Introduction
Please refer [IoT Public API Authentication](/iot/api/iot-public-api-new) to know how to get API Bearer token<br/>
IoT Public API Authentication
IoT Security uses the Strataβ’ Cloud Manager authentication and
DEPRECATED - IoT Standalone Public API Authentication
To call public apis via the IoT Standalone Portal use the api path//.iot.paloaltonetworks.com/pub/v4.0/{APIROUTE}
Get Security Alerts
Get a list of security alerts. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Resolve a Security Alert
Resolve a security alert. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Alert or Vulnerability Capabilities
Listing the current IoT capabilities on alert and vulnerability <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - Aruba WLC
Update devices in your IoT Security inventory with device information that Cortex XSOAR retrieves from integrated Aruba WLAN controllers. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Assign Sites to an Organization Group
Assign up to 1000 sites to a group, by site name (`external_id`). A site belongs to one group, so each site is moved out of the group it was in. Assigning sites to the top-level group removes them from their groups. <br/> If the group or any of the sites does not exist, the request returns HTTP 400, names what is missing, and changes nothing. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - Cellular Devices
Bulk device updates for cellular devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - Cisco WLC
Update devices in your IoT Security inventory with device information that Cortex XSOAR retrieves from integrated Cisco WLAN controllers. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Create a custom attribute
Create a custom attribute. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Create Network Segment Definition
Create one new network segment definition in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Create Organization Groups
Create one or more groups in the organization hierarchy. Send one group, or an array of up to 1000 groups. <br/> A `parent` can be an existing group or a group listed earlier in the same request, so several levels can be created in one request: list each parent before its children. An empty, `null` or omitted `parent` creates the group directly under the top-level group. <br/> Group names are unique in a tenant. The hierarchy can be at most five levels deep, counting the top-level group. <br/> The request is all or nothing: if any group is rejected (for example a name that is already used, a parent that does not exist or is listed after its child, or a group that would be too deep), the request returns HTTP 400 and no group is created. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Create Site Definitions
Create one or more site definitions in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Create Subnet Definition
Create a new subnet definition in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - Crowdstrike Falcon Devices
Bulk device updates for Crowdstrike Falcon devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - Custom Attribute
Update devices custom attributes values <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Delete a custom attribute.
Delete a custom attribute. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Delete Network Segment Definition
Delete one network segment definition from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Delete an Organization Group
Delete one group. Its subgroups and sites are not deleted: they move to the deleted group's parent group. Sites that move to the top-level group are no longer in any group. No site or device data is removed. <br/> The top-level group cannot be deleted. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Delete Site Definitions
Delete one or more site definitions from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Delete Subnet Definition
Delete a subnet definition from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Device Attributes
Get List of All Device Attributes. Native device attributes and attributes from enabled third party integrations are returned. Only available to customers with SCM access. <br/> This api is not supported for IoT Standalone Portal customers (SCM customers only).
Get Device Details per IP Address
Get a list of device details for the device with the specified IP address. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Device Details per MAC Address
Get a list of device details for the device with the specified MAC address or, for a static IP device, the device with the specified static IP address. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get the Device Inventory V2
Get a list of all the devices in your IoT Security inventory. Specify what device attributes to return. Only available to customers with SCM access. <br/> <b>Rate limiting</b>: 60 times per minute <br/> This api is not supported for IoT Standalone Portal customers (SCM customers only).
Get the Device Inventory
Get a list of all the devices in your IoT Security inventory. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Search Device or Multi-interface Device
Searching for a device or multi-interface by either the IP address or the Mac address. <br/> <b>Rate limiting</b>: 60 times per minute <br/> This api is not supported for IoT Standalone Portal customers (SCM customers only).
Bulk Device Updates - Cisco DNAC and Prime
Update devices in your IoT Security inventory with select device information that Cortex XSOAR retrieves from an integrated Cisco DNA Center or Cisco Prime instance. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get a list of custom attributes
Get a list of custom attributes. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get a list of saved filters
Get a list of saved filters. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Network Segment Definitions
Retrieve network segment definitions from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Organization Hierarchy
Retrieve the organization hierarchy as one list: the top-level group (named after the tenant), its groups and subgroups, and the sites in each group, as shown on the Sites page of the Device Security GUI. <br/> Each node has its `name`, its `type` (`root`, `group` or `site`), the name of its `parent` group, and its `path` (the names from the top-level group down to the node). For a site, `name` is the site's `external_id`, the value shown as 'Name' in the GUI. <br/> Nodes are listed depth first, and the groups and sites under each parent are sorted by name. Sites that are not in any group are listed under the top-level group, and groups without sites are included. Only the groups and sites your account can access are returned; the top-level group is always returned. <br/> Use `group` to get one group and everything beneath it, and `type` to keep one kind of node. An unknown query parameter returns HTTP 400. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Site Definitions
Retrieve site definitions from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Subnet Definitions
Retrieve subnet definitions from IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Subnet Updates - IPAM Infoblox
Bulk subnet updates from customer IPAM (infoblox) <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Network Discovery Bulk Device Endpoint Updates
Bulk device endpoint updates for network discovery devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Network Discovery Bulk Device Node Graph Updates
Bulk device node graph updates for network discovery devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Network Discovery Bulk Device L2L3 Updates
Bulk device l2l3 updates for network discovery devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Activated Policy Rule Recommendations
Fetch all activated policy rule recommendations or all the activated recommendations for one or more IoT device profiles. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Profile Mapping
Get a list of mappings of each device profile to a category and industry vertical. This list is for all device profiles that can appear in IoT Security, not just those in your environment. <br/> <b>Rate limiting</b>: 180 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
retain the incoming list of rules while remove everything else.
remove invalid firewall security rules <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Removing Manual Tag From The Devices
Removing manual tag from the devices. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Revert to an Unshared IP Block
Revert a shared block to an unshared IP block. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - SCCM Devices
Bulk device updates for sccm devices <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Bulk Device Updates - SNMP
Update devices in your IoT Security inventory with device information that Cortex XSOAR retrieves from integrated switches through SNMP. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Adding Manual Tag to Devices
Adding manual tag to the devices. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get a List of User-defined Tags
Get a list of user-defined tags assigned to IoT devices. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
update device CVE from 3rd party integration and join with enxisting IoT device CVE records.
update device CVE from 3rd party integration <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Transfer to Shared IP Block
Transfer a subnet to a shared IP block. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Unassign Sites from an Organization Group
Remove up to 1000 sites from a group, by site name (`external_id`). The sites then sit directly under the top-level group. The request takes a JSON body, like the assign request. <br/> Every site must currently be in that group. Otherwise the request returns HTTP 400, names the sites that are not in the group, and changes nothing. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Update a custom attribute
Update a custom attribute. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Update Network Segment Definition
Update one network segment definition in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Rename or Move an Organization Group
Rename one group, move it under another group, or both. The group keeps its subgroups and sites, and a move takes them along. <br/> Groups are identified by name, so renaming a group changes the name that scripts and integrations must use for it. <br/> The top-level group cannot be renamed or moved. A move that would place a group under itself or one of its subgroups, or make the hierarchy deeper than five levels (counting the top-level group), returns HTTP 400. If another request moves a group at the same time and the two moves conflict, the request returns HTTP 400 without making a change; retry it. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
update a list of firewall security rules.
update firewall secrity rules <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Update Site Definitions
Update one or more site definitions in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Update Subnet Definition
Update a subnet definition in IoT Security. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get Vulnerabilities
Get a list of vulnerability instances. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Resolve Vulnerabilty Instances
Mark one or more instances of a vulnerability as resolved. <br/> <b>Rate limiting</b>: 60 times per minute <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Collect Profile ACL Sync Job Status
Receive the Profile ACL sync status from Xsoar server <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Collect 3rd party scanner details from Xsoar Server
Collect 3rd party scanner details from Xsoar Server <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Collect Device Vulnerability Scan report from Xsoar Server
To let Xsoar server report back the device vulnerability scan report <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
IoT uses a heartbeat to track xsoar instance health
xsoar instance send a heartbeat to IoT. <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
Get a list of active integrations
To get a list of active integrations (status = success). If third-party license is basic, only three integrations are allowed, otherwise there is no limitation <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.
sync xsoar integration playbook status to IoT
sync xsoar integration playbook status <br/> For customers using the IoT Standalone Portal, refer to IoT Standalone Public API Authentication page.