Threat Vault API
A REST API for querying Palo Alto Networks threat signature metadata, content release notes, and threat intelligence data. The API provides access to antivirus signatures, anti-spyware signatures, vulnerability protection (IPS) signatures, and file type identification data. Supports queries by signature ID, CVE, threat name, and content release version. Replaces the deprecated AutoFocus API for threat intelligence lookups. Requires an Advanced Threat Prevention or Threat Prevention subscription.
Documentation
Documentation
https://pan.dev/threat-vault/api/
GettingStarted
https://pan.dev/cdss/docs/getstarted/
Authentication
https://pan.dev/cdss/docs/authentication/
GettingStarted
https://pan.dev/cdss/docs/api-call/
Specifications
OpenAPI
openapi/palo-alto-threat-vault-api-openapi-original.yml
JSON-LD
json-ld/palo-alto-threat-vault-api-context.jsonld
Schemas & Data
JSONSchema
json-schema/threat-vault-api-api-stats-schema.json
JSONSchema
json-schema/threat-vault-api-atp-report-list-schema.json
JSONSchema
json-schema/threat-vault-api-atp-report-schema.json
JSONSchema
json-schema/threat-vault-api-release-note-schema.json
JSONSchema
json-schema/threat-vault-api-release-notes-list-schema.json
JSONSchema
json-schema/threat-vault-api-threat-history-entry-schema.json
JSONSchema
json-schema/threat-vault-api-threat-history-list-schema.json
JSONSchema
json-schema/threat-vault-api-threat-list-schema.json
JSONSchema
json-schema/threat-vault-api-threat-signature-schema.json
JSONStructure
json-structure/threat-vault-api-api-stats-structure.json
JSONStructure
json-structure/threat-vault-api-atp-report-list-structure.json
JSONStructure
json-structure/threat-vault-api-atp-report-structure.json
JSONStructure
json-structure/threat-vault-api-release-note-structure.json
JSONStructure
json-structure/threat-vault-api-release-notes-list-structure.json
JSONStructure
json-structure/threat-vault-api-threat-history-entry-structure.json
JSONStructure
json-structure/threat-vault-api-threat-history-list-structure.json
JSONStructure
json-structure/threat-vault-api-threat-list-structure.json
JSONStructure
json-structure/threat-vault-api-threat-signature-structure.json
Examples
Example
examples/threat-vault-api-api-stats-example.json
Example
examples/threat-vault-api-atp-report-example.json
Example
examples/threat-vault-api-atp-report-list-example.json
Example
examples/threat-vault-api-release-note-example.json
Example
examples/threat-vault-api-release-notes-list-example.json
Example
examples/threat-vault-api-threat-history-entry-example.json
Example
examples/threat-vault-api-threat-history-list-example.json
Example
examples/threat-vault-api-threat-list-example.json
Example
examples/threat-vault-api-threat-signature-example.json
OpenAPI
#Antivirus
#CVE
#IPS
#Signatures
#Threat Intelligence