Palo Alto Networks Agent Controller API

openapi: 3.2.0
info:
  title: ADEM data Agent Controller API
  version: 2.1.1
  description: "This API provides access to the Autonomous Digital Experience Management timeseries data.\nAll responses are aggregates over a period of time specified by the start, end, or timerange query parameters. \nThe aggregrate used for each field will depend on the field type. For simple numerical types, for example application score, \nthe aggregate will typically be an average (for example, scores or metrics). In some cases, it may be a maximum, minimum, or sum. \nFor string fields, it may be a comma separated concatenation of distinct values in the sample period. This spec was created on February 13, 2026. © 2026 Palo Alto Networks, Inc."
servers:
- url: https://api.sase.paloaltonetworks.com
security:
- jwt: []
tags:
- name: AgentController
paths:
  /adem/telemetry/v2/agent/properties:
    get:
      x-controller-name: AgentController
      x-operation-name: getAgentProperties
      tags:
      - AgentController
      summary: Get agent properties
      responses:
        '200':
          description: Agent properties
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/AgentSummary'
                - $ref: '#/components/schemas/AgentSeries'
        '400':
          description: Invalid Request
        '401':
          description: Invalid Client
        '500':
          description: Server Error
      parameters:
      - name: start
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample start time in seconds (unix epoch)
      - name: end
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample end time in seconds (unix epoch)
      - name: timerange
        in: query
        required: false
        schema:
          type: string
          description: A time range e.g 'last_3_hours', 'last_7_days'
      - name: truncate-timerange
        in: query
        required: false
        schema:
          type: boolean
          description: round timestamps to nearest sample period
          default: true
      - name: filter
        in: query
        required: true
        schema:
          type: string
          description: filter results e.g. application==zoom-meeting or application==zoom-meeting, application==Gmail
      - name: include
        in: query
        required: false
        schema:
          type: string
          description: include agent properties e.g. AgentProperties.disks,AgentProperties.wlans,AgentProperties.computerName
      - name: Prisma-Tenant
        in: header
        schema:
          type: string
          description: Tenant ( tenant_service_group or tenant_service_group:subtenant )
        required: true
      - name: Prisma-SubTenant
        in: header
        schema:
          type: string
          description: SubTenant
        required: false
      - name: endpoint-type
        in: query
        required: true
        schema:
          type: string
          description: endpoint type
          enum:
          - muAgent
          - rnAgent
      - name: response-type
        in: query
        required: true
        schema:
          type: string
          enum:
          - timeseries
          - summary
      operationId: AgentController.getAgentProperties
      description: Retrieve the properties details through this endpoint.
  /adem/telemetry/v2/measure/agent/metric:
    get:
      x-controller-name: AgentController
      x-operation-name: getAgentMetric
      tags:
      - AgentController
      summary: Get agent metrics
      responses:
        '200':
          description: Agent metric
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/MetricSummaryCollection'
                - $ref: '#/components/schemas/MetricSeries'
        '400':
          description: Invalid Request
        '401':
          description: Invalid Client
        '500':
          description: Server Error
      parameters:
      - name: start
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample start time in seconds (unix epoch)
      - name: end
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample end time in seconds (unix epoch)
      - name: timerange
        in: query
        required: false
        schema:
          type: string
          description: A time range e.g 'last_3_hours', 'last_7_days'
      - name: truncate-timerange
        in: query
        required: false
        schema:
          type: boolean
          description: round timestamps to nearest sample period
          default: true
      - name: group
        in: query
        required: false
        schema:
          type: string
          description: entity to group results by (e.g. Entity.user or Entity.user,Entity.endpoint)
      - name: filter
        in: query
        required: false
        schema:
          type: string
          description: filter results e.g. application==zoom-meeting or application==zoom-meeting, application==Gmail
      - name: Prisma-Tenant
        in: header
        schema:
          type: string
          description: Tenant ( tenant_service_group or tenant_service_group:subtenant )
        required: true
      - name: Prisma-SubTenant
        in: header
        schema:
          type: string
          description: SubTenant
        required: false
      - name: endpoint-type
        in: query
        required: true
        schema:
          type: string
          description: endpoint type
          enum:
          - muAgent
          - rnAgent
      - name: response-type
        in: query
        required: true
        schema:
          type: string
          enum:
          - timeseries
          - grouped-summary
      operationId: AgentController.getAgentMetric
      description: Retrieve the metric details through this endpoint.
