REST API

Use the Panther REST API to interact with your Panther entities

Overview

Panther offers a REST API to interact with certain parts of your Panther instance. Currently, you can interact with the following entities through the REST API:

• Alerts

• Alert Comments

• API Tokens

• Data Models

• Globals

• Log sources

• Queries

• Roles

• Rules

• Scheduled rules

• Simple/YAML rules

• Policies

• Users

Additional operations are available in the GraphQL API.

Discover the Panther REST API schema

OpenAPI specification

Discover the REST API schema by downloading the OpenAPI specification file:

151KB

panther_open_api_v3_spec.yaml

Open

API Playground

How to use the Panther REST API

Step 1: Identify your Panther REST API URL

To locate your REST API URL:

• In the upper-right corner of your Panther Console, click the gear icon, then API Tokens. At the top of the page, see the API URL.

  • If you are running a SaaS deployment of Panther, your REST URL will be the portion shown below:

  

  • If you are running a Cloud Connected or self-hosted deployment of Panther, the URL will be the portion shown below (inclusive of /v1):

  

Note that all REST URLs exclude /public/graphql from the end of the value.

Step 2: Generate an API token

• See these instructions on how to create an API token. You can find required permissions for each REST API operation on each entity's page (nested under this one).

Step 3: Invoke the Panther REST API

In addition to testing with the API Playground in the Console, you can invoke the REST API using Swagger, Postman, or this documentation:

Swagger

Using Swagger to access the REST API

1. In a web browser, navigate to the Swagger Editor.

2. In the code editor on the left-hand side, paste in the Panther REST OpenAPI specification file found above, in Discover the Panther REST API schema.

3. On the right-hand side, under Server variables, in api_host, enter your Panther REST API URL without the protocol (i.e., excluding https://).

4. Click Authorize.

5. In the Available authorizations modal:

   1. Under Value, enter your API token value.

   2. Click Authorize.

   3. Click Close.

6. You can now try invoking the API:

   1. Choose an endpoint, and expand it by clicking the arrow pointing down.

   2. Click Try it out.

   3. Click Execute.

Postman

This documentation