Palo Alto Networks Certificate Import API

openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Certificate Import API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Certificate Import
  description: APIs for Certificate Import.
paths:
  /outagedetection/v1/certificates:
    post:
      description: Adds to the inventory one or more certificates to the inventory.the certificates are specified in raw base64-encoded format (PEM without header/footer). Chain CA certificates are optional but may be provided using `issuerCertificates`.
      operationId: certificateimports_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateImportRequest1'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateImportResponse1'
          description: Certificates were imported; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
      summary: Import a set of raw certificates
      tags:
      - Certificate Import
components:
  schemas:
    CertificateImportInfo:
      description: Base64 encoding certificate content.
      properties:
        apiClientInformation:
          $ref: '#/components/schemas/ApiClientInformation'
        applicationIds:
          description: A collection of application IDs
          example:
          - 47c9d920-da21-11ed-a63c-d508f08eeaa0
          - 9303e940-df9d-11ed-8850-f18176fc5513
          items:
            format: uuid
            type: string
          type: array
        certificate:
          description: Certificate base64 encoded format (PEM without header/footer
          type: string
        certificateUsageMetadata:
          description: A collection of certificate request metadata
          example:
          - appName: venafi app1
            automationMetadata: automation data 008
            nodeName: venafi node 007
          - appName: venafi app2
            automationMetadata: automation data 0013
            nodeName: venafi node 005
          items:
            $ref: '#/components/schemas/CertificateUsageMetadata'
          type: array
        issuerCertificates:
          description: A collection of issuer certificates
          example:
          - Venafi issuer
          - QA Venafi issuer
          items:
            type: string
          type: array
      required:
      - certificate
      type: object
    ApiClientInformation:
      description: Represents the information of the client that is calling the API
      example:
        identifier: 192.168.1.63
        type: Venafi VCert CLI
      properties:
        identifier:
          description: Client identifier
          example: 199.121.8.74
          type: string
        type:
          description: Client type
          example: Venafi VCert CLI
          type: string
      type: object
    ImportedCertificateInformation:
      properties:
        apiClientInformation:
          $ref: '#/components/schemas/ApiClientInformation'
        base64Certificate:
          description: Certificate base64 encoded format (PEM without header/footer
          type: string
        certificateSource:
          description: A certificate source
          enum:
          - UNKNOWN
          - USER_PROVIDED
          - USER_IMPORTED
          - USER_SCAN
          - TRUSTNET_SCAN
          - ON_PREM_CA_IMPORT
          - EXTERNAL_CA_IMPORT
          - FILE_IMPORT
          - EXTERNAL_SCAN
          - DOMAIN_SCAN
          - SMART_SCAN_INTERNAL
          - SMART_SCAN_EXTERNAL
          - SMART_VALIDATION_INTERNAL
          - SMART_VALIDATION_EXTERNAL
          - MACHINE_DISCOVERY
          - KUBERNETES_DISCOVERY
          - AWS_DISCOVERY
          - AZURE_DISCOVERY
          - GCP_DISCOVERY
          example: USER_PROVIDED
          type: string
        certificateUsageMetadata:
          description: A collection of certificate request metadata
          example:
          - appName: venafi app1
            automationMetadata: automation data 008
            nodeName: venafi node 007
          - appName: venafi app2
            automationMetadata: automation data 0013
            nodeName: venafi node 005
          items:
            $ref: '#/components/schemas/CertificateUsageMetadata'
          type: array
        companyId:
          description: UUID of a company
          example: 2d558b30-da16-11ed-8e4f-8339a1bc8d58
          format: uuid
          type: string
        fingerprint:
          description: A certificate fingerprint
          example: 2C85B0AD64F55AA70BAC75F69711578DC505C3F9
          type: string
        id:
          description: UUID of a Certificate
          example: 16cb6940-e2de-11ed-a644-4fab0ea00b60
          format: uuid
          type: string
        issuerCertificateIds:
          description: A collection of issuer certificates
          items:
            format: uuid
            type: string
          type: array
        managedCertificateId:
          description: UUID of a managed certificate
          example: 17488880-e2de-11ed-aed6-79d407efea73
          format: uuid
          type: string
      type: object
    CertificateUsageMetadata:
      properties:
        appName:
          type: string
        automationMetadata:
          type: string
        nodeName:
          type: string
      type: object
    CertificateImportRequest1:
      properties:
        certificates:
          description: Base64 encoding certificate content.
          items:
            $ref: '#/components/schemas/CertificateImportInfo'
          type: array
        overrideBlocklist:
          description: Imports the certificate even if it's present in the Certificates blocklist.
          type: boolean
      required:
      - certificates
      type: object
    ErrorInformation4:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue4'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    CertificateImportResponse1:
      properties:
        certificateInformations:
          description: A collection of information about certificates that were newly imported.
          items:
            $ref: '#/components/schemas/ImportedCertificateInformation'
          type: array
        statistics:
          additionalProperties:
            description: Certificate import statistics
            format: int32
            type: integer
          description: Certificate import statistics
          type: object
      type: object
    AnyValue4:
      description: Can be any value - string, number, boolean, array or object.
    ErrorResponse4:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation4'
          type: array
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT