Palo Alto Networks Agent Users API API
Retrieve the agent client version distribution, providing agent details.
OpenAPI Specification
openapi: 3.2.0
info:
contact:
email: support@paloaltonetworks.com
description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.
The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of
your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access
customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group
(TSG) identifier.
These APIs use the common SASE authentication mechanism and base URL. See the
[Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.
This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see
[Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).
© 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at
[https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)
All other marks mentioned herein may be trademarks of their respective companies.
'
license:
name: MIT
url: https://opensource.org/license/mit
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
title: Palo Alto Networks 3.0 Agent Users API API
version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: 'Retrieve the agent client version distribution, providing agent details.
'
name: Agent Users API
paths:
/insights/v3.0/resource/export/query/users/agent/user_list:
post:
description: 'Export a list of agent users.
'
operationId: post-insights-v3.0-resource-export-query-users-agent-user_list
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name
values:
- device1
- operator: in
property: agent_version
values:
- 1.0.0
- operator: in
property: client_os_version
values:
- Windows 10
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- US
- operator: in
property: client_public_address
values:
- 1.1.1.1
- operator: in
property: source_ip
values:
- 192.168.1.1
- operator: in
property: usergroups
values:
- admin
- operator: in
property: application_name
values:
- Zoom
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: experience_score_aggregate_value
values:
- 90
- operator: in
property: device_score_aggregate_value
values:
- 80
- operator: in
property: lan_score_aggregate_value
values:
- 70
- operator: in
property: wifi_score_aggregate_value
values:
- 60
- operator: in
property: pa_score_aggregate_value
values:
- 50
- operator: in
property: internet_score_aggregate_value
values:
- 40
- operator: in
property: device_self_serve_status
values:
- true
- operator: in
property: device_isp_name
values:
- Verizon
- operator: in
property: instance_name
values:
- FW1
- operator: in
property: instance_name
values:
- instance1
- operator: in
property: project_name
values:
- project1
- operator: in
property: location_group_name
values:
- location_group1
- operator: in
property: domain_name
values:
- zoom.us
- operator: in
property: agent_type
values:
- Agent
schema:
properties:
filter:
properties:
rules:
items:
properties:
agent_type:
description: Client agent type.
example: Agent
type: string
agent_version:
description: Client agent version.
example: 1.0.0
type: string
application_name:
description: Application name.
example: Zoom
type: string
client_os_version:
description: Client OS version.
example: Windows 10
type: string
device_isp_name:
description: ISP name.
example: Verizon
type: string
device_name:
description: Device name source.
example: device1
type: string
device_score_aggregate_value:
description: Device score.
example: 80
type: number
device_self_serve_status:
description: Self-serve user enabled.
example: true
type: boolean
domain_name:
description: Application domain name.
example: zoom.us
type: string
edge_location_display_name:
description: Prisma Access location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score_aggregate_value:
description: Experience score.
example: 90
type: number
instance_name:
description: Instance name.
example: instance1
type: string
internet_score_aggregate_value:
description: Internet score.
example: 40
type: number
lan_score_aggregate_value:
description: LAN score.
example: 70
type: number
location_group_name:
description: Location group name.
example: location_group1
type: string
pa_score_aggregate_value:
description: PA score.
example: 50
type: number
platform_type:
description: Platform type.
example: prisma_access
type: string
project_name:
description: Project name.
example: project1
type: string
source_city:
description: Source city name.
example: San Jose
type: string
source_country:
description: Source country name.
example: US
type: string
source_ip:
description: Source IP address.
example: 192.168.1.1
type: string
usergroups:
description: User groups.
example: admin
type: string
username:
description: Username.
example: john.doe
type: string
wifi_score_aggregate_value:
description: WiFi score.
example: 60
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
accelerated:
description: Accelerated.
example: true
type: boolean
adem_username:
description: Adem Username.
example: john.doe@company.com
type: string
application_count:
description: Application count.
example: 5
type: integer
device_count:
description: Device count.
example: 2
type: integer
last_activity_timestamp_epoc_millis:
description: Last activity timestamp epoch millis.
example: 1678886400000
type: integer
location_group_name:
description: Location group name.
example: location_group1
type: string
project_name:
description: Project name.
example: project1
type: string
threat_count:
description: Threat count.
example: 714
type: integer
total_bytes:
description: Total bytes.
example: 179246404
type: integer
username:
description: Username.
example: john.doe
type: string
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Export Agent User List
tags:
- Agent Users API
/insights/v3.0/resource/query/users/agent/client_version_distribution:
post:
description: 'Retrieve the distribution of agent client versions.
