Palo Alto Networks Apps API
The Apps API from Palo Alto Networks — 4 operation(s) for apps.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-apps-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Apps API
version: '1.0'
description: 'Operations tagged Apps across 3 of this provider''s published API definitions: palo-alto-networks-apps-api-openapi.yml, palo-alto-sase-sspm-consolidated-sspm-new-openapi.yaml, palo-alto-sspm-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
- url: https://api.sase.paloaltonetworks.com/sspm
description: SASE SSPM API production server.
tags:
- name: Apps
description: SaaS application onboarding and management.
paths:
/v1/apps:
get:
operationId: listOnboardedApps
summary: Palo Alto Networks List Onboarded SaaS Applications
description: Returns the list of SaaS applications that have been onboarded to SSPM for posture assessment. Each entry includes the application type, connection status, and summary counts of posture check results by severity.
tags:
- Apps
parameters:
- name: status
in: query
description: Filter applications by connection status.
schema:
type: string
enum:
- connected
- disconnected
- pending
- error
example: disconnected
- name: offset
in: query
description: Number of results to skip for pagination.
schema:
type: integer
default: 0
example: 0
- name: limit
in: query
description: Maximum number of applications to return.
schema:
type: integer
default: 50
maximum: 200
example: 50
responses:
'200':
description: Onboarded applications returned.
content:
application/json:
schema:
type: object
properties:
total:
type: integer
offset:
type: integer
limit:
type: integer
items:
type: array
items:
$ref: '#/components/schemas/OnboardedApp'
examples:
ListOnboardedApps200Example:
summary: Default listOnboardedApps 200 response
x-microcks-default: true
value:
total: 694
offset: 752
limit: 416
items:
- app_id: '621838'
app_type: standard
display_name: Sarah Doe
status: error
tenant_id: tenant-34be8834
check_summary:
critical: 904
high: 463
medium: 193
low: 762
pass: 336
last_scanned_at: '2026-06-23T07:17:30Z'
onboarded_at: '2026-07-05T03:34:39Z'
- app_id: '621838'
app_type: standard
display_name: Sarah Doe
status: error
tenant_id: tenant-34be8834
check_summary:
critical: 904
high: 463
medium: 193
low: 762
pass: 336
last_scanned_at: '2026-06-23T07:17:30Z'
onboarded_at: '2026-07-05T03:34:39Z'
'400':
description: Invalid query parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListOnboardedApps400Example:
summary: Default listOnboardedApps 400 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListOnboardedApps401Example:
summary: Default listOnboardedApps 401 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListOnboardedApps403Example:
summary: Default listOnboardedApps 403 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListOnboardedApps500Example:
summary: Default listOnboardedApps 500 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
post:
operationId: onboardApp
summary: Palo Alto Networks Onboard New Application
description: Onboards a new SaaS application to SSPM for posture assessment. Requires specifying the application type and providing the OAuth consent or API credentials needed to connect to the application. After onboarding, SSPM performs an initial posture scan.
tags:
- Apps
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/OnboardAppRequest'
examples:
OnboardAppRequestExample:
summary: Default onboardApp request
x-microcks-default: true
value:
app_type: standard
display_name: Alex Garcia
credentials: {}
responses:
'201':
description: Application onboarded successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/OnboardedApp'
examples:
OnboardApp201Example:
summary: Default onboardApp 201 response
x-microcks-default: true
value:
app_id: '621838'
app_type: standard
display_name: Sarah Doe
status: error
tenant_id: tenant-34be8834
check_summary:
critical: 904
high: 463
medium: 193
low: 762
pass: 336
last_scanned_at: '2026-06-23T07:17:30Z'
onboarded_at: '2026-07-05T03:34:39Z'
'400':
description: Invalid request body or unsupported application type.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
OnboardApp400Example:
summary: Default onboardApp 400 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
OnboardApp401Example:
summary: Default onboardApp 401 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
OnboardApp403Example:
summary: Default onboardApp 403 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'409':
description: Application of this type is already onboarded.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
OnboardApp409Example:
summary: Default onboardApp 409 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
OnboardApp500Example:
summary: Default onboardApp 500 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
/v1/apps/{app_id}:
delete:
operationId: removeApp
summary: Palo Alto Networks Remove Onboarded Application
description: Removes a previously onboarded SaaS application from SSPM. This stops posture scanning for the application and removes all associated check results. This action cannot be undone.
tags:
- Apps
parameters:
- name: app_id
in: path
required: true
description: Unique identifier of the onboarded application.
schema:
type: string
example: '293827'
responses:
'204':
description: Application removed successfully.
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
RemoveApp401Example:
summary: Default removeApp 401 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
RemoveApp403Example:
summary: Default removeApp 403 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'404':
description: Application not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
RemoveApp404Example:
summary: Default removeApp 404 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
RemoveApp500Example:
summary: Default removeApp 500 response
x-microcks-default: true
value:
error: example-error
message: Malware violation rule blocked detected endpoint policy detected.
request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
/sspm/api/v1/apps:
get:
summary: Registered Application
description: Retrieve the list of onboarded SaaS applications.
operationId: getRegisteredApplications
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ApplicationPage'
description: successful operation
parameters:
- description: region
in: header
name: x-panw-region
required: false
schema:
type: string
- description: List of filters
example: filter=type:office365
in: query
name: filter
schema:
type: string
- description: 'defines sorting of the result.Format: FIELD_NAME:DIRECTION|FIELD_NAME:DIRECTION|... .'
example: order_by=name:asc|type:desc
in: query
name: order_by
schema:
type: string
- description: applies page_token to get requested page of items
example: page_token=MSM2Iw==
in: query
name: page_token
schema:
type: string
tags:
- Apps
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/api/v1/apps/{app_id}:
get:
summary: Application Details
description: Retrieve the basic details of the application by providing app ID and tenant name.
operationId: getRegisteredApplication
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Application'
description: successful operation
'404':
description: not registered application
parameters:
- description: region
in: header
name: x-panw-region
required: false
schema:
type: string
- description: application id
example: f1700e7b-e60f-4d5e-bfce-aba3543adf8e
in: path
name: app_id
required: true
schema:
type: string
tags:
- Apps
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/api/v1/apps/{app_id}/configs:
get:
summary: Application Configuration Details
description: Retrieve details on the application configuration by providing app ID and tenant name.
operationId: getApplicationConfigs
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Config'
type: array
description: successful operation
'404':
description: not registered application
parameters:
- description: region
in: header
name: x-panw-region
required: false
schema:
type: string
- description: application id
example: f1700e7b-e60f-4d5e-bfce-aba3543adf8e
in: path
name: app_id
required: true
schema:
type: string
tags:
- Apps
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/api/v1/apps/{app_id}/settings:
get:
summary: Application Settings Details
description: Retrieve details on the settings of the SaaS application by providing app ID and tenant name.
operationId: getApplicationSettings
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Config'
type: array
description: successful operation
'404':
description: not registered application
parameters:
- description: region
in: header
name: x-panw-region
required: false
schema:
type: string
- description: application id
example: f1700e7b-e60f-4d5e-bfce-aba3543adf8e
in: path
name: app_id
required: true
schema:
type: string
tags:
- Apps
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
components:
schemas:
OnboardAppRequest:
type: object
required:
- app_type
properties:
app_type:
type: string
description: Application type to onboard (e.g., google_workspace, microsoft_365, salesforce).
example: standard
display_name:
type: string
description: Optional display name for this application instance.
example: Alex Garcia
credentials:
type: object
description: Authentication credentials required to connect to the application.
additionalProperties: true
example: {}
OnboardedApp:
type: object
properties:
app_id:
type: string
description: Unique identifier for the onboarded application.
example: '621838'
app_type:
type: string
description: Application type identifier (e.g., google_workspace, microsoft_365).
example: standard
display_name:
type: string
description: Human-readable name for the onboarded application instance.
example: Sarah Doe
status:
type: string
enum:
- connected
- disconnected
- pending
- error
description: Current connection status.
example: error
tenant_id:
type: string
description: Tenant or domain identifier within the SaaS application.
example: tenant-34be8834
check_summary:
type: object
description: Summary counts of posture check results by severity.
properties:
critical:
type: integer
example: 195
high:
type: integer
example: 699
medium:
type: integer
example: 127
low:
type: integer
example: 223
pass:
type: integer
example: 442
example:
critical: 904
high: 463
medium: 193
low: 762
pass: 336
last_scanned_at:
type: string
format: date-time
description: Timestamp of the most recent posture scan.
example: '2026-06-23T07:17:30Z'
onboarded_at:
type: string
format: date-time
description: Timestamp when the application was onboarded.
example: '2026-07-05T03:34:39Z'
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code identifying the error type.
example: example-error
message:
type: string
description: Human-readable description of the error.
example: Malware violation rule blocked detected endpoint policy detected.
request_id:
type: string
description: Request identifier for support correlation.
example: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
Config:
properties:
app_id:
type: string
category:
type: string
common_control_id:
type: string
config_id:
type: string
console_url:
type: string
current_value:
type: string
description:
type: string
descriptionUrl:
type: string
id:
type: string
locked:
type: boolean
locked_value:
type: string
monitored:
type: boolean
monitored_attestation:
type: string
name:
type: string
operator:
type: string
operator_display_value:
type: string
overridden:
type: boolean
overridden_value:
type: string
recommended_value:
type: string
remediation_enabled:
type: boolean
remediation_steps:
type: string
status:
type: string
subcategory:
type: string
tenant:
type: string
tickets:
items:
$ref: '#/components/schemas/Ticket'
type: array
type: object
Application:
properties:
app_id:
type: string
app_settings:
additionalProperties:
type: string
type: object
changed_at:
format: date-time
type: string
changed_by:
type: string
configs:
additionalProperties:
type: string
type: object
created_at:
format: date-time
type: string
created_by:
type: string
fawkes_url:
type: string
features_metadata:
additionalProperties:
additionalProperties:
type: string
type: object
type: object
features_state:
additionalProperties:
$ref: '#/components/schemas/FeatureState'
type: object
health_status:
enum:
- Up
- Unhealthy
- Down
- Unknown
- Scanning
type: string
instance_label:
enum:
- Default
- Production
- Sandbox
- Internal
- QA
- Dev
type: string
last_scanned_at:
format: date-time
type: string
last_validated_at:
format: date-time
type: string
missing_configs:
items:
type: string
type: array
name:
type: string
owner:
$ref: '#/components/schemas/User'
remediation_enabled:
type: boolean
scan_interval_minutes:
format: int32
type: integer
status:
enum:
- Registered
- Active
- Disabled
type: string
tenant:
type: string
tsg_id:
type: string
type:
type: string
type: object
ApplicationPage:
properties:
items:
items:
type: object
type: array
limit:
format: int32
type: integer
next_path:
type: string
prev_path:
type: string
total:
format: int64
type: integer
type: object
User:
properties:
email:
type: string
full_name:
type: string
user_id:
type: string
required:
- email
- full_name
- user_id
type: object
FeatureState:
properties:
last_scanned_at:
format: date-time
type: string
status:
enum:
- UNKNOWN
- OK
- UNHEALTHY
- AUTH_REQUIRED
- SCANNING
type: string
status_details:
type: string
updated_at:
format: date-time
type: string
type: object
Ticket:
properties:
createdAt:
format: date-time
type: string
integrationId:
type: string
summary:
type: string
tenant:
type: string
ticketKey:
type: string
ticketUrl:
type: string
type:
enum:
- JIRA_TICKETING
- SNOW_TICKETING
type: string
type: object
securitySchemes:
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-networks-apps-api-openapi.yml
- palo-alto-sase-sspm-consolidated-sspm-new-openapi.yaml
- palo-alto-sspm-api-openapi-original.yml