>
    Strata Copilot
    Export Files (API)
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS XML API Request Types and Actions
    4. Export Files (API)
    Download PDF
    Next-Generation Firewall

    Export Files (API)

    Table of Contents

    Export Files (API)

    You can export certain types of files from the firewall using thetype=export parameter in the API request.
    Use the category parameter to specify the type of file that you want to export.
    • Configuration—category=configuration
    • Certificates/Keys—category=certificate
    • Response pages—category= application-block-page | captive-portal-text | file-block-continue-page | file-block-page | global-protect-portal-custom-help-page | global-protect-portal-custom-login-page | global-protect-portal-custom-welcome-page | ssl-cert-status-page | ssl-optout-text | url-block-page | url-coach-text | virus-block-page>
    • Technical support data—category=tech-support
    • Device State—category=device-state
    Use cURL tools to export the file from the firewall and save locally with a local file name:
    curl -o
			<filename> "https://<firewall>/api/??key=apikey&<query-parameters>"
    When using the API query from a web browser, you can specifyto=filename as an optional parameter if you would like to provide a different name when saving the file locally.

    Export Packet Captures

    Application PCAPs are organized by a directory/filename structure where the directory is a date inyyyymmdd format. Filenames for application pcaps use aSourceIP-SourcePort-DestinationIP-DestinationPort-SessionID.pcap format.
    Application PCAP Type
    API Request
    Application PCAP directory list.
    		 
    curl -X POST 'https://firewall/api?type=export&category=application-pcap"
    List of files under a directory using thefrom parameter to indicate date. 
    curl -X POST 'https://firewall/api?type=export&category=application-pcap&from=<yyyymmdd>"
    Application PCAP file by name using thefrom parameter. 
    curl -X POST 'https://firewall/api?type=export&category=application-pcap&from=<yyyymmdd>/<filename>"
    The file will be retrieved and saved locally using the name yyyymmdd-filename.
    Application PCAP file saved locally with a custom name using theto parameter. 
    curl -X POST 'https://firewall/api?type=export&category=application-pcap&from=<yyyymmdd>/<filename>&to=<localfile>"

    Export Keys and Certificates

    To export certificates and keys, specify query parameterscertificate-name,format, andpassphrase
    https://<firewall>/api/?key=apikey&type=export&category=<certificate>
				&certificate-name=<certificate_name>
				&passphrase=<passphrase>
				&format=<pkcs12><pem><pkcs10>
				&include-key=<yes><no>&vsys=<vsys>
				<omit this parameter to import it into a shared location>
    • certificate-name—name of the certificate object on the firewall
    • passphrase—required when including the certificate key
    • format—certificate format:pkcs12,pem, orpkcs10
    • include-key—yes or no parameter to include or exclude the key
    • vsys—virtual system where the certificate object is used. Ignore this parameter if the certificate is a shared object.

    Export Threat, Filter, and Data Filtering PCAPs

    To export threat PCAPs, you need to provide the PCAP ID from the threat log and the search time, which is the time that the PCAP was received on the firewall. Threat PCAP filenames use apcapID.pcap format.
    PCAP Type
    API Request
    Threat PCAP using PCAP ID, device name, session ID, and search
    		 
    curl -X POST 'https://firewall/api?type=export&category=threat-pcap&pcap-id=<id>&device_name=<device name>&sessionid=<session id>&search-time=<yyyy/mm/dd+hr:min:sec>"
    List of filtered PCAPs
    		 
    curl -X POST 'https://firewall/api?type=export&category=filters-pcap"
    Specific filtered PCAP file
    		 
    curl -X POST 'https://firewall/api?type=export&category=filters-pcap&from=<filename>"
    List of data filtering PCAP file names
    		 
    curl -X POST 'https://firewall/api?type=export&category=dlp-pcap&dlp-password=<password>"
    Specific data filtering PCAP file
    		 
    curl -X POST 'https://firewall/api?type=export&category=dlp-pcap&dlp-password=<password>&from=<filename>&to=<localfile>"

    © 2026 Palo Alto Networks, Inc. All rights reserved.