{ "info": { "_postman_id": "65d54854-c58c-4950-bad1-c445283ae0ba", "name": "Palo Alto Networks Cortex XSOAR REST API", "description": "REST API for the Cortex XSOAR (formerly Demisto) security orchestration, automation, and response (SOAR) platform. Provides programmatic access to incidents, investigations, playbooks, entries, and integrations. Enables automation of security workflows, creation and management of incidents, execution of playbooks, and integration with third-party security tools. Authentication uses an API key passed in the Authorization header. API keys are generated from the XSOAR settings under Integrations > API Keys.\n\nContact Support:\n Name: Palo Alto Networks Developer Support", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "lastUpdatedBy": "35240", "uid": "35240-65d54854-c58c-4950-bad1-c445283ae0ba" }, "item": [ { "name": "incident", "item": [ { "name": "{id}", "item": [ { "name": "Palo Alto Networks Get Incident", "id": "da39afc9-afb4-485c-9d4a-424b49fba71b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/incident/:id", "host": [ "{{baseUrl}}" ], "path": [ "incident", ":id" ], "variable": [ { "id": "8cac0c2b-c365-4ea0-995f-05b087b73320", "key": "id", "value": "", "description": "(Required) Unique identifier of the incident." } ] }, "description": "Returns a specific incident by its unique identifier, including all fields and metadata." }, "response": [ { "id": "68717ad7-fbf6-43b0-8a5d-788a657138da", "name": "Incident returned successfully.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incident/:id", "host": [ "{{baseUrl}}" ], "path": [ "incident", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 0,\n \"severity\": 5,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"exercitation9\": \"consequat\",\n \"dolor4b\": 737021.269022271\n }\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-68717ad7-fbf6-43b0-8a5d-788a657138da" }, { "id": "0435f0ae-4677-4a60-a6c0-c22179c6bbea", "name": "Missing or invalid API key.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incident/:id", "host": [ "{{baseUrl}}" ], "path": [ "incident", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-0435f0ae-4677-4a60-a6c0-c22179c6bbea" }, { "id": "d1180aa7-2765-4e50-af90-3df8247ecf15", "name": "The requested resource was not found.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incident/:id", "host": [ "{{baseUrl}}" ], "path": [ "incident", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-d1180aa7-2765-4e50-af90-3df8247ecf15" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-da39afc9-afb4-485c-9d4a-424b49fba71b" } ], "id": "e63ff540-138e-4ffe-91c9-95a5a1a78c3d", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-e63ff540-138e-4ffe-91c9-95a5a1a78c3d" }, { "name": "update", "item": [ { "name": "Palo Alto Networks Update Incident", "id": "30121910-d42b-45f9-93bc-2569d5d3e55f", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"id\": \"\",\n \"version\": \"\",\n \"status\": 2,\n \"severity\": 2,\n \"owner\": \"\",\n \"details\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"CustomFields\": {\n \"mollitf5\": 74166108,\n \"Ut_9\": 18551385.253928304\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident/update", "host": [ "{{baseUrl}}" ], "path": [ "incident", "update" ] }, "description": "Updates one or more fields of an existing incident. Only the fields provided in the request body are modified. Supports updating status, severity, owner, labels, and custom fields." }, "response": [ { "id": "8485d269-bfae-49cd-83ee-dff819be4321", "name": "Incident updated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"id\": \"\",\n \"version\": \"\",\n \"status\": 2,\n \"severity\": 2,\n \"owner\": \"\",\n \"details\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"CustomFields\": {\n \"mollitf5\": 74166108,\n \"Ut_9\": 18551385.253928304\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident/update", "host": [ "{{baseUrl}}" ], "path": [ "incident", "update" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 0,\n \"severity\": 5,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"exercitation9\": \"consequat\",\n \"dolor4b\": 737021.269022271\n }\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-8485d269-bfae-49cd-83ee-dff819be4321" }, { "id": "8e94c900-227a-4c03-972e-b4a03a869ffb", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"id\": \"\",\n \"version\": \"\",\n \"status\": 2,\n \"severity\": 2,\n \"owner\": \"\",\n \"details\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"CustomFields\": {\n \"mollitf5\": 74166108,\n \"Ut_9\": 18551385.253928304\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident/update", "host": [ "{{baseUrl}}" ], "path": [ "incident", "update" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-8e94c900-227a-4c03-972e-b4a03a869ffb" }, { "id": "eaa11eaf-7f0d-43f8-adaf-61dfe724de25", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"id\": \"\",\n \"version\": \"\",\n \"status\": 2,\n \"severity\": 2,\n \"owner\": \"\",\n \"details\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"CustomFields\": {\n \"mollitf5\": 74166108,\n \"Ut_9\": 18551385.253928304\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident/update", "host": [ "{{baseUrl}}" ], "path": [ "incident", "update" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-eaa11eaf-7f0d-43f8-adaf-61dfe724de25" }, { "id": "a863d82c-6ae4-4730-8c20-b5a5fe38f271", "name": "The requested resource was not found.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"id\": \"\",\n \"version\": \"\",\n \"status\": 2,\n \"severity\": 2,\n \"owner\": \"\",\n \"details\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"CustomFields\": {\n \"mollitf5\": 74166108,\n \"Ut_9\": 18551385.253928304\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident/update", "host": [ "{{baseUrl}}" ], "path": [ "incident", "update" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-a863d82c-6ae4-4730-8c20-b5a5fe38f271" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-30121910-d42b-45f9-93bc-2569d5d3e55f" } ], "id": "56bee8c6-2065-4017-a35b-ec70ba7b5e72", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-56bee8c6-2065-4017-a35b-ec70ba7b5e72" }, { "name": "Palo Alto Networks Create Incident", "id": "9316490d-e855-45a1-8950-50358e876552", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"type\": \"\",\n \"severity\": 3,\n \"owner\": \"\",\n \"occurred\": \"\",\n \"details\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"createInvestigation\": true,\n \"CustomFields\": {\n \"id_c0\": 62753684.27310583,\n \"in_9\": 62038932\n },\n \"rawJson\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident", "host": [ "{{baseUrl}}" ], "path": [ "incident" ] }, "description": "Creates a new incident in Cortex XSOAR. Incidents represent security events requiring investigation and response. Specify the incident type, severity, name, and any custom fields defined for the incident type. If an associated playbook is configured for the incident type, it starts automatically." }, "response": [ { "id": "756ce5f6-e861-4fcc-bf53-4c79369ed64f", "name": "Incident created successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"type\": \"\",\n \"severity\": 3,\n \"owner\": \"\",\n \"occurred\": \"\",\n \"details\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"createInvestigation\": true,\n \"CustomFields\": {\n \"id_c0\": 62753684.27310583,\n \"in_9\": 62038932\n },\n \"rawJson\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident", "host": [ "{{baseUrl}}" ], "path": [ "incident" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 0,\n \"severity\": 5,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"exercitation9\": \"consequat\",\n \"dolor4b\": 737021.269022271\n }\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-756ce5f6-e861-4fcc-bf53-4c79369ed64f" }, { "id": "a7b0507e-7d0a-4d42-ab97-fa274911aa60", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"type\": \"\",\n \"severity\": 3,\n \"owner\": \"\",\n \"occurred\": \"\",\n \"details\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"createInvestigation\": true,\n \"CustomFields\": {\n \"id_c0\": 62753684.27310583,\n \"in_9\": 62038932\n },\n \"rawJson\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident", "host": [ "{{baseUrl}}" ], "path": [ "incident" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-a7b0507e-7d0a-4d42-ab97-fa274911aa60" }, { "id": "ac71a9f0-1450-4567-b5e2-f143d215f04d", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"type\": \"\",\n \"severity\": 3,\n \"owner\": \"\",\n \"occurred\": \"\",\n \"details\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"createInvestigation\": true,\n \"CustomFields\": {\n \"id_c0\": 62753684.27310583,\n \"in_9\": 62038932\n },\n \"rawJson\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident", "host": [ "{{baseUrl}}" ], "path": [ "incident" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-ac71a9f0-1450-4567-b5e2-f143d215f04d" }, { "id": "d17e1a1b-5293-449e-bb1d-ecc76ebb54cd", "name": "An internal server error occurred.