Panther REST API

★ Only Publicly Available OpenAPI DocumentSecuritySiemapiKey16 EndpointsREST

For Agents

Manage SIEM alerts, rules, queries, users, and API tokens across 16 endpoints.

Connect the Panther REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Panther REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Panther REST API API.

Retrieve and update security alerts with status, assignee, and quality metadata

Create, rotate, and manage API tokens with permission scopes and IP allowlists

Create and manage Python-based detection rules with testing capabilities

Create, update, and delete saved and scheduled queries

GET STARTED

Start building with Panther REST API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Panther REST API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Panther REST API, keeping it validated and agent-ready. The Panther REST API provides comprehensive interaction with Panther SIEM entities including alerts, API tokens, rules, users, and queries. It powers security operations workflows, threat detection rule management, and SIEM automation for cloud-native security teams using Panther's detection-as-code platform.

Use Cases

Patterns agents use Panther REST API API for, with concrete tasks.

★ Alert Triage and Management

Retrieve and update security alerts during incident response workflows. GET /alerts/{id} fetches alert details including severity, status, and event count, while PATCH /alerts/{id} updates status, assignee, quality, or contextTags. Essential for security operations teams managing alert queues and incident escalation.

GET /alerts/{id} to retrieve alert, then PATCH /alerts/{id} to update status to RESOLVED and assign to analyst

Detection Rule Management

Create and update Python-based detection rules with built-in testing. POST /rules creates a new rule with optional run-tests-first and run-tests-only parameters, enabling test-driven detection development. PUT /rules/{id} updates existing rules with the same testing capabilities.

POST /rules with rule body and run-tests-first=true to validate before saving, or run-tests-only=true for testing without saving

API Token Lifecycle Management

Create, retrieve, rotate, and delete API tokens with granular permission scopes and IP allowlists. POST /api-tokens creates tokens with specified permissions array, POST /api-tokens/self/rotate rotates the current token, and DELETE /api-tokens/{id} revokes access. Critical for API security and credential rotation policies.

POST /api-tokens with name, permissions, and allowedCIDRBlocks, then POST /api-tokens/self/rotate for token rotation

Saved and Scheduled Queries

Create, update, and delete saved or scheduled queries for recurring searches across log data. POST /queries creates a saved query with optional schedule and emailConfig for automated report delivery. Essential for security analytics and compliance reporting workflows.

POST /queries with name, sql, schedule, and emailConfig to create scheduled query with email delivery

Agent-Driven SIEM Automation via Jentic

An AI agent managing security operations can triage alerts, create detection rules, and manage API tokens through Jentic without holding the X-API-Key in agent context. Jentic resolves intents like 'assign this alert' to the right Panther endpoint and supplies the request schema.

Search Jentic for 'update alert status', load the PATCH /alerts/{id} schema, and execute

Key Endpoints

16 endpoints — jentic publishes the only available openapi specification for panther rest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/alerts/{id}

Get an alert by ID

PATCH

/alerts/{id}

Update alert status, assignee, quality, or contextTags

POST

/api-tokens

Create an API token

GET

/api-tokens/{id}

Get an API token by ID

DELETE

/api-tokens/{id}

Delete an API token

POST

/api-tokens/self/rotate

Rotate the current API token

POST

/rules

Create a Python detection rule

GET

/rules/{id}

Get a rule by ID

PUT

/rules/{id}

Update a rule

DELETE

/rules/{id}

Delete a rule

POST

/queries

Create a saved or scheduled query

GET

/queries/{id}

Get a query by ID

PUT

/queries/{id}

Update a query

DELETE

/queries/{id}

Delete a query

POST

/users

Create a user

GET

/users/{id}

Get a user by ID

GET

/alerts/{id}

Get an alert by ID

PATCH

/alerts/{id}

Update alert status, assignee, quality, or contextTags

POST

/api-tokens

Create an API token

GET

/api-tokens/{id}

Get an API token by ID

DELETE

/api-tokens/{id}

Delete an API token

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Panther's X-API-Key is stored encrypted in the Jentic vault and injected at execution time. Agents receive scoped access — the raw key never enters agent context.

Intent-based discovery

Agents search by intent (e.g. 'update alert status', 'create detection rule') and Jentic returns the matching Panther endpoint with the request schema pre-shaped for execution.

Time to first call

Direct Panther integration: 3-6 days including API token setup, endpoint discovery, and permission configuration. Through Jentic: under 1 hour once credentials are configured — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Splunk API

Traditional SIEM platform with extensive search, alerting, and log management capabilities

Choose Splunk API when the workflow requires traditional SIEM features or on-premises deployment rather than cloud-native detection-as-code

Complementary

Elasticsearch API

Search and analytics engine often used as a log storage backend for SIEM platforms

Use Elasticsearch API alongside Panther when raw log queries are needed beyond Panther's saved queries

FAQs

Specific to using Panther REST API API through Jentic.

Why is there no official OpenAPI spec for Panther REST API?

Panther does not publish a complete OpenAPI specification for their REST API. Jentic generates and maintains this spec so that AI agents and developers can call Panther REST API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Panther REST API use?

The Panther REST API uses an API key passed in the X-API-Key header. Through Jentic, the key is stored in the encrypted vault and injected at execution time so it never enters the agent's prompt context.

Can I test detection rules before saving them?

Yes. POST /rules accepts run-tests-first (default true) to run tests before saving, or run-tests-only=true to test without saving. This enables test-driven detection development and prevents broken rules from being deployed.

How do I rotate an API token?

POST /api-tokens/self/rotate rotates the current API token used for authentication. The endpoint returns a new token with the same permissions, and the old token is immediately invalidated.

Can I schedule queries to run automatically?

Yes. POST /queries accepts a schedule object to configure recurring execution, and an emailConfig object to deliver results via email. This enables automated security reporting and compliance workflows.

What alert statuses are supported?

Panther alerts support OPEN, CLOSED, TRIAGED, and RESOLVED statuses. PATCH /alerts/{id} updates the status, and you can optionally set assignee, quality (NOISE or USEFUL), and contextTags to enrich alert metadata.