Cisco Secure Firewall Policy Assignments API

openapi: 3.2.0
info:
  title: Cisco Secure Firewall Policy Assignments API
  version: 1.13.0
  contact:
    name: Cisco Firepower TAC
    email: ngfw-support@cisco.com
  description: 'Operations tagged Policy Assignments across 2 of this provider''s published API definitions: cdfmc-openapi.yaml,
    cisco-secure-firewall-cdfmc-openapi.yml. Each path carries the servers of the definition it was published in.'
  x-provenance:
    method: harvested
    first_party: true
    harvested: '2026-08-19'
    source: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/cdfmc-openapi.yaml
    source_repo: https://github.com/CiscoDevNet/scc-public-api-docs
    note: Verbatim first-party OpenAPI published by Cisco in the CiscoDevNet scc-public-api-docs repository, the source of
      record for developer.cisco.com/docs/cisco-security-cloud-control-firewall-manager/. Not authored or modified by API
      Evangelist.
    derived_view: Per-tag view of cisco-secure-firewall-cdfmc-openapi.yml, the provider's source document. Operations and
      schemas are the provider's, unmodified; only the partition is ours.
    derived_from: cisco-secure-firewall-cdfmc-openapi.yml
    operation_coverage: 4/4
  x-evidence:
    fetched: '2026-08-19'
    url: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/cdfmc-openapi.yaml
    http_status: 200
servers:
- url: https://api.us.security.cisco.com/firewall
  description: US
- url: https://api.eu.security.cisco.com/firewall
  description: EU
- url: https://api.apj.security.cisco.com/firewall
  description: APJ
- url: https://api.au.security.cisco.com/firewall
  description: AUS
- url: https://api.in.security.cisco.com/firewall
  description: IN
- url: https://api.int.security.cisco.com/firewall
  description: Staging
- url: https://scale.manage.security.cisco.com/api/rest
  description: Scale
- url: https://ci.manage.security.cisco.com/api/rest
  description: CI
- url: https://manage.stg.secure.cisco/api/rest
  description: Stgf9
tags:
- name: Policy Assignments
paths:
  /v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/assignment/policyassignments:
    get:
      deprecated: false
      description: '**Get the list of all policy assignments to target devices.**'
      operationId: getAllPolicyAssignment
      parameters:
      - $ref: '#/components/parameters/domainUUID'
        name: domainUUID
      - $ref: '#/components/parameters/offset'
        name: offset
      - $ref: '#/components/parameters/limit'
        name: limit
      - $ref: '#/components/parameters/expanded'
        name: expanded
      responses:
        '200':
          content:
            application/json:
              examples:
                'Example 1 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments ( Success: Test GET ALL success )':
                  value:
                    items:
                    - id: NatPolUuid
                      name: NATPOL
                      type: PolicyAssignment
                    - id: accessPolicyUuid
                      name: AccessPolicy1
                      type: PolicyAssignment
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/?offset=0&limit=2
                    paging:
                      count: 2
                      limit: 2
                      offset: 0
                      pages: 1
                ? 'Example 2 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments?expanded=true ( Success:
                  Test GET ALL success with expanded=true )'
                : value:
                    items:
                    - id: NatPolUuid
                      links:
                        self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/NatPolUuid
                      name: NATPOL
                      policy:
                        id: NatPolUuid
                        name: NATPOL
                        type: FTDNatPolicy
                      targets:
                      - id: device1Uuid
                        keepLocalEvents: false
                        name: FTD_Device1
                        prohibitPacketTransfer: false
                        type: Device
                      - id: device2Uuid
                        keepLocalEvents: false
                        name: FTD_Device2
                        prohibitPacketTransfer: false
                        type: Device
                      type: PolicyAssignment
                    - id: accessPolicyUuid
                      links:
                        self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/accessPolicyUuid
                      name: AccessPolicy1
                      policy:
                        id: accessPolicyUuid
                        name: AccessPolicy1
                        type: AccessPolicy
                      targets:
                      - id: FP_DeviceUuid
                        keepLocalEvents: false
                        name: FP_device
                        prohibitPacketTransfer: false
                        type: Device
                      - id: device1Uuid
                        keepLocalEvents: false
                        name: FTD_Device1
                        prohibitPacketTransfer: false
