REST API (Beta)

Use the Panther REST API to interact with your Panther entities

Overview

The REST API is in open beta starting with Panther version 1.98, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther offers a REST API to interact with certain parts of your Panther instance. Currently, you can interact with the following entities through the REST API:

• Alerts

• Alert Comments

• API Tokens

• Data Models

• Globals

• Log sources

• Queries

• Roles

• Rules

• Scheduled rules

• Simple/YAML rules

• Policies

• Users

Additional operations are available in the GraphQL API.

Discover the Panther REST API schema

OpenAPI specification

Discover the REST API schema by downloading the OpenAPI specification file:

137KB

panther_open_api_v3_spec.yaml

API Playground

You can discover the API schema by browsing the API Playground in your Panther Console. Learn more on API Playground.

How to use the Panther REST API

Step 1: Identify your Panther REST API URL

To locate your REST API URL:

• In the upper-right corner of your Panther Console, click the gear icon, then API Tokens. At the top of the page, see the API URL.

  • If you are running a SaaS deployment of Panther, your REST URL will be the portion shown below:

  

  • If you are running a Cloud Connected or self-hosted deployment of Panther, the URL will be the portion shown below (inclusive of /v1):

  

Note that all REST URLs exclude /public/graphql from the end of the value.

Step 2: Generate an API token

• See these instructions on how to create an API token. You can find required permissions for each REST API operation on each entity's page (nested under this one).

Step 3: Invoke the Panther REST API

In addition to testing with the API Playground in the Console, you can invoke the REST API using Swagger, Postman, or this documentation:

Swagger

Using Swagger to access the REST API

1. In a web browser, navigate to the Swagger Editor.
2. In the code editor on the left-hand side, paste in the Panther REST OpenAPI specification file found above, in Discover the Panther REST API schema.
3. On the right-hand side, under Server variables, in api_host, enter your Panther REST API URL without the protocol (i.e., excluding https://).
4. Click Authorize.
5. In the Available authorizations modal:

   1. Under Value, enter your API token value.

   2. Click Authorize.

   3. Click Close.
6. You can now try invoking the API:

   1. Choose an endpoint, and expand it by clicking the arrow pointing down.

   2. Click Try it out.
   3. Click Execute.

Postman

Using Postman to access the REST API

You will import the Panther Postman collection, create a new environment with URL and API variables, then try making a request.

1. Download the Panther_REST_API_postman_collection.json file at the bottom of this tab.

2. In your Postman application, click File > Import.

3. Choose the Panther_REST_API_postman_collection.json file.

   • Under Collections, there will now be a Panther Rest API collection.

4. Click Environments, then click the plus sign (+).
5. Enter a name for your environment—e.g., "Panther."

6. In the table on the right-hand side, enter the following two variables:

   • restHost: For the Current value, enter your full Panther REST API URL.

     • You can find this value by following the instructions in Step 1: Identify your Panther REST API URL.
   • restApiToken: For the Current value, enter your Panther API token. In the Type column, select secret.\

     
7. In the upper-right corner, click Save.

8. You can now try making a request:

   1. In the upper-right hand corner, click the environment dropdown, and select the one you created in the previous step.
   2. Click Collections.

   3. Expand the Panther Rest API collection, then select a request.

   4. Click Send.

31KB

Panther Rest API.postman_collection.json

This documentation

Using the Panther documentation to access the REST API

1. Navigate to one of the REST API entity pages (nested under this page), and locate the operation you'd like to perform.

2. In the bottom-right corner of the operation's Request tile, click ▶Test it.

   
3. In the modal that pops up, in the endpoint displayed at the top, click {api_host}.
4. In the api_host field, enter the REST API URL you identified in Step 1, without the protocol (i.e., excluding https://).
5. In the Authentication section, click the Auth Type dropdown.

   1. Under Required authentication, check the box next to ApiKeyAuth.
   2. Under Authentication, Name and Value fields will populate. In Value, enter the API token you generated in Step 2.
6. In the Variables section, if the operation has required path variables, such as {id}, provide value(s) in the VALUE column.
7. If there are values in the Query Parameters section, if you would like them to apply to this invocation, click their checkboxes in the right-hand column.
8. If a request body is required for your request, add content within Body.

9. Click Send Request.