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"type\": \"\",\n \"severity\": 3,\n \"owner\": \"\",\n \"occurred\": \"\",\n \"details\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"createInvestigation\": true,\n \"CustomFields\": {\n \"id_c0\": 62753684.27310583,\n \"in_9\": 62038932\n },\n \"rawJson\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incident", "host": [ "{{baseUrl}}" ], "path": [ "incident" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-d17e1a1b-5293-449e-bb1d-ecc76ebb54cd" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-9316490d-e855-45a1-8950-50358e876552" } ], "id": "c8742107-d500-4953-940e-82b70eae4a1c", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-c8742107-d500-4953-940e-82b70eae4a1c" }, { "name": "incidents", "item": [ { "name": "search", "item": [ { "name": "Palo Alto Networks Search Incidents (GET)", "id": "ef3d599d-e20a-44e1-92a9-8e61b9e6a75d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/incidents/search?query=&size=10&fromdate=&todate=&page=0", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ], "query": [ { "description": "Lucene query string to filter incidents (e.g., status:Active AND severity:High).", "key": "query", "value": "" }, { "description": "Maximum number of incidents to return.", "key": "size", "value": "10" }, { "description": "Filter incidents created after this date (ISO 8601 format).", "key": "fromdate", "value": "" }, { "description": "Filter incidents created before this date (ISO 8601 format).", "key": "todate", "value": "" }, { "description": "Page number for pagination (zero-based).", "key": "page", "value": "0" } ] }, "description": "Returns incidents matching query criteria specified as URL query parameters. Supports filtering by keyword, status, severity, type, and time range. For complex queries use POST /incidents/search." }, "response": [ { "id": "7a5e5609-e301-4501-89f2-2b7c0fd67495", "name": "Incidents returned successfully.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incidents/search?query=&size=10&fromdate=&todate=&page=0", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ], "query": [ { "description": "Lucene query string to filter incidents (e.g., status:Active AND severity:High).", "key": "query", "value": "" }, { "description": "Maximum number of incidents to return.", "key": "size", "value": "10" }, { "description": "Filter incidents created after this date (ISO 8601 format).", "key": "fromdate", "value": "" }, { "description": "Filter incidents created before this date (ISO 8601 format).", "key": "todate", "value": "" }, { "description": "Page number for pagination (zero-based).", "key": "page", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"total\": {\n \"value\": \"\",\n \"relation\": \"\"\n },\n \"incidents\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 0,\n \"severity\": 1,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"aliqua_8\": 38754474\n }\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 1,\n \"severity\": 1,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"culpa_16\": true,\n \"culpa1\": -67602550,\n \"nond4\": \"dolore exercitation ullamco aliquip\",\n \"exercitation_9\": \"sunt ad velit\"\n }\n }\n ],\n \"searchResultTotal\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-7a5e5609-e301-4501-89f2-2b7c0fd67495" }, { "id": "86f03568-5d3c-4f5b-9dcc-cbf25ee625dd", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incidents/search?query=&size=10&fromdate=&todate=&page=0", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ], "query": [ { "description": "Lucene query string to filter incidents (e.g., status:Active AND severity:High).", "key": "query", "value": "" }, { "description": "Maximum number of incidents to return.", "key": "size", "value": "10" }, { "description": "Filter incidents created after this date (ISO 8601 format).", "key": "fromdate", "value": "" }, { "description": "Filter incidents created before this date (ISO 8601 format).", "key": "todate", "value": "" }, { "description": "Page number for pagination (zero-based).", "key": "page", "value": "0" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-86f03568-5d3c-4f5b-9dcc-cbf25ee625dd" }, { "id": "c392059f-c30e-42af-9f38-5bb72455e96d", "name": "Missing or invalid API key.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/incidents/search?query=&size=10&fromdate=&todate=&page=0", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ], "query": [ { "description": "Lucene query string to filter incidents (e.g., status:Active AND severity:High).", "key": "query", "value": "" }, { "description": "Maximum number of incidents to return.", "key": "size", "value": "10" }, { "description": "Filter incidents created after this date (ISO 8601 format).", "key": "fromdate", "value": "" }, { "description": "Filter incidents created before this date (ISO 8601 format).", "key": "todate", "value": "" }, { "description": "Page number for pagination (zero-based).", "key": "page", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-c392059f-c30e-42af-9f38-5bb72455e96d" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-ef3d599d-e20a-44e1-92a9-8e61b9e6a75d" }, { "name": "Palo Alto Networks Search Incidents (POST)", "id": "db43a89f-764f-4a17-bbb3-5c97afbb00fc", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"filter\": {\n \"query\": \"\",\n \"status\": [\n \"\",\n \"\"\n ],\n \"sort\": [\n {\n \"field\": \"\",\n \"asc\": \"\"\n },\n {\n \"field\": \"\",\n \"asc\": \"\"\n }\n ],\n \"period\": {\n \"byFrom\": \"\",\n \"byTo\": \"\"\n }\n },\n \"fromDate\": \"\",\n \"toDate\": \"\",\n \"size\": 10,\n \"page\": 0\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/search", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ] }, "description": "Searches for incidents using a structured filter in the request body. Supports advanced filtering, field selection, sorting, and pagination. Preferred over GET for complex queries." }, "response": [ { "id": "11d8f436-105c-4c35-86fe-d669a112e4ff", "name": "Incidents returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"filter\": {\n \"query\": \"\",\n \"status\": [\n \"\",\n \"\"\n ],\n \"sort\": [\n {\n \"field\": \"\",\n \"asc\": \"\"\n },\n {\n \"field\": \"\",\n \"asc\": \"\"\n }\n ],\n \"period\": {\n \"byFrom\": \"\",\n \"byTo\": \"\"\n }\n },\n \"fromDate\": \"\",\n \"toDate\": \"\",\n \"size\": 10,\n \"page\": 0\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/search", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"total\": {\n \"value\": \"\",\n \"relation\": \"\"\n },\n \"incidents\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 0,\n \"severity\": 1,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"aliqua_8\": 38754474\n }\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"type\": \"\",\n \"status\": 1,\n \"severity\": 1,\n \"owner\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"occurred\": \"\",\n \"closed\": \"\",\n \"closeReason\": \"\",\n \"closeNotes\": \"\",\n \"labels\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ],\n \"details\": \"\",\n \"investigationId\": \"\",\n \"playbookId\": \"\",\n \"sourceInstance\": \"\",\n \"sourceBrand\": \"\",\n \"rawJson\": \"\",\n \"CustomFields\": {\n \"culpa_16\": true,\n \"culpa1\": -67602550,\n \"nond4\": \"dolore exercitation ullamco aliquip\",\n \"exercitation_9\": \"sunt ad velit\"\n }\n }\n ],\n \"searchResultTotal\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-11d8f436-105c-4c35-86fe-d669a112e4ff" }, { "id": "316b1df2-9fa7-4e94-9169-fe721e1c0283", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"filter\": {\n \"query\": \"\",\n \"status\": [\n \"\",\n \"\"\n ],\n \"sort\": [\n {\n \"field\": \"\",\n \"asc\": \"\"\n },\n {\n \"field\": \"\",\n \"asc\": \"\"\n }\n ],\n \"period\": {\n \"byFrom\": \"\",\n \"byTo\": \"\"\n }\n },\n \"fromDate\": \"\",\n \"toDate\": \"\",\n \"size\": 10,\n \"page\": 0\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/search", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-316b1df2-9fa7-4e94-9169-fe721e1c0283" }, { "id": "47a193dd-915b-4735-9808-caaaf255db14", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"filter\": {\n \"query\": \"\",\n \"status\": [\n \"\",\n \"\"\n ],\n \"sort\": [\n {\n \"field\": \"\",\n \"asc\": \"\"\n },\n {\n \"field\": \"\",\n \"asc\": \"\"\n }\n ],\n \"period\": {\n \"byFrom\": \"\",\n \"byTo\": \"\"\n }\n },\n \"fromDate\": \"\",\n \"toDate\": \"\",\n \"size\": 10,\n \"page\": 0\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/search", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "search" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-47a193dd-915b-4735-9808-caaaf255db14" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-db43a89f-764f-4a17-bbb3-5c97afbb00fc" } ], "id": "9e7f2497-a58f-49ee-99ac-c2de27831ee8", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-9e7f2497-a58f-49ee-99ac-c2de27831ee8" } ], "id": "78674f7f-76f5-4122-8823-a0cfeb64ad4c", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-78674f7f-76f5-4122-8823-a0cfeb64ad4c" }, { "name": "entry", "item": [ { "name": "Palo Alto Networks Add Entry to Investigation", "id": "b440111c-d6d5-4316-8ea1-ad6159cf70e2", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"investigationId\": \"\",\n \"data\": \"\",\n \"markdown\": false,\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/entry", "host": [ "{{baseUrl}}" ], "path": [ "entry" ] }, "description": "Adds a work note or entry to an investigation's war room. Entries can be notes, commands, files, or other content types. The war room serves as the collaborative workspace for the incident investigation team." }, "response": [ { "id": "f8cf6c0c-2831-4ca7-b9e9-e4f8da3c2b0b", "name": "Entry added successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"investigationId\": \"\",\n \"data\": \"\",\n \"markdown\": false,\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/entry", "host": [ "{{baseUrl}}" ], "path": [ "entry" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"investigationId\": \"\",\n \"type\": \"\",\n \"user\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"contents\": \"\",\n \"humanReadable\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-f8cf6c0c-2831-4ca7-b9e9-e4f8da3c2b0b" }, { "id": "23b085ab-aea3-4221-a2e2-470e37cd5fe5", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"investigationId\": \"\",\n \"data\": \"\",\n \"markdown\": false,\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/entry", "host": [ "{{baseUrl}}" ], "path": [ "entry" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-23b085ab-aea3-4221-a2e2-470e37cd5fe5" }, { "id": "92fe5fa0-a05e-4e9c-8aad-f81aa1d88e13", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"investigationId\": \"\",\n \"data\": \"\",\n \"markdown\": false,\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/entry", "host": [ "{{baseUrl}}" ], "path": [ "entry" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-92fe5fa0-a05e-4e9c-8aad-f81aa1d88e13" }, { "id": "e0cb8091-2238-4199-a87f-53a60d1feac7", "name": "The requested resource was not found.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"investigationId\": \"\",\n \"data\": \"\",\n \"markdown\": false,\n \"tags\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/entry", "host": [ "{{baseUrl}}" ], "path": [ "entry" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-e0cb8091-2238-4199-a87f-53a60d1feac7" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-b440111c-d6d5-4316-8ea1-ad6159cf70e2" } ], "id": "1eefd161-9c73-46af-8476-a1b3aa94bdc8", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-1eefd161-9c73-46af-8476-a1b3aa94bdc8" }, { "name": "investigations", "item": [ { "name": "{id}", "item": [ { "name": "Palo Alto Networks Get Investigation", "id": "9d631b3a-4b3f-44ab-8e1c-7f78049ac011", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/investigations/:id", "host": [ "{{baseUrl}}" ], "path": [ "investigations", ":id" ], "variable": [ { "id": "35e9c66f-741c-48a9-bfff-382c4cc05b12", "key": "id", "value": "", "description": "(Required) Unique identifier of the investigation." } ] }, "description": "Returns the full details of an investigation including all war room entries, playbook status, and associated incidents." }, "response": [ { "id": "c9a845f6-9f05-4f6d-b134-c9c9795146df", "name": "Investigation returned successfully.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/investigations/:id", "host": [ "{{baseUrl}}" ], "path": [ "investigations", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"status\": \"\",\n \"incidentId\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"entries\": [\n {\n \"id\": \"\",\n \"investigationId\": \"\",\n \"type\": \"\",\n \"user\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"contents\": \"\",\n \"humanReadable\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ]\n },\n {\n \"id\": \"\",\n \"investigationId\": \"\",\n \"type\": \"\",\n \"user\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"contents\": \"\",\n \"humanReadable\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ]\n }\n ],\n \"playbookId\": \"\",\n \"runningPlaybooks\": [\n \"\",\n \"\"\n ]\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-c9a845f6-9f05-4f6d-b134-c9c9795146df" }, { "id": "57ceb967-8d39-44d3-8bf0-7ab5accd27ea", "name": "Missing or invalid API key.