  /adem/telemetry/v2/measure/agent/score:
    get:
      x-controller-name: AgentController
      x-operation-name: getAgentScore
      tags:
      - AgentController
      summary: Get agent scores
      responses:
        '200':
          description: Summary of agent scores
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/ScoreSummary'
                - $ref: '#/components/schemas/ScoreSeries'
                - $ref: '#/components/schemas/ScoreSummaryCollection'
                - $ref: '#/components/schemas/ScoreSeriesCollection'
                - $ref: '#/components/schemas/ScoreDistributionCollection'
        '400':
          description: Invalid Request
        '401':
          description: Invalid Client
        '500':
          description: Server Error
      parameters:
      - name: start
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample start time in seconds (unix epoch)
      - name: end
        in: query
        required: false
        schema:
          type: integer
          format: int64
          maximum: 2147483648
          description: sample end time in seconds (unix epoch)
      - name: timerange
        in: query
        required: false
        schema:
          type: string
          description: A time range e.g 'last_3_hours', 'last_7_days'
      - name: truncate-timerange
        in: query
        required: false
        schema:
          type: boolean
          description: round timestamps to nearest sample period
          default: true
      - name: filter
        in: query
        required: false
        schema:
          type: string
          description: filter results e.g. application==zoom-meeting or application==zoom-meeting, application==Gmail
      - name: include
        in: query
        required: false
        schema:
          type: string
          description: include agent properties or entity counts e.g. EntityCounts.endpoint,EntityCounts.user,AgentProperties.computername
      - name: group
        in: query
        required: false
        schema:
          type: string
          description: entity to group results by (e.g. Entity.user or Entity.user,Entity.endpoint)
      - name: Prisma-Tenant
        in: header
        schema:
          type: string
          description: Tenant ( tenant_service_group or tenant_service_group:subtenant )
        required: true
      - name: Prisma-SubTenant
        in: header
        schema:
          type: string
          description: SubTenant
        required: false
      - name: endpoint-type
        in: query
        required: true
        schema:
          type: string
          description: endpoint type
          enum:
          - muAgent
          - rnAgent
      - name: result-filter
        in: query
        schema:
          type: array
          items:
            type: string
            description: aggregate filter e.g. Score.application==poor,fair or MuAgent.selfServeUserEnabled==false
      - name: response-type
        in: query
        required: true
        schema:
          type: string
          enum:
          - timeseries
          - summary
          - distribution
          - grouped-summary
          - grouped-timeseries
      - name: pagination
        in: query
        required: false
        schema:
          type: string
          description: paginate results (e.g. page==0;limit==10;sortBy==application;sortOrder==asc
      - name: distribution-by
        in: query
        required: false
        schema:
          type: string
          description: distribution entity e.g. Entity.user or Entity.endpoint
      operationId: AgentController.getAgentScore
      description: Retrieve the score details through this endpoint.