                        type: Device
                      - id: device2Uuid
                        keepLocalEvents: false
                        name: FTD_Device2
                        prohibitPacketTransfer: false
                        type: Device
                      type: PolicyAssignment
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/?offset=0&limit=2&expanded=true
                    paging:
                      count: 2
                      limit: 2
                      offset: 0
                      pages: 1
              schema:
                $ref: '#/components/schemas/PolicyAssignmentListContainer'
                type: object
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
                type: object
          description: Error
      tags:
      - Policy Assignments
    post:
      deprecated: false
      description: '**Create a policy assignment. _Check the response section for applicable examples (if any)._**'
      operationId: createPolicyAssignment
      parameters:
      - $ref: '#/components/parameters/domainUUID'
        name: domainUUID
      requestBody:
        content:
          application/json:
            examples:
              ? 'Example 1 : POST /fmc_config/v1/domain/DomainUUID/assignment/policyassignments ( POST request to assign device
                to an FTDPlatformSettings policy )'
              : value:
                  policy:
                    id: ftdplatformsettingspolicyUUID
                    name: FTDPlatformSettingsPolicy2
                    type: FTDPlatformSettingsPolicy
                  targets:
                  - id: deviceUUID1
                    name: FTD_Device1
                    type: Device
                  - id: deviceUUID2
                    name: FTD_Device2
                    type: Device
                  type: PolicyAssignment
              ? 'Example 2 : POST /fmc_config/v1/domain/DomainUUID/assignment/policyassignments ( POST request to assign device
                to an AC policy )'
              : value:
                  policy:
                    id: accesspolicyUUID
                    name: AccessPolicy2
                    type: AccessPolicy
                  targets:
                  - id: deviceUUID1
                    name: FTD_Device1
                    type: Device
                  - id: deviceUUID2
                    name: FTD_Device2
                    type: Device
                  type: PolicyAssignment
              ? 'Example 3 : POST /fmc_config/v1/domain/DomainUUID/assignment/policyassignments ( POST request to assign device
                to an FlexConfig policy )'
              : value:
                  policy:
                    id: flexconfigpolicyUUID
                    name: FlexConfigPolicy2
                    type: FlexConfigPolicy
                  targets:
                  - id: deviceUUID1
                    name: FTD_Device1
                    type: Device
                  - id: deviceUUID2
                    name: FTD_Device2
                    type: Device
                  type: PolicyAssignment
              ? 'Example 4 : POST /fmc_config/v1/domain/DomainUUID/assignment/policyassignments ( POST request to assign device(s)
                to a NAT policy )'
              : value:
                  policy:
                    id: NatPol1_uuid
                    name: NatPol1
                    type: FTDNatPolicy
                  targets:
                  - id: FTD_Device1_uuid
                    name: FTD_Device1
                    type: Device
                  - id: FTD_Device2_uuid
                    name: FTD_Device2
                    type: Device
                  type: PolicyAssignment
            schema:
              $ref: '#/components/schemas/PolicyAssignment'
              type: object
        description: The input policy assignment model.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAssignment'
                type: object
          description: Created
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
                type: object
          description: Error
      tags:
      - Policy Assignments
    servers:
    - url: https://api.us.security.cisco.com/firewall
      description: US
    - url: https://api.eu.security.cisco.com/firewall
      description: EU
    - url: https://api.apj.security.cisco.com/firewall
      description: APJ
    - url: https://api.au.security.cisco.com/firewall
      description: AUS
    - url: https://api.in.security.cisco.com/firewall
      description: IN
    - url: https://api.int.security.cisco.com/firewall
      description: Staging
    - url: https://scale.manage.security.cisco.com/api/rest
      description: Scale
    - url: https://ci.manage.security.cisco.com/api/rest
      description: CI
    - url: https://manage.stg.secure.cisco/api/rest
      description: Stgf9
  /v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/assignment/policyassignments/{objectId}:
    get:
      deprecated: false
      description: '**Get the policy assignment associated with the specified ID.**'
      operationId: getPolicyAssignment
      parameters:
      - description: Unique identifier of the policy assignment.
