Palo Alto Networks Device Groups API

openapi: 3.2.0
info:
  title: Prisma Browser Management Console Public Device Groups API
  version: 1.0.0
  description: This Open API spec file was created on May 06, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies.
security:
- BearerAuth: []
tags:
- name: Device Groups
paths:
  /seb-api/v1/device-groups:
    get:
      summary: Returns a list of device groups
      description: Retrieve the device groups details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Device-groups
      responses:
        '200':
          description: A list of device groups with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/DeviceGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '500':
          description: Internal server error
      parameters:
      - name: limit
        in: query
        description: Number of device groups to return
        required: false
        schema:
          type: integer
          format: int32
      - name: deviceGroup.name
        in: query
        description: Filter by device group name
        required: false
        schema:
          type: string
      - name: deviceGroup.platform
        in: query
        description: Filter by device group platform
        required: false
        schema:
          $ref: '#/components/schemas/DeviceGroupPlatform'
      - name: deviceGroup.created_at_gte
        in: query
        description: Filter by created at time or after
        required: false
        schema:
          type: string
          format: date-time
      - name: deviceGroup.created_at_lte
        in: query
        description: Filter by created at time or before
        required: false
        schema:
          type: string
          format: date-time
      - name: deviceGroup.updated_at_gte
        in: query
        description: 'Filter by updated at time or after. Format: RFC3339 (e.g., "2023-03-29T00:00:00Z")'
        required: false
        schema:
          type: string
          format: date-time
      - name: deviceGroup.updated_at_lte
        in: query
        description: 'Filter by updated at time or before. Format: RFC3339 (e.g., "2023-03-29T23:59:59Z")'
        required: false
        schema:
          type: string
          format: date-time
      - name: cursor
        in: query
        description: An optional opaque string that defines from where to start listing
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: The field to sort by
        required: false
        schema:
          type: string
          enum:
          - deviceGroup.name
          - deviceGroup.platform
          - deviceGroup.created_at
          - deviceGroup.updated_at
      - name: order
        in: query
        description: The sort order
        required: false
        schema:
          $ref: '#/components/schemas/Order'
      - name: configurationVersion
        in: query
        description: Configuration version to retrieve (draft, active, or version number)
        required: false
        schema:
          type: string
          default: draft
          pattern: ^([dD]raft|[aA]ctive|[1-9][0-9]{0,9}|0CV[0-9A-Z]{26})$
      tags:
      - Device Groups
    post:
      summary: Create a new device group
      description: Create the device groups details through this Application Programming Interface endpoint.
      operationId: PostSeb-apiV1Device-groups
      responses:
        '201':
          description: Device group created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  deviceGroupId:
                    type: string
                    description: The ID of the newly created device group
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '409':
          description: Conflict - device group already exists
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Device Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupRequest'
  /seb-api/v1/device-groups/{device-group-id}:
    get:
      summary: Returns a device group by ID
      description: Retrieve the {device group id} details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Device-groupsbydevice-group-id
      responses:
        '200':
          description: A device group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Device group not found
        '500':
          description: Internal server error
      parameters:
      - name: device-group-id
        in: path
        description: Device Group ID
        required: true
        schema:
          type: string
      - name: configurationVersion
        in: query
        description: Configuration version to retrieve (draft, active, or version number)
        required: false
        schema:
          type: string
          default: draft
          pattern: ^([dD]raft|[aA]ctive|[1-9][0-9]{0,9}|0CV[0-9A-Z]{26})$
      tags:
      - Device Groups
    put:
      summary: Replace entire device group
      description: Replaces the entire device group - missing attributes are disabled, provided attributes are set as specified.
      operationId: PutSeb-apiV1Device-groupsbydevice-group-id
      responses:
        '200':
          description: Device group updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  deviceGroupId:
                    type: string
                    description: The ID of the updated device group
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Device group not found
        '500':
          description: Internal server error
      parameters:
      - name: device-group-id
        in: path
        required: true
        description: The ID of the device group to update
        schema:
          type: string
      tags:
      - Device Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupRequest'
    patch:
      summary: Partially update device group
      description: Partially updates the device group - provided attributes are set as specified, others remain unchanged.
      operationId: PatchSeb-apiV1Device-groupsbydevice-group-id
      responses:
        '200':
          description: Device group updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  deviceGroupId:
                    type: string
                    description: The ID of the updated device group
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Device group not found
        '500':
          description: Internal server error
      parameters:
      - name: device-group-id
        in: path
        required: true
        description: The ID of the device group to update
        schema:
          type: string
      tags:
      - Device Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupPatchRequest'
    delete:
      summary: Deletes a device group
      description: Delete the {device group id} details through this Application Programming Interface endpoint.
      operationId: DeleteSeb-apiV1Device-groupsbydevice-group-id
      responses:
        '204':
          description: Device group deleted successfully
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Device group not found
        '500':
          description: Internal server error
      parameters:
      - name: device-group-id
        in: path
        required: true
        description: The ID of the device group to delete
        schema:
          type: string
      tags:
      - Device Groups
components:
  schemas:
    LinuxDistro:
      type: string
      description: Linux distribution
      enum:
      - Ubuntu
      - Fedora
      - Igel
    MacOSVersion:
      type: object
      properties:
        enabled:
          type: boolean
        major:
          type: string
        minMinorVersion:
          type: string
      required:
      - enabled
      - major
    RegistryValueType:
      type: string
      description: Registry value type
      enum:
      - String
      - Binary
      - DWORD
      - QWORD
      - MultiString
      - ExpandableString
    DeviceGroupRequest:
      type: object
      properties:
        name:
          type: string
          description: Device group name
          minLength: 1
          maxLength: 255
        platform:
          $ref: '#/components/schemas/DeviceGroupPlatform'
        attributes:
          $ref: '#/components/schemas/AttributeObject'
      required:
      - name
      - platform
    WindowsVersionAttribute:
      type: object
      properties:
        any:
          type: boolean
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/WindowsVersion'
    MobileDeviceType:
      type: string
      description: Mobile device type
      enum:
      - smartphone
      - tablet
    LinuxVersionAttribute:
      type: object
      properties:
        any:
          type: boolean
          description: Accept any Linux version
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/LinuxVersion'
          description: List of specific Linux distributions and versions to check for
    WindowsEdition:
      type: string
      description: Windows edition
      enum:
      - Pro
      - Enterprise
      - Home
      - Server
      - Education
    DeviceGroup:
      type: object
      properties:
        id:
          type: string
          format: string
          description: Unique identifier
        name:
          type: string
          description: Device group name
        platform:
          $ref: '#/components/schemas/DeviceGroupPlatform'
        createdBy:
          type: string
          description: Created by user
        updatedBy:
          type: string
          description: Updated by user
        createdAt:
          type: string
          format: date-time
          description: Created at timestamp
        updatedAt:
          type: string
          format: date-time
          description: Updated at timestamp
        attributes:
          $ref: '#/components/schemas/AttributeObject'
        devices:
          type: array
          description: Device IDs in this group
          items:
            type: string
      required:
      - id
      - name
      - platform
      - createdAt
      - updatedAt
    MobileOs:
      type: object
      properties:
        enabled:
          type: boolean
        version:
          type: string
        minSecurityPatch:
          type: string
        latest:
          type: boolean
      required:
      - enabled
      - version
    LinuxVersion:
      type: object
      properties:
        enabled:
          type: boolean
        distro:
          $ref: '#/components/schemas/LinuxDistro'
        minVersion:
          type: string
          description: Minimum Linux version (e.g., "20.04" for Ubuntu, "33" for Fedora)
      required:
      - enabled
    MacOSVersionAttribute:
      type: object
      properties:
        any:
          type: boolean
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/MacOSVersion'
    BrowserBrand:
      type: string
      description: Browser brand
      enum:
      - Arc
      - Brave
      - Chrome
      - Edge
      - Opera
      - Dia
      - Comet
      - Unknown
    AttributeObject:
      type: object
      properties:
        screenLock:
          type: object
          description: Check if the device has automatic screen lock enabled
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
          required:
          - enabled
        endpointProtection:
          type: object
          description: Check if the device has endpoint protection software installed and running
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            selectedVendors:
              type: array
              items:
                $ref: '#/components/schemas/EppVendorName'
              description: Selected endpoint protection vendors to check for
            lastDefinitionUpdate:
              $ref: '#/components/schemas/LastDefinitionUpdateAttribute'
          required:
          - enabled
        firewall:
          type: object
          description: Check if the device has firewall protection installed and running
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
            anyVendor:
              type: boolean
              description: Whether to accept any firewall vendor
            specificVendors:
              type: array
              items:
                $ref: '#/components/schemas/FirewallVendorName'
              description: Selected firewall vendors to check for
          required:
          - enabled
        diskEncryption:
          type: object
          description: Check if the device has disk encryption software installed and running
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
            anyVendor:
              type: boolean
              description: Whether to accept any disk encryption vendor
            specificVendors:
              type: array
              items:
                $ref: '#/components/schemas/DiskEncryptionVendorName'
              description: Selected disk encryption vendors to check for
          required:
          - enabled
        osVersion:
          type: object
          description: Check if the device is running a specific operating system version
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            windows:
              $ref: '#/components/schemas/WindowsVersionAttribute'
            macOS:
              $ref: '#/components/schemas/MacOSVersionAttribute'
            linux:
              $ref: '#/components/schemas/LinuxVersionAttribute'
          required:
          - enabled
        serialNumber:
          type: object
          description: Check if the device's serial number is included in the provided list
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            serials:
              type: array
              items:
                type: string
              description: List of device serial numbers to check for
          required:
          - enabled
        clientCertificate:
          type: object
          description: Check if the device's client certificate is signed by the provided issuer certificate
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            issuerCertificates:
              type: array
              items:
                $ref: '#/components/schemas/IssuerCertificate'
              description: List of trusted issuer certificates to validate against
          required:
          - enabled
        deviceType:
          type: object
          description: Check if the device matches specific device types (e.g., desktop, laptop, virtual machine)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            types:
              type: array
              items:
                $ref: '#/components/schemas/DeviceType'
              description: List of device types to check for
          required:
          - enabled
        csZtaScore:
          type: object
          description: "Check if the device meets minimum CrowdStrike Zero Trust Assessment score requirements. \nIf multiple score types are provided (basicScore, overallScore, breakdownScores), the latest one will be used.\n"
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            basicScore:
              $ref: '#/components/schemas/CsZtaBasicScoreLevel'
            overallScore:
              $ref: '#/components/schemas/CsZtaScore'
            breakdownScores:
              type: object
              description: Breakdown scores with separate OS and sensor score ranges for granular validation.
