Palo Alto Networks Certificate Inventory Monitoring API

openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Certificate Inventory Monitoring API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Certificate Inventory Monitoring
  description: APIs for Certificate Inventory Monitoring.
paths:
  /outagedetection/v1/inventorymonitoringconfig/{type}:
    get:
      description: Retrieves the details of the inventory monitoring configuration by configuration type
      operationId: inventorymonitoringconfiguration_getByType
      parameters:
      - description: Configuration type
        in: path
        name: type
        required: true
        schema:
          description: Configuration type
          enum:
          - CERTIFICATE_EXPIRATION
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InventoryMonitoringConfigurationResponse'
          description: Details of inventory monitoring configuration in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Inventory monitoring configuration not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
      summary: Get the details of the current
      tags:
      - Certificate Inventory Monitoring
    put:
      description: Updates existing inventory monitoring configuration
      operationId: inventorymonitoringconfiguration_update
      parameters:
      - description: Configuration type
        in: path
        name: type
        required: true
        schema:
          description: Type of the configuration
          enum:
          - CERTIFICATE_EXPIRATION
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InventoryMonitoringConfigRequest'
        description: Updates properties of the inventory monitoring configuration.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InventoryMonitoringConfigurationResponse'
          description: Inventory monitoring configuration was updated.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
      summary: Updates existing inventory monitoring configuratio
      tags:
      - Certificate Inventory Monitoring
  /outagedetection/v1/inventorymonitoringconfig/{type}/scheduler:
    put:
      description: Update inventory monitoring scheduler by type
      operationId: inventorymonitoringconfigurationscheduler_update
      parameters:
      - description: Configuration type
        in: path
        name: type
        required: true
        schema:
          description: Configuration type
          enum:
          - CERTIFICATE_EXPIRATION
          type: string
      - description: Start the scheduler now
        in: query
        name: runNow
        schema:
          default: true
          description: Start the scheduler now
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InventoryMonitoringSchedulerInformation'
          description: Inventory monitoring scheduler was updated.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse4'
          description: Incomplete or malformed request.
      summary: Update inventory monitoring scheduler by type
      tags:
      - Certificate Inventory Monitoring
  /v1/expirationnotifications/tenantconfiguration:
    get:
      description: Retrieve the certificate expiration notification configuration for the current tenant
      operationId: get-v1-tenant-expiration-notification-configuration
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantExpirationNotificationConfiguration'
          description: Success
        '400':
          description: BadRequest
        '401':
          description: Unauthorized
        '500':
          description: InternalServerError
      summary: Retrieve the certificate expiration notification c
      tags:
      - Certificate Inventory Monitoring
    put:
      description: Update the certificate expiration notification configuration for the current tenant
      operationId: put-v1-tenant-expiration-notification-configuration
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantExpirationNotificationConfiguration'
        description: The options to apply
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantExpirationNotificationConfiguration'
          description: Success. The tenant configuration was successfully updated.
        '400':
          description: BadRequest
        '401':
          description: Unauthorized
        '500':
          description: InternalServerError
      summary: Update the certificate expiration notification con
      tags:
      - Certificate Inventory Monitoring
components:
  schemas:
    InventoryMonitoringConfiguration:
      discriminator:
        propertyName: inventoryMonitoringConfigurationType
      properties:
        inventoryMonitoringConfigurationType:
          type: string
      required:
      - inventoryMonitoringConfigurationType
      type: object
    Persona:
      enum:
      - Application Owners
      - All PKI Admins
      - All Admins
      type: string
    TenantExpirationNotificationConfiguration:
      properties:
        additionalRecipients:
          description: A list of users and/or teams who should be added as recipients.
          example:
          - id: 22153ae0-4352-11ee-b95c-3531a284802b
            type: User
          - id: 22153ae0-4352-11ee-b95c-12345abcd123
            type: Team
          items:
            $ref: '#/components/schemas/Recipient'
          type: array
          uniqueItems: true
        channels:
          description: A list of channels that should be used to deliver the notification.
          example:
          - email
          items:
            $ref: '#/components/schemas/Channel'
          minItems: 1
          type: array
          uniqueItems: true
        enabled:
          description: If true, then the system will send notification for certificates which are nearing expiration.
          example: true
          type: boolean
        fallbackToPKIAdmin:
          description: If true, then all users with the PKI admin role will be added as recipients if the persona list does not include any recipients for a specific certificate.
          example: true
          type: boolean
        includeCertificateDetails:
          description: If true, then the notification may include potentially sensitive details about the certificate that is nearing expiration.
          example: true
          type: boolean
        personas:
          description: A list of personas who should be recipients of the notification. If "Application Owners" is included then the owners of the Application object to which the certificate is assigned will be added as recipients. If "All PKI Admins" or "All Admins" are present then all users in the system with that role will be added as recipients.
          example:
          - Application Owners
          - All PKI Admins
          items:
            $ref: '#/components/schemas/Persona'
          type: array
          uniqueItems: true
      type: object
    InventoryMonitoringConfigRequest:
      properties:
        inventoryMonitoringConfiguration:
          oneOf:
          - $ref: '#/components/schemas/CertificateExpirationInventoryMonitoringConfig'
          type: object
      type: object
    ErrorInformation4:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue4'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    InventoryMonitoringConfig:
      discriminator:
        mapping:
          CERTIFICATE_EXPIRATION: '#/components/schemas/CertificateExpirationInventoryMonitoringConfig'
        propertyName: inventoryMonitoringConfigurationType
      properties:
        inventoryMonitoringConfigurationType:
          type: string
      type: object
    Channel:
      enum:
      - email
      type: string
    AnyValue4:
      description: Can be any value - string, number, boolean, array or object.
    Recipient:
      properties:
        id:
          description: The ID of a user or team who should be included as a recipient.
          format: UUID
          type: string
        type:
          description: The type of the recipient.
          enum:
          - User
          - Team
          type: string
      required:
      - type
      - id
      type: object
    CertificateExpirationInventoryMonitoringConfig:
      allOf:
      - $ref: '#/components/schemas/InventoryMonitoringConfig'
      - properties:
          applicationIds:
            description: Application IDs that the webhook applies to
            items:
              description: Application IDs that the webhook applies to
              format: uuid
              type: string
            type: array
            uniqueItems: true
          enabled:
            description: Enables or disables webhook messages.
            type: boolean
          includeUnassignedCertificates:
            description: Enables or disables notifications for unassigned certificates.
            type: boolean
          thresholds:
            description: Array of certificate expiration thresholds, in days, for when notifications will be sent. Limit is 3 values.
            items:
              description: Array of certificate expiration thresholds, in days, for when notifications will be sent. Limit is 3 values.
              format: int32
              type: integer
            type: array
        type: object
      type: object
    InventoryMonitoringSchedulerInformation:
      properties:
        name:
          description: Name of the configuration
          type: string
        status:
          description: Status of the configuration
          enum:
          - PENDING
          - RUNNING
          - DONE
          - FAILED
          type: string
      type: object
    ErrorResponse4:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation4'
          type: array
      type: object
    InventoryMonitoringConfigurationResponse:
      properties:
        companyId:
          description: UUID specific to your company
          example: 2b391680-74ce-11ed-bf7a-a3d5ccdf275c
          format: uuid
          type: string
        configuration:
          $ref: '#/components/schemas/InventoryMonitoringConfiguration'
        id:
          description: UUID of the configuration
          example: 2e8d71a0-74ce-11ed-9051-cfa579eae364
          format: uuid
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT