Palo Alto Networks Branch User API API
The Branch User API API from Palo Alto Networks — 8 operation(s) for branch user api.
OpenAPI Specification
openapi: 3.2.0
info:
contact:
email: support@paloaltonetworks.com
description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.
The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of
your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access
customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group
(TSG) identifier.
These APIs use the common SASE authentication mechanism and base URL. See the
[Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.
This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see
[Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).
© 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at
[https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)
All other marks mentioned herein may be trademarks of their respective companies.
'
license:
name: MIT
url: https://opensource.org/license/mit
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
title: Palo Alto Networks 3.0 Branch User API API
version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- name: Branch User API
paths:
/insights/v3.0/resource/export/query/users/branch/user_list:
post:
description: 'Export a list of users, including details on devices and applications.
'
operationId: post-insights-v3.0-resource-export-query-users-branch-user_list
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- US
- operator: in
property: app
values:
- Zoom
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: instance_name
values:
- instance1
- operator: in
property: user_source_ip_address
values:
- 192.168.1.1
schema:
properties:
filter:
properties:
rules:
items:
properties:
application_name:
description: Application name.
example: Zoom
type: string
edge_location_display_name:
description: Prisma Access Location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
instance_name:
description: Instance name.
example: instance1
type: string
platform_type:
description: Type of platform.
example: prisma_access
type: string
source_city:
description: City from GeoIP.
example: San Jose
type: string
source_country:
description: Country from GeoIP.
example: US
type: string
user_source_ip_address:
description: Source IP address.
example: 192.168.1.1
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
application_count:
description: Number of applications.
example: 5
type: integer
device_auth_type:
description: Device authentication type.
example: certificate
type: string
device_client_private_address:
description: Device client private address.
example: 10.0.0.200
type: string
device_count:
description: Number of devices.
example: 2
type: integer
device_last_activity_timestamp_epoc_millis:
description: Device last activity timestamp in epoch milliseconds.
example: 1678886500000
type: integer
device_last_connected_pa_fw_location:
description: Device last connected PA FW location.
example: US East
type: string
device_last_connected_source_city:
description: Device last connected source city.
example: New York
type: string
device_last_connected_source_country:
description: Device last connected source country.
example: USA
type: string
device_name:
description: Device name.
example: device1
type: string
device_os_version:
description: Device OS version.
example: iOS 15
type: string
device_source_ip_address:
description: Device source IP address.
example: 192.168.1.200
type: string
threat_count:
description: Number of threats.
example: 10
type: integer
total_bytes:
description: Total bytes transferred.
example: 1000000
type: integer
user_client_private_address:
description: User client private address.
example: 10.0.0.100
type: string
user_client_source_address:
description: User client source address.
example: 192.168.1.100
type: string
user_last_activity_timestamp_epoc_millis:
description: User last activity timestamp in epoch milliseconds.
example: 1678886400000
type: integer
user_last_connected_pa_fw_location:
description: Last connected PA FW location.
example: US West
type: string
user_last_connected_source_city:
description: User last connected source city.
example: San Francisco
type: string
user_last_connected_source_country:
description: User last connected source country.
example: USA
type: string
user_os_version:
description: User OS version.
example: Windows 10
type: string
username:
description: Username.
example: john.doe
type: string
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Export Branch User List
tags:
- Branch User API
/insights/v3.0/resource/query/branch/risky_user_count:
post:
description: 'Retrieve the number of risky users based on the applied filters.
'
operationId: post-insights-v3.0-resource-query-branch-risky_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
username:
description: Name of the source user.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of risky users.
example: 10034
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Risky User Data
tags:
- Branch User API
/insights/v3.0/resource/query/users/branch/active_user_count:
post:
description: 'Retrieve the number of active branch users.
'
operationId: post-insights-v3.0-resource-query-users-branch-active_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of active users.
example: 10045
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Active Branch User Data
tags:
- Branch User API
/insights/v3.0/resource/query/users/branch/active_user_list:
post:
description: 'Retrieve a list of active branch users.
'
operationId: post-insights-v3.0-resource-query-users-branch-active_user_list
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: username
values:
- achalla1kerbuser
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Platform type.
example: prisma_access
type: string
username:
description: Username.
example: achalla1kerbuser
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
last_activity_epoc_time_millis:
description: Last activity epoch time in milliseconds.
example: 1678886400000
type: integer
pa_fw_location:
description: PA Firewall location.
example: US West
type: string
user_last_connected_source_city:
description: Source city.
example: San Francisco
type: string
user_last_connected_source_country:
description: Source country.
example: USA
type: string
user_source_ip:
description: User source IP address.
example: 192.168.1.1
type: string
username:
description: Username.
example: john.doe
type: string
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Active Branch User List
tags:
- Branch User API
/insights/v3.0/resource/query/users/branch/connected_entity_count:
post:
description: 'Retrieve the number of connected entities for branch users.
'
operationId: post-insights-v3.0-resource-query-users-branch-connected_entity_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
username:
description: Source user name.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
device_count:
description: Count of connected devices.
example: 104
type: integer
user_count:
description: Count of connected users.
example: 1034
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Connected Entity Data for Branch Users
tags:
- Branch User API
/insights/v3.0/resource/query/users/branch/session_list:
post:
description: 'Retrieve a list of branch user sessions.
'
operationId: post-insights-v3.0-resource-query-users-branch-session_list
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: username
values:
- john.doe
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Platform type.
example: prisma_access
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
bytes_received:
description: Bytes received.
example: 2048.0
format: float
type: number
bytes_sent:
description: Bytes sent.
example: 1024.0
format: float
type: number
login_time:
description: Login time.
example: '2023-03-15T00:00:00Z'
type: string
pa_fw_location:
description: PA Firewall location.
example: US West
type: string
user_client_private_address:
description: User client IP address.
example: 192.165.0.1
type: string
user_client_source_address:
description: User client IP address.
example: 192.168.1.1
type: string
user_last_connected_source_city:
description: Source city.
example: San Francisco
type: string
user_last_connected_source_country:
description: Source country.
example: USA
type: string
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Branch User Session List
tags:
- Branch User API
/insights/v3.0/resource/query/users/branch/user_count_histogram:
post:
description: 'Retrieve a histogram of branch user data.
'
operationId: post-insights-v3.0-resource-query-users-branch-user_count_histogram
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
histogram:
enableEmptyInterval: true
property: event_time
range: minute
value: 30
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: username
values:
- john.doe
schema:
properties:
filter:
properties:
rules:
items:
properties:
event_time:
description: Time of the event.
example: 5
type: number
platform_type:
description: Platform type.
example: prisma_access
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
event_time:
description: Event time
example: 1709226000000
type: number
user_count:
description:
# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-branch-user-api-api-openapi.yml