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/investigations/:id", "host": [ "{{baseUrl}}" ], "path": [ "investigations", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-57ceb967-8d39-44d3-8bf0-7ab5accd27ea" }, { "id": "35be0b62-56ae-419e-88fd-cb52be12f2ba", "name": "The requested resource was not found.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/investigations/:id", "host": [ "{{baseUrl}}" ], "path": [ "investigations", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-35be0b62-56ae-419e-88fd-cb52be12f2ba" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-9d631b3a-4b3f-44ab-8e1c-7f78049ac011" } ], "id": "00cfd543-8633-4a46-8ab9-99c90d547f3b", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-00cfd543-8633-4a46-8ab9-99c90d547f3b" } ], "id": "b3550e04-d77c-4357-966e-f442a270d2e7", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-b3550e04-d77c-4357-966e-f442a270d2e7" }, { "name": "investigation", "item": [ { "name": "add", "item": [ { "name": "Palo Alto Networks Create Investigation", "id": "94ffacb7-f636-4784-8dfd-ee3fa766062a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"name\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/investigation/add", "host": [ "{{baseUrl}}" ], "path": [ "investigation", "add" ] }, "description": "Creates a new investigation attached to an existing incident. Multiple investigations can be created for a single incident to track separate analytical threads." }, "response": [ { "id": "fff244b5-97fa-44ea-a0eb-75f7d969b542", "name": "Investigation created successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"name\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/investigation/add", "host": [ "{{baseUrl}}" ], "path": [ "investigation", "add" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"status\": \"\",\n \"incidentId\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"entries\": [\n {\n \"id\": \"\",\n \"investigationId\": \"\",\n \"type\": \"\",\n \"user\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"contents\": \"\",\n \"humanReadable\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ]\n },\n {\n \"id\": \"\",\n \"investigationId\": \"\",\n \"type\": \"\",\n \"user\": \"\",\n \"created\": \"\",\n \"modified\": \"\",\n \"contents\": \"\",\n \"humanReadable\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ]\n }\n ],\n \"playbookId\": \"\",\n \"runningPlaybooks\": [\n \"\",\n \"\"\n ]\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-fff244b5-97fa-44ea-a0eb-75f7d969b542" }, { "id": "22f1f235-b867-4c9c-bc80-63febced6777", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"name\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/investigation/add", "host": [ "{{baseUrl}}" ], "path": [ "investigation", "add" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-22f1f235-b867-4c9c-bc80-63febced6777" }, { "id": "d65d7904-0a40-4b46-9baa-db70d5f9753f", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"name\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/investigation/add", "host": [ "{{baseUrl}}" ], "path": [ "investigation", "add" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-d65d7904-0a40-4b46-9baa-db70d5f9753f" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-94ffacb7-f636-4784-8dfd-ee3fa766062a" } ], "id": "76e56cc0-8bc6-491a-b9f7-633c19b381d5", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-76e56cc0-8bc6-491a-b9f7-633c19b381d5" } ], "id": "4bd48218-0ff5-4b10-ba36-9afa1276a32b", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-4bd48218-0ff5-4b10-ba36-9afa1276a32b" }, { "name": "playbook", "item": [ { "name": "run", "item": [ { "name": "Palo Alto Networks Run Playbook", "id": "15e4f63e-951d-4843-9bc8-24d6b55cecd1", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"playbookId\": \"\",\n \"version\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/playbook/run", "host": [ "{{baseUrl}}" ], "path": [ "playbook", "run" ] }, "description": "Executes a playbook against a specified incident. The playbook runs asynchronously and its progress can be monitored through the investigation's war room entries." }, "response": [ { "id": "5a647b50-edff-4ba2-8c4c-b830e2a62fa6", "name": "Playbook execution initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"playbookId\": \"\",\n \"version\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/playbook/run", "host": [ "{{baseUrl}}" ], "path": [ "playbook", "run" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"completed\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-5a647b50-edff-4ba2-8c4c-b830e2a62fa6" }, { "id": "3926bdc3-0c1a-4b9b-af14-286eafad5250", "name": "Malformed request or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"playbookId\": \"\",\n \"version\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/playbook/run", "host": [ "{{baseUrl}}" ], "path": [ "playbook", "run" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-3926bdc3-0c1a-4b9b-af14-286eafad5250" }, { "id": "bd87de67-58d4-46c4-b34e-b449a91803ac", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"playbookId\": \"\",\n \"version\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/playbook/run", "host": [ "{{baseUrl}}" ], "path": [ "playbook", "run" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-bd87de67-58d4-46c4-b34e-b449a91803ac" }, { "id": "2d022a9a-1c84-44a9-b182-4c696ef7152a", "name": "The requested resource was not found.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"incidentId\": \"\",\n \"playbookId\": \"\",\n \"version\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/playbook/run", "host": [ "{{baseUrl}}" ], "path": [ "playbook", "run" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-2d022a9a-1c84-44a9-b182-4c696ef7152a" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-15e4f63e-951d-4843-9bc8-24d6b55cecd1" } ], "id": "62bfa68f-5d4b-44e9-b648-a273c11d73ff", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-62bfa68f-5d4b-44e9-b648-a273c11d73ff" }, { "name": "Palo Alto Networks List Playbooks", "id": "bf0b5f93-9597-4be5-b188-be83042474fb", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/playbook?query=", "host": [ "{{baseUrl}}" ], "path": [ "playbook" ], "query": [ { "description": "Filter playbooks by name or keyword.", "key": "query", "value": "" } ] }, "description": "Returns all playbooks available in the Cortex XSOAR instance. Playbooks define automated response workflows that execute tasks, run integrations, and perform actions in response to incident conditions." }, "response": [ { "id": "c4337976-b80c-4489-89cb-07a38415309b", "name": "Playbooks returned successfully.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/playbook?query=", "host": [ "{{baseUrl}}" ], "path": [ "playbook" ], "query": [ { "description": "Filter playbooks by name or keyword.", "key": "query", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "[\n {\n \"id\": \"\",\n \"name\": \"\",\n \"version\": \"\",\n \"description\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ],\n \"fromVersion\": \"\",\n \"toVersion\": \"\",\n \"deprecated\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"version\": \"\",\n \"description\": \"\",\n \"tags\": [\n \"\",\n \"\"\n ],\n \"fromVersion\": \"\",\n \"toVersion\": \"\",\n \"deprecated\": \"\"\n }\n]", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-c4337976-b80c-4489-89cb-07a38415309b" }, { "id": "38aac640-9807-4e7a-ad43-b4bd6239aeca", "name": "Missing or invalid API key.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/playbook?query=", "host": [ "{{baseUrl}}" ], "path": [ "playbook" ], "query": [ { "description": "Filter playbooks by name or keyword.", "key": "query", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-38aac640-9807-4e7a-ad43-b4bd6239aeca" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-bf0b5f93-9597-4be5-b188-be83042474fb" } ], "id": "18faecdc-81a0-4241-a991-db6af7ff6e06", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-18faecdc-81a0-4241-a991-db6af7ff6e06" }, { "name": "integration", "item": [ { "name": "search", "item": [ { "name": "Palo Alto Networks Search Integrations", "id": "341c932f-4bd7-479f-ae28-5bec0e4d6446", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/integration/search?query=&page=0&size=50", "host": [ "{{baseUrl}}" ], "path": [ "integration", "search" ], "query": [ { "description": "Search query to filter integrations by name or category.", "key": "query", "value": "" }, { "key": "page", "value": "0" }, { "key": "size", "value": "50" } ] }, "description": "Returns a list of available integration packs installed in the Cortex XSOAR instance. Integrations provide connectivity to third-party security tools and platforms." }, "response": [ { "id": "3a70082c-4fb6-4082-aba9-004a2b3e77f9", "name": "Integrations returned successfully.