_release_time:
                        type: string
                        description: The release time when the threat signature was first released with WildFire package.
                        example: '2019-06-19T17:06:35Z'
                      last_release_version:
                        type: string
                        description: The release version when the threat signature was last released with WildFire package.
                        example: '672412'
                      last_release_time:
                        type: string
                        description: The release time when the threat signature was last released with WildFire package.
                        example: '2022-06-14T16:56:15Z'
    CVECoverageInfo:
      type: object
      properties:
        cve_id:
          type: string
          description: The CVE identifier
          example: CVE-2021-1647
        nvd_link:
          type: string
          description: Link to the NVD database entry for this CVE
          example: https://nvd.nist.gov/vuln/detail/CVE-2021-1647
        cve_status:
          type: string
          description: Status of coverage for this CVE
          enum:
          - cve_not_reviewed
          - cve_being_monitored
          - cve_assigned
          - cve_under_testing
          - cve_pending_release
          - cve_cannot_cover
        release_week:
          type:
          - string
          - 'null'
          format: date
          description: Expected release date for pending coverage
          example: 2025-04-15
        not_cover_reason:
          type:
          - string
          - 'null'
          enum:
          - encrypted_traffic_limitations
          - risk_of_high_false_positives
          - threat_detection_limitations
          - performance_considerations
          description: Reason why the CVE cannot be covered. This field will only be available when ```cve_status``` is ```cve_cannot_cover```
        response_text:
          type: string
          description: Human-readable response explaining the status
          example: We have not looked into this CVE. Contact Customer Support if you want us to consider this CVE.
      required:
      - cve_id
      - nvd_link
      - cve_status
      - response_text
  securitySchemes:
    X-API-KEY:
      description: API key to query https://api.threatvault.paloaltonetworks.com/service/v1
      in: header
      name: X-API-KEY
      type: apiKey