REST API (Beta)

Use the Panther REST API to interact with your Panther entities

Overview

The REST API is in open beta starting with Panther version 1.98, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther offers a REST API to interact with certain parts of your Panther instance. Currently, you can interact with the following entities through the REST API:

• Alerts

• API Tokens

• Data Models

• Globals

• Log sources

• Queries

• Roles

• Rules

• Scheduled rules

• Simple/YAML rules

• Policies

• Users

Additional operations are available in the GraphQL API.

Discover the Panther REST API schema

OpenAPI specification

Discover the REST API schema by downloading the OpenAPI specification file:

137KB

panther_open_api_v3_spec.yaml

API Playground

You can discover the API schema by browsing the API Playground in your Panther Console. Learn more on API Playground.

How to use the Panther REST API

Step 1: Identify your Panther REST API URL

To locate your REST API URL:

• In the upper-right corner of your Panther Console, click the gear icon, then API Tokens. At the top of the page, see the API URL.

  • If you are running a SaaS deployment of Panther, your REST URL will be the portion shown below:

  • If you are running a Cloud Connected or self-hosted deployment of Panther, the URL will be the portion shown below (inclusive of /v1):

Note that all REST URLs exclude /public/graphql from the end of the value.

Step 2: Generate an API token

• See these instructions on how to create an API token. You can find required permissions for each REST API operation on each entity's page (nested under this one).

Step 3: Invoke the Panther REST API

In addition to testing with the API Playground in the Console, you can invoke the REST API using Swagger, Postman, or this documentation:

Swagger

Using Swagger to access the REST API

1. In a web browser, navigate to the Swagger Editor.

2. In the code editor on the left-hand side, paste in the Panther REST OpenAPI specification file found above, in Discover the Panther REST API schema.

5. In the Available authorizations modal:

   1. Under Value, enter your API token value.

   2. Click Authorize.
6. You can now try invoking the API:

   1. Choose an endpoint, and expand it by clicking the arrow pointing down.

   3. Click Execute.

Postman

Using Postman to access the REST API

You will import the Panther Postman collection, create a new environment with URL and API variables, then try making a request.

1. Download the Panther_REST_API_postman_collection.json file at the bottom of this tab.

2. In your Postman application, click File > Import.

3. Choose the Panther_REST_API_postman_collection.json file.

   • Under Collections, there will now be a Panther Rest API collection.

5. Enter a name for your environment—e.g., "Panther."

6. In the table on the right-hand side, enter the following two variables:

   • restHost: For the Current value, enter your full Panther REST API URL.

     • You can find this value by following the instructions in Step 1: Identify your Panther REST API URL.

   • restApiToken: For the Current value, enter your Panther API token. In the Type column, select secret.\
7. In the upper-right corner, click Save.

8. You can now try making a request:

   2. Click Collections.

   3. Expand the Panther Rest API collection, then select a request.

   4. Click Send.

31KB

Panther Rest API.postman_collection.json

This documentation

Using the Panther documentation to access the REST API

1. Navigate to one of the REST API entity pages (nested under this page), and locate the operation you'd like to perform.

2. In the bottom-right corner of the operation's Request tile, click ▶Test it.
3. In the modal that pops up, within the Variables section:

   1. If the operation has required path variables, such as {id}, provide value(s) in the VALUE column.

   2. Click + Variable, then create the following variable:

      • key: Enter api_host.
4. Within the Headers section, click + Headers.

5. In the table, create the following header:

   • key: Enter X-API-Key.

   • value: Enter the API token you generated in Step 2.

7. If a request body is required for your request, add content within Body.

8. Click Send Request.