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/integration/search?query=&page=0&size=50", "host": [ "{{baseUrl}}" ], "path": [ "integration", "search" ], "query": [ { "description": "Search query to filter integrations by name or category.", "key": "query", "value": "" }, { "key": "page", "value": "0" }, { "key": "size", "value": "50" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"configurations\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"display\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"version\": \"\",\n \"fromVersion\": \"\",\n \"deprecated\": \"\",\n \"beta\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"display\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"version\": \"\",\n \"fromVersion\": \"\",\n \"deprecated\": \"\",\n \"beta\": \"\"\n }\n ],\n \"total\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-3a70082c-4fb6-4082-aba9-004a2b3e77f9" }, { "id": "f0560682-50b8-437b-9dd9-83b154176b6a", "name": "Missing or invalid API key.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/integration/search?query=&page=0&size=50", "host": [ "{{baseUrl}}" ], "path": [ "integration", "search" ], "query": [ { "description": "Search query to filter integrations by name or category.", "key": "query", "value": "" }, { "key": "page", "value": "0" }, { "key": "size", "value": "50" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-f0560682-50b8-437b-9dd9-83b154176b6a" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-341c932f-4bd7-479f-ae28-5bec0e4d6446" } ], "id": "46a22360-8bff-4e82-b8e4-916f24cfead5", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-46a22360-8bff-4e82-b8e4-916f24cfead5" } ], "id": "b28f31f7-ea25-442b-b93d-5b50eeaa0390", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-b28f31f7-ea25-442b-b93d-5b50eeaa0390" }, { "name": "settings", "item": [ { "name": "integration", "item": [ { "name": "search", "item": [ { "name": "Palo Alto Networks Search Integration Instances", "id": "8666e6a8-a562-4d7f-8140-7a8ca9f5d4bd", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"page\": 0,\n \"size\": 50\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/settings/integration/search", "host": [ "{{baseUrl}}" ], "path": [ "settings", "integration", "search" ] }, "description": "Returns a list of configured integration instances. Each instance represents a configured connection to a specific tool using a particular integration pack. Supports filtering by integration name and enabled status." }, "response": [ { "id": "b083ad95-b557-426b-9ea4-42ec21b22a68", "name": "Integration instances returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"page\": 0,\n \"size\": 50\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/settings/integration/search", "host": [ "{{baseUrl}}" ], "path": [ "settings", "integration", "search" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"instances\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"brand\": \"\",\n \"enabled\": \"false\",\n \"isIntegrationScript\": \"\",\n \"incomingMapperId\": \"\",\n \"mappingId\": \"\",\n \"configuration\": {}\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"brand\": \"\",\n \"enabled\": \"true\",\n \"isIntegrationScript\": \"\",\n \"incomingMapperId\": \"\",\n \"mappingId\": \"\",\n \"configuration\": {}\n }\n ],\n \"total\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-b083ad95-b557-426b-9ea4-42ec21b22a68" }, { "id": "8c1ac975-ad89-4a3d-a72a-9a3214f54242", "name": "Missing or invalid API key.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"query\": \"\",\n \"page\": 0,\n \"size\": 50\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/settings/integration/search", "host": [ "{{baseUrl}}" ], "path": [ "settings", "integration", "search" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"status\": \"\",\n \"title\": \"\",\n \"detail\": \"\",\n \"error\": \"\"\n}", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-8c1ac975-ad89-4a3d-a72a-9a3214f54242" } ], "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-8666e6a8-a562-4d7f-8140-7a8ca9f5d4bd" } ], "id": "6d9f66cb-6e70-432c-97d3-e31bdc27e64a", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-6d9f66cb-6e70-432c-97d3-e31bdc27e64a" } ], "id": "ed569c78-e3b7-4b8d-b25b-bc7daddd89dc", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-ed569c78-e3b7-4b8d-b25b-bc7daddd89dc" } ], "id": "dc34736a-9fe5-431e-ba1b-855bed6bdb3e", "createdAt": "2026-06-05T13:18:54.000Z", "updatedAt": "2026-06-05T13:18:54.000Z", "uid": "35240-dc34736a-9fe5-431e-ba1b-855bed6bdb3e" } ], "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "Authorization", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "variable": [ { "key": "xsoar-server", "value": "xsoar.example.com" }, { "key": "baseUrl", "value": "https://{{xsoar-server}}" } ] }