components:
  schemas:
    EntityCounts:
      title: EntityCounts
      type: object
      properties:
        endpoint:
          type: number
          description: count of distinct endpoints
        location:
          type: number
          description: count of distinct locations
        user:
          type: number
          description: count of distinct users
        site:
          type: number
          description: count of distinct sites
        test:
          type: number
          description: count of distinct application tests
      additionalProperties: false
    AgentGpGateway:
      title: AgentGpGateway
      type: object
      properties:
        startTime:
          type: number
          description: GP tunnel location change time
        value:
          type: string
          description: GP tunnel location change value e.g. US West
      additionalProperties: false
    AgentSystemMemoryNotification:
      title: AgentSystemMemoryNotification
      type: object
      properties:
        time:
          type: number
          description: system memory change time
        disposition:
          type: number
          description: system memory disposition (1=enabled,2=disabled,3=enabled+acknowledged
        usage:
          type: number
          description: system memory usage, percent
        threshold:
          type: number
          description: system memory threshold, percent
      additionalProperties: false
    AgentSystemCpuNotification:
      title: AgentSystemCpuNotification
      type: object
      properties:
        time:
          type: number
          description: CPU change time
        disposition:
          type: number
          description: CPU disposition (1=enabled,2=disabled,3=enabled+acknowledged
        usage:
          type: number
          description: CPU usage, percent
        threshold:
          type: number
          description: CPU threshold, percent
      additionalProperties: false
    AgentWlan:
      title: AgentWlan
      type: object
      properties:
        macAddress:
          type: string
          description: wireless LAN MAC address, e.g 8c:85:90:58:15:98
        ssid:
          type: string
          description: wireless LAN SSID, e.g TP-LINK_72D1_5G
        bssid:
          type: string
          description: wireless LAN BSSID, e.g 70:4f:57:74:72:d2
        channel:
          type: string
          description: wireless LAN channel e.g 36
        quality:
          type: number
          description: wireless LAN quality, 0 - 100
        minQuality:
          type: number
          description: minimum wireless LAN quality, 0 - 100
        maxQuality:
          type: number
          description: maximum wireless LAN quality, 0 - 100
        rx:
          type: number
          description: wireless LAN received bytes
        minRx:
          type: number
          description: minimum wireless LAN received bytes
        maxRx:
          type: number
          description: maximum wireless LAN received bytes
        tx:
          type: number
          description: maximum wireless LAN sent bytes
        minTx:
          type: number
          description: minimum wireless LAN sent bytes
        maxtx:
          type: number
          description: maximum wireless LAN sent bytes
        phyMode:
          type: string
          description: wireless LAN PHY mode e.g. 802.11ac
      additionalProperties: false
    AgentGpTunnelStatus:
      title: AgentGpTunnelStatus
      type: object
      properties:
        startTime:
          type: number
          description: GP tunnel status change time
        value:
          type: string
          description: GP tunnel status change value e.g connected, disconnected
      additionalProperties: false
    MetricSeries:
      title: MetricSeries
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        samplePeriod:
          type: number
          description: sample period in seconds
        series:
          type: array
          items:
            $ref: '#/components/schemas/Metric'
      required:
      - id
      additionalProperties: false
    Pagination:
      title: Pagination
      type: object
      properties:
        page:
          type: number
          description: page number
        limit:
          type: number
          description: page limit
        sortBy:
          type: string
          description: sort by field
        sortOrder:
          type: string
          description: 'sort order : asc, desc'
        enabled:
          type: boolean
      additionalProperties: false
    ScoreDistributionCollection:
      title: ScoreDistributionCollection
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        classifier:
          type: string
          description: score classifier e.g. poor:[0 - 30],fair:[30 - 70],good:[70 - 100]
        entityCounts:
          $ref: '#/components/schemas/EntityCounts'
        collection:
          type: array
          items:
            $ref: '#/components/schemas/ScoreDistribution'
      additionalProperties: false
    AgentSeries:
      title: AgentSeries
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        samplePeriod:
          type: number
          description: sample period in seconds
        series:
          type: array
          items:
            $ref: '#/components/schemas/Agent'
        seriesEntityCount:
          type: array
          items:
            $ref: '#/components/schemas/SeriesEntityCounts'
      required:
      - id
      additionalProperties: false
    ScoreSummary:
      title: ScoreSummary
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        average:
          $ref: '#/components/schemas/Score'
        entityCounts:
          $ref: '#/components/schemas/EntityCounts'
        agentProperties:
          $ref: '#/components/schemas/Agent'
      required:
      - id
      additionalProperties: false
    Metric:
      title: Metric
      type: object
      properties:
        sample:
          type: number
          description: sample time (Unix timestamp)
        loss:
          type: number
          description: packet loss, percentage