        in: path
        name: objectId
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/domainUUID'
        name: domainUUID
      responses:
        '200':
          content:
            application/json:
              examples:
                ? 'Example 1 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( GET
                  by id on AC policy )'
                : value:
                    id: policyassignmentUUID
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID
                    policy:
                      description: policy to test FMC implementation
                      id: accesspolicyUUID
                      name: AccessPolicy1
                      type: AccessPolicy
                    targets:
                    - id: deviceUUID
                      name: FTD_Device1
                      type: Device
                    type: PolicyAssignment
                ? 'Example 2 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( GET
                  by id on NAT policy )'
                : value:
                    id: NatPolUuid
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID
                    name: NATPOL
                    policy:
                      id: NatPolUuid
                      name: NATPOL
                      type: FTDNatPolicy
                    targets:
                    - id: device1Uuid
                      keepLocalEvents: false
                      name: FTD_Device1
                      prohibitPacketTransfer: false
                      type: Device
                    - id: device2Uuid
                      keepLocalEvents: false
                      name: FTD_Device2
                      prohibitPacketTransfer: false
                      type: Device
                    type: PolicyAssignment
                ? 'Example 3 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( GET
                  by id on FlexConfig policy )'
                : value:
                    id: policyassignmentUUID
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID
                    policy:
                      description: policy to test FMC implementation
                      id: flexconfigpolicyUUID
                      name: FlexConfigPolicy1
                      type: FlexConfigPolicy
                    targets:
                    - id: deviceUUID
                      name: FTD_Device1
                      type: Device
                    type: PolicyAssignment
                ? 'Example 4 : GET /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( GET
                  by id on PlatformSettings policy )'
                : value:
                    id: policyassignmentUUID
                    links:
                      self: /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID
                    policy:
                      description: policy to test FMC implementation
                      id: platformsettingspolicyUUID
                      name: FTDPlatformSettings1
                      type: FTDPlatformSettings
                    targets:
                    - id: deviceUUID
                      name: FTD_Device1
                      type: Device
                    type: PolicyAssignment
              schema:
                $ref: '#/components/schemas/PolicyAssignment'
                type: object
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
                type: object
          description: Error
      tags:
      - Policy Assignments
    put:
      deprecated: false
      description: '**Modify the policy assignment associated with the specified ID. _Check the response section for applicable
        examples (if any)._**'
      operationId: updatePolicyAssignment
      parameters:
      - description: Unique identifier of the policy assignment.
        in: path
        name: objectId
        required: true
        schema:
          type: string
      - $ref: '#/components/parameters/domainUUID'
        name: domainUUID
      requestBody:
        content:
          application/json:
            examples:
              ? 'Example 1 : PUT /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( PUT
                request to modify policy assignment of FTDPlatformSettings policy )'
              : value:
                  id: policyassignmentUUID
                  policy:
                    id: ftdplatformsettingsUUID
                    name: FTDPlatformSettingsPolicy1
                    type: FTDPlatformSettingsPolicy
                  targets:
                  - id: deviceUUID
                    name: FTD_Device1
                    type: Device
                  type: PolicyAssignment
              ? 'Example 2 : PUT /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( PUT
                request to modify policy assignment of AC policy )'
              : value:
                  id: policyassignmentUUID
                  policy:
                    id: accesspolicyUUID
                    name: AccessPolicy1
                    type: AccessPolicy
                  targets:
                  - id: deviceUUID
                    name: FTD_Device1
                    type: Device
                  type: PolicyAssignment
              ? 'Example 3 : PUT /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( PUT
                request to modify policy assignment of FlexConfig policy )'
              : value:
                  id: policyassignmentUUID
                  policy:
                    id: flexconfigpolicyUUID
                    name: FlexConfigPolicy1
                    type: FlexConfigPolicy
                  targets:
                  - id: deviceUUID
                    name: FTD_Device1
                    type: Device
                  type: PolicyAssignment
              ? 'Example 4 : PUT /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( PUT
                request to modify policy assignment of NAT policy )'
              : value:
                  id: policyassignmentUUID
                  policy:
                    id: natpolicyUUID
                    name: NatPol1
                    type: FTDNatPolicy
                  targets:
                  - id: deviceUUID
                    name: FTD_Device1
                    type: Device
                  - id: deviceUUID2
                    name: FTD_Device2
                    type: Device
                  type: PolicyAssignment
              ? 'Example 5 : PUT /fmc_config/v1/domain/DomainUUID/assignment/policyassignments/policyassignmentUUID ( PUT
                request to delete policy assignments of NAT policy )'
              : value:
                  id: policyassignmentUUID
                  policy:
                    id: natpolicyUUID
                    name: NatPol1
                    type: FTDNatPolicy
                  type: PolicyAssignment
            schema:
              $ref: '#/components/schemas/PolicyAssignment'
              type: object
        description: The input policy assignment model.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAssignment'
                type: object
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
                type: object
          description: Error
      tags:
      - Policy Assignments
    servers:
    - url: https://api.us.security.cisco.com/firewall
      description: US
    - url: https://api.eu.security.cisco.com/firewall
      description: EU
    - url: https://api.apj.security.cisco.com/firewall
      description: APJ
    - url: https://api.au.security.cisco.com/firewall
      description: AUS
    - url: https://api.in.security.cisco.com/firewall
      description: IN
    - url: https://api.int.security.cisco.com/firewall
      description: Staging
    - url: https://scale.manage.security.cisco.com/api/rest
      description: Scale
    - url: https://ci.manage.security.cisco.com/api/rest
      description: CI
    - url: https://manage.stg.secure.cisco/api/rest
      description: Stgf9
components:
  parameters:
    expanded:
      description: If set to true, the GET response displays a list of objects with additional attributes.
      in: query
      name: expanded
      required: false
      schema:
        type: boolean
    limit:
      description: Number of items to return.
      in: query
      name: limit
      required: false
      schema:
        format: int32
        type: integer
    offset:
      description: Index of first item to return.
      in: query
      name: offset
      required: false
      schema:
        format: int32
        type: integer
    domainUUID:
      description: Domain UUID
      in: path
      name: domainUUID
      required: true
      schema:
        type: string
  schemas:
    Domain:
      description: The details about the domain.
      properties:
        id:
          description: Unique UUID of this domain
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          description: Links to the domain resource URLs.
          type: object
        name:
          description: Name of the domain.
          type: string
        type:
          description: Domain type definition (fixed).
          type: string
        uuid:
          type: string
      type: object
    Metadata:
      description: Defines read only details about the object - whether it is system defined, last user who modified the object
        etc.
      properties:
        domain:
          $ref: '#/components/schemas/Domain'
          description: Defines the domains this instance belongs to (if applicable).
          type: object
        isLocked:
          type: boolean
        lastUser:
          $ref: '#/components/schemas/MetadataUser'
          description: The last user who modified this instance.
          type: object
        matches:
          items:
            type: string
          type: array
        readOnly:
          $ref: '#/components/schemas/ReadOnly'
          description: Details regarding the read only status of this instance
          type: object
        timestamp:
          description: The last updated timestamp.
          format: int32
          type: integer
      type: object
    Links:
      properties:
        parent:
          type: string
        self:
          type: string
      type: object
    IReadonly:
      properties:
        reason:
          enum:
          - RBAC
          - SYSTEM
          - DOMAIN
          type: string
        state:
          type: boolean
      type: object
    MetadataUser:
      description: This object defines details about the user.
      properties:
        id:
          description: The unique UUID of the user
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          description: Contains the self referencing links to this resource
          type: object
        name:
          description: Name of the user.
          type: string
        type:
          description: The user type (fixed).
          type: string
      type: object
    ITarget:
      description: This is the target device.
      properties:
        description:
          type: string
        id:
          description: Unique ID of the device.
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          type: object
        metadata:
          $ref: '#/components/schemas/IMetadata'
          type: object
        name:
          description: Name of the device.
          type: string
        type:
          description: Device
          type: string
        version:
          type: string
      type: object
    PolicyAssignmentListContainer:
      properties:
        items:
          $ref: '#/components/schemas/PolicyAssignment'
          type: array
        links:
          $ref: '#/components/schemas/ILinks'
          type: object
        paging:
          $ref: '#/components/schemas/PagingContainer'
          type: object
      type: object
    IMetadataUser:
      properties:
        id:
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          type: object
        name:
          type: string
        type:
          type: string
      type: object
    ErrorResponse:
      properties:
        category:
          description: Describes the category of the error thrown.
          enum:
          - FRAMEWORK
          - OTHER
          - VALIDATION
          type: string
        messages:
          description: List of error messages which the response has.
          items:
            $ref: '#/components/schemas/ErrorMessagesContainer'
            type: object
          type: array
        severity:
          description: Specifies the Highest level severity among all the error messages.
          enum:
          - ERROR
          - WARN
          type: string
      type: object
    ILinks:
      description: This defines the self referencing links for the given resource.
      properties:
        parent:
          description: Full resource URL path to reference the parent (if any) for this resource.
          type: string
        self:
          description: Full resource URL path to reference this particular resource.
          type: string
      type: object
    PolicyAssignment:
      properties:
        description:
          type: string
        id:
          type: string
        links:
          $ref: '#/components/schemas/Links'
          type: object
        metadata:
          $ref: '#/components/schemas/Metadata'
          type: object
        name:
          type: string
        policy:
          $ref: '#/components/schemas/IPolicyModel'
          type: object
        targets:
          items:
            $ref: '#/components/schemas/ITarget'
            type: object
          type: array
        type:
          type: string
        version:
          type: string
      type: object
    PagingContainer:
      properties:
        count:
          format: int32
          type: integer
        limit:
          format: int32
          type: integer
        offset:
          format: int32
          type: integer
        pages:
          format: int32
          type: integer
      type: object
    IMetadata:
      properties:
        domain:
          $ref: '#/components/schemas/IDomain'
          type: object
        isLocked:
          type: boolean
        lastUser:
          $ref: '#/components/schemas/IMetadataUser'
          type: object
        matches:
          items:
            type: string
          type: array
        readOnly:
          $ref: '#/components/schemas/IReadonly'
          type: object
        timestamp:
          format: int32
          type: integer
      type: object
    IDomain:
      properties:
        id:
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          type: object
        name:
          type: string
        type:
          type: string
      type: object
    ErrorMessagesContainer:
      properties:
        bulkPayloadIndex:
          description: More details about the error.
          type: string
        code:
          description: More details about the error.
          type: string
        description:
          description: More details about the error.
          type: string
        details:
          description: More details about the error.
          type: string
        errorCode:
          description: More details about the error.
          type: string
        location:
          description: More details about the error.
          type: string
        severity:
          description: Specifies the Highest level severity among all the error messages.
          enum:
          - ERROR
          - WARN
          type: string
      type: object
    IPolicyModel:
      properties:
        description:
          type: string
        id:
          type: string
        links:
          $ref: '#/components/schemas/ILinks'
          type: object
        metadata:
          $ref: '#/components/schemas/IMetadata'
          type: object
        name:
          type: string
        type:
          type: string
        version:
          type: string
      type: object
    ReadOnly:
      description: Defines the read only conditions if the referenced resource is read only.
      properties:
        reason:
          description: Reason the resource is read only - SYSTEM (if it is system defined), RBAC (if user RBAC permissions
            make it read only) or DOMAIN (if resource is read only in current domain).
          enum:
          - RBAC
          - SYSTEM
          - DOMAIN
          type: string
        state:
          description: True if this resource us read only and false otherwise.
          type: boolean
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http
x-refined-from:
- cdfmc-openapi.yaml
- cisco-secure-firewall-cdfmc-openapi.yml