Palo Alto Networks

PAN-OS XML API

The comprehensive XML-based API for PAN-OS providing full access to all firewall configuration, operational commands, reporting, logging, and commit operations. Supports request types including keygen for authentication, config for configuration changes using XPath, op for operational commands, report for generating reports, log for retrieving traffic and threat logs, and user-id for dynamic user-to-IP mapping.

GitHub

Documentation

📖
Documentation
https://pan.dev/panos/docs/xmlapi/
📖
GettingStarted
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/get-started-with-the-pan-os-xml-api
📖
APIReference
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/pan-os-xml-api-request-types
📖
Authentication
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/pan-os-security-rule-schema.json

API entry from apis.yml

apis.yml Raw ↑ 
aid: palo-alto-networks:pan-os-xml-api
name: PAN-OS XML API
tags:
- Configuration
- Firewall
- Monitoring
- Operations
- XML
image: https://kinlane-productions2.s3.amazonaws.com/apis-json/apis-json-logo.jpg
baseURL: https://{firewall}/api/
humanURL: https://pan.dev/panos/docs/xmlapi/
properties:
- url: https://pan.dev/panos/docs/xmlapi/
  type: Documentation
- url: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/get-started-with-the-pan-os-xml-api
  type: GettingStarted
- url: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/pan-os-xml-api-request-types
  type: APIReference
- url: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key
  type: Authentication
- url: json-schema/pan-os-security-rule-schema.json
  type: JSONSchema
description: The comprehensive XML-based API for PAN-OS providing full access to all firewall configuration,
  operational commands, reporting, logging, and commit operations. Supports request types including keygen
  for authentication, config for configuration changes using XPath, op for operational commands, report
  for generating reports, log for retrieving traffic and threat logs, and user-id for dynamic user-to-IP
  mapping.