'
operationId: post-insights-v3.0-resource-query-users-agent-client_version_distribution
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: client_agent_type
values:
- traped
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: client_agent_type
values:
- traped
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name_source
values:
- DHCP
- operator: in
property: client_agent_version
values:
- 7.1.2
- operator: in
property: client_os_version
values:
- 10.15.7
- operator: in
property: source_city_name
values:
- San Jose
- operator: in
property: source_country_name
values:
- US
- operator: in
property: client_public_address
values:
- 203.0.113.45
- operator: in
property: pa_location_name
values:
- US West
- operator: in
property: usergroups
values:
- Employees
- operator: in
property: self_serve_user_enabled
values:
- true
- operator: in
property: isp_name
values:
- Verizon
- operator: in
property: fw_name
values:
- FW-1
- operator: in
property: project_name
values:
- Project-A
- operator: in
property: location_group_name
values:
- Location-Group-1
- operator: in
property: app_domain_name
values:
- google.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
app_domain_name:
description: Name of the application domain.
example: google.com
type: string
client_agent_type:
description: Type of the client agent.
example: traped
type: string
client_agent_version:
description: Version of the client agent.
example: 7.1.2
type: string
client_os_version:
description: Version of the client OS.
example: 10.15.7
type: string
client_public_address:
description: Public IP address of the client.
example: 203.0.113.45
type: string
device_name_source:
description: Source of the device name.
example: DHCP
type: string
event_time:
description: Time of the event.
example: 5
type: number
fw_name:
description: Name of the firewall.
example: FW-1
type: string
isp_name:
description: Name of the ISP.
example: Verizon
type: string
location_group_name:
description: Name of the location group.
example: Location-Group-1
type: string
pa_location_name:
description: Name of the Prisma Access location.
example: US West
type: string
platform_type:
description: Type of platform.
example: prisma_access
type: string
project_name:
description: Name of the project.
example: Project-A
type: string
self_serve_user_enabled:
description: Is self serve user enabled.
example: true
type: boolean
source_city_name:
description: Name of the source city.
example: San Jose
type: string
source_country_name:
description: Name of the source country.
example: US
type: string
usergroups:
description: User groups.
example: Employees
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
- client_agent_type
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
client_agent_version:
description: Version of the client agent.
example: 7.1.2
type: string
num_devices:
description: Number of devices using this client agent version.
example: 10
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Agent Client Version Distribution
tags:
- Agent Users API
/insights/v3.0/resource/query/users/agent/connected_entity_count:
post:
description: 'Retrieve the number of connected entities based on specified filters.
'
operationId: post-insights-v3.0-resource-query-users-agent-connected_entity_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: connect_method
values:
- AGENT
- AGENT_PROXY
- operator: in
property: application_name
values:
- zoom
- operator: in
property: experience_score
values:
- 90
- operator: in
property: device_score
values:
- 90
- operator: in
property: lan_score
values:
- 90
- operator: in
property: wifi_score
values:
- 90
- operator: in
property: pa_score
values:
- 90
- operator: in
property: internet_score
values:
- 90
- operator: in
property: rbi
values:
- enabled
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: instance_name
values:
- fw00
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- US
- operator: in
property: username
values:
- john.doe
schema:
properties:
filter:
properties:
rules:
items:
properties:
application_name:
description: Application name.
example: zoom
type: string
connect_method:
description: Connection method.
example: AGENT
type: string
device_score:
description: Device score.
example: 90
type: number
edge_location_display_name:
description: Prisma Access Location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: Experience score.
example: 90
type: number
instance_name:
description: Instance name.
example: fw00
type: string
internet_score:
description: Internet score.
example: 90
type: number
lan_score:
description: LAN score.
example: 90
type: number
pa_score:
description: PA score.
example: 90
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
rbi:
description: RBI status.
example: enabled
type: string
source_city:
description: City from GeoIP.
example: San Jose
type: string
source_country:
description: Country from GeoIP.
example: US
type: string
username:
description: Source user name.
example: john.doe
type: string
wifi_score:
description: WiFi score.
example: 90
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of connected entities.
example: 1034
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Connected Entity Data
tags:
- Agent Users API
/insights/v3.0/resource/query/users/agent/connected_user_count_histogram:
post:
description: 'Retrieve a histogram of connected user data without filters.
'
operationId: post-insights-v3.0-resource-query-users-agent-connected_user_count_histogram
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
histogram:
enableEmptyInterval: true
property: event_time
range: minute
value: 30
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name
values:
- Johns-MacBook-Pro
- operator: in
# --- truncated at 32 KB (122 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-agent-users-api-api-openapi.yml