        maxLoss:
          type: number
          description: maximum packet loss, percentage
        jitter:
          type: number
          description: network jitter, microseconds
        maxJitter:
          type: number
          description: maximum network jitter, microseconds
        delay:
          type: number
          description: network round trip time, microseconds
        maxDelay:
          type: number
          description: maximum network round trip time, microseconds
        availability:
          type: number
          description: network availability, percentage
        dnsLookupTime:
          type: number
          description: DNS lookup, microseconds
        maxDnsLookupTime:
          type: number
          description: maximum DNS lookup, microseconds
        tcpHandshakeTime:
          type: number
          description: TCP handshake, microseconds
        maxTcpHandshakeTime:
          type: number
          description: maximum TCP handshake, microseconds
        sslHandshakeTime:
          type: number
          description: SSL handshake, microseconds
        maxSslHandshakeTime:
          type: number
          description: maximum SSL handshake, microseconds
        waitTime:
          type: number
          description: wait time, microseconds
        maxWaitTime:
          type: number
          description: maximum wait time, microseconds
        timeToFirstByte:
          type: number
          description: time to first byte, microseconds
        maxTimeToFirstByte:
          type: number
          description: maximum time to first byte, microseconds
        dataTransferTime:
          type: number
          description: data transfer time, microseconds
        maxDataTransferTime:
          type: number
          description: maximum data transfer time, microseconds
        throughput:
          type: number
          description: data throughput
        maxThroughput:
          type: number
          description: maximum data throughput
        totalTime:
          type: number
          description: total time, microseconds
      additionalProperties: false
    AgentWifiConnectivityNotification:
      title: AgentWifiConnectivityNotification
      type: object
      properties:
        time:
          type: number
          description: wireless LAN connectivity change time
        disposition:
          type: number
          description: wireless LAN connectivity disposition (1=enabled,2=disabled,3=enabled+acknowledged
        connected:
          type: boolean
          description: wireless LAN connectivity
      additionalProperties: false
    Agent:
      title: Agent
      type: object
      properties:
        sample:
          type: number
          description: sample time (Unix timestamp)
        muGatewayPublicIp:
          type: string
          description: IP Adress of the MU gateway to which the agent connects
        agentPublicIp:
          type: string
          description: Public IP Adress of the agent
        username:
          type: string
          description: Global Protect username
        globalProtectVersion:
          type: string
          description: Global Protect version
        globalProtectGatewayLocation:
          type: string
          description: Global Protect location
        globalProtectTunnelStatus:
          type: string
          description: Global Protect tunnel status
        endpointVersion:
          type: string
          description: endpoint device version
        operatingSystemVersion:
          type: string
          description: endpoint device operating system version
        operatingSystem:
          type: string
          description: endpoint device operating system name
        computerName:
          type: string
          description: endpoint device computer name
        model:
          type: string
          description: endpoint device computer model
        country:
          type: string
          description: endpoint device country (derived from public IP)
        city:
          type: string
          description: endpoint device city (derived from public IP)
        latitude:
          type: number
          description: endpoint device latitude (derived from public IP)
        longitude:
          type: number
          description: endpoint device longitude (derived from public IP)
        asn:
          type: number
          description: endpoint device ASN (derived from public IP)
        asnOrgName:
          type: string
          description: endpoint device ASN ORG (derived from public IP)
        cpuAverage:
          type: number
          description: average CPU (float)
        cpuMin:
          type: number
          description: minimum CPU (float)
        cpuMax:
          type: number
          description: maximum CPU (float)
        ramAverage:
          type: number
          description: average RAM (float)
        ramMin:
          type: number
          description: minimum RAM (float)
        ramMax:
          type: number
          description: maximum RAM (float)
        batteryCharge:
          type: number
        batteryIsCharging:
          type: number
        batterySaver:
          type: number
        deviceCount:
          type: number
        disks:
          type: array
          items:
            $ref: '#/components/schemas/AgentDisk'
        wlans:
          type: array
          items:
            $ref: '#/components/schemas/AgentWlan'
        topMemoryProcesses:
          type: array
          items:
            $ref: '#/components/schemas/AgentTopProcess'
        topCpuProcesses:
          type: array
          items:
            $ref: '#/components/schemas/AgentTopProcess'
        gpGateway:
          type: array
          items:
            $ref: '#/components/schemas/AgentGpGateway'
        gpTunnelStatus:
          type: array
          items:
            $ref: '#/components/schemas/AgentGpTunnelStatus'
        wifiLinkQualityNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentWifiLinkQualityNotification'
        wifiSsidChangeNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentWifiSsidChangeNotification'
        wifiConnectivityNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentWifiConnectivityNotification'
        internetConnectivityNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentInternetConnectivityNotification'
        systemCpuNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentSystemCpuNotification'
        systemMemoryNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentSystemMemoryNotification'
        systemCpuMemoryNotificationArray:
          type: array
          items:
            $ref: '#/components/schemas/AgentSystemCpuMemoryNotification'
        selfServeConfigEnabled:
          type: boolean
          description: self serve config enabled
        selfServeUserEnabled:
          type: boolean
          description: self serve user enabled
        wifiLinkQualityNotification:
          type: number
          description: wireless LAN quality notifications
        wifiSsidChangeNotification:
          type: number
          description: wireless LAN SSID change notifications
        internetConnectivityNotification:
          type: number
          description: internet connectivity change notifications
        systemCpuNotification:
          type: number
          description: system cpu change notifications
        systemMemoryNotification:
          type: number
          description: system memory change notifications
        systemCpuMemoryNotification:
          type: number
          description: system cpu or memory change notifications
        wifiConnectivityNotification:
          type: number
          description: wireless LAN connectivity change notifications
        totalNotifications:
          type: number
          description: total notifications
      additionalProperties: false
    MetricSummary:
      title: MetricSummary
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        average:
          $ref: '#/components/schemas/Metric'
      required:
      - id
      additionalProperties: false
    AgentSummary:
      title: AgentSummary
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        entityCounts:
          $ref: '#/components/schemas/EntityCounts'
        average:
          $ref: '#/components/schemas/Agent'
      required:
      - id
      additionalProperties: false
    ScoreDistribution:
      title: ScoreDistribution
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        id:
          type: string
        classifier:
          type: string
          description: score classifier e.g. poor:[0 - 30],fair:[30 - 70],good:[70 - 100]
        entityCounts:
          $ref: '#/components/schemas/EntityCounts'
        distribution:
          $ref: '#/components/schemas/Distribution'
      additionalProperties: false
    Distribution:
      title: Distribution
      type: object
      properties:
        sample:
          type: number
        score:
          type: number
          description: average of all scores in distribution
        clients:
          type: number
          description: count of distribution entity e.g. application tests, endpoints
        poor:
          type: number
          description: count of scores classified as poor
        poorValues:
          type: array
          items:
            type: string
        fair:
          type: number
          description: count of scores classified as fair
        fairValues:
          type: array
          items:
            type: string
        good:
          type: number
          description: count of scores classified as good
        goodValues:
          type: array
          items:
            type: string
        unclassified:
          type: number
          description: count of unclassified scores
      additionalProperties: false
    AgentInternetConnectivityNotification:
      title: AgentInternetConnectivityNotification
      type: object
      properties:
        time:
          type: number
          description: internet connectivity change time
        disposition:
          type: number
          description: internet connectivity disposition (1=enabled,2=disabled,3=enabled+acknowledged
        connected:
          type: boolean
          description: internet connectivity
      additionalProperties: false
    AgentTopProcess:
      title: AgentTopProcess
      type: object
      properties:
        command:
          type: string
          description: command name
        cpu:
          type: number
          description: command CPU usage, percent
        memory:
          type: number
          description: command RAM usage, percent
      additionalProperties: false
    ScoreSeriesCollection:
      title: ScoreSeriesCollection
      type: object
      properties:
        startTime:
          type: number
          description: sample start time (Unix timestamp)
        endTime:
          type: number
          description: sample end time (Unix timestamp)
        endpointType:
          type: string
          description: 'endpoint type : muAgent, muProbe, rnAgent, rnProbe'
        tenantServiceGroup:
          type: string
          description: array of tenant service groups
        pagination:
          $ref: '#/components/schemas/Pagination'
        rowCount:
          type: number
        collection:
          type: array
          items:
            $ref: '#/components/schemas/ScoreSeries'
        samplePeriod:
          type: number
          description: sample period in seconds
      additionalProperties: false
    Score:
      title: Score
      type: object
      properties:
        sample:
          type: number
        endpointScore:
          type: number
          description: endpoint device score (memory, cpu, disk), 0 - 100
        wlan:
          type: number
          description: wireless network score, 0 - 100
        lan:
          type: number
          description: local network score, 0 - 100
        vpnUnderlay:
          type: number
          description: underlay score (tunnel endpoint), 0 - 100
        vpnOverlay:
    

# --- truncated at 32 KB (38 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-agentcontroller-api-openapi.yml