              properties:
                osScore:
                  $ref: '#/components/schemas/CsZtaScore'
                sensorScore:
                  $ref: '#/components/schemas/CsZtaScore'
              required:
              - osScore
              - sensorScore
            customerIds:
              type: array
              items:
                type: string
              description: CrowdStrike customer IDs to validate
          required:
          - enabled
        mobileRootJailBreakStatus:
          type: object
          description: Check if the mobile device has been rooted (Android) or jailbroken (iOS)
          properties:
            enabled:
              type: boolean
          required:
          - enabled
        mobileScreenLock:
          type: object
          description: Check if the mobile device has screen lock protection enabled
          properties:
            enabled:
              type: boolean
          required:
          - enabled
        mobileDeviceManufacturers:
          type: object
          description: Check if the mobile device is from specific manufacturers (e.g., Apple, Samsung)
          properties:
            enabled:
              type: boolean
            vendors:
              type: array
              items:
                $ref: '#/components/schemas/MobileManufacturer'
              description: List of mobile device manufacturers to check for
          required:
          - enabled
        mobileOsVersion:
          type: object
          description: Check if the mobile device is running a specific iOS or Android version
          properties:
            enabled:
              type: boolean
            ios:
              $ref: '#/components/schemas/MobileOsVersion'
            android:
              $ref: '#/components/schemas/MobileOsVersion'
          required:
          - enabled
        mobileDeviceType:
          type: object
          description: Check if the mobile device matches specific types (e.g., phone, tablet)
          properties:
            enabled:
              type: boolean
            types:
              type: array
              items:
                $ref: '#/components/schemas/MobileDeviceType'
              description: List of mobile device types to check for
          required:
          - enabled
        mobileDeviceManagement:
          type: object
          description: Check if the mobile device is managed by specific mobile device management systems
          properties:
            enabled:
              type: boolean
            systems:
              type: array
              items:
                $ref: '#/components/schemas/MobileDeviceManagementSystem'
              description: Mobile device management system configurations
          required:
          - enabled
        osPassword:
          type: object
          description: Check if the device has an OS authentication password configured with specific requirements
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            complexity:
              $ref: '#/components/schemas/OsPasswordComplexity'
            maxAge:
              type: integer
              description: Maximum password age in days
            minLength:
              type: integer
              description: Minimum password length in characters
          required:
          - enabled
        normalOSBootMode:
          type: object
          description: Check if a device is running in OS normal boot mode (not safe mode, recovery mode or a pre-installation environment)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
        privilegedProcess:
          type: object
          description: Include only devices on which Prisma Browser is running with elevated/root permissions
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
        deviceManufacturer:
          type: object
          description: Check if the device is from specific manufacturers (e.g., Dell, HP, Lenovo)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            selectedVendors:
              type: array
              items:
                $ref: '#/components/schemas/SelectedDeviceVendor'
              description: List of device manufacturers with optional specific models to check for
          required:
          - enabled
        deviceManagement:
          type: object
          description: Check if the device is managed by specific device management systems (e.g., Microsoft Intune, Jamf, Active Directory)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            systems:
              type: array
              items:
                $ref: '#/components/schemas/DeviceManagementSystemInput'
              description: Device management system configurations
          required:
          - enabled
        systemIntegrity:
          type: object
          description: Check if the device has advanced system integrity protection enabled
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
        browserBrand:
          type: object
          description: Check if the device has specific browser brands and versions installed
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            brands:
              type: array
              items:
                $ref: '#/components/schemas/BrowserBrandDetails'
              description: Browser brand and version requirements
          required:
          - enabled
        remoteConnection:
          type: object
          description: Check if the device has an active remote connection (RDP, Citrix ICA, etc.)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
        registry:
          type: object
          description: Check if the device has all of the specified registry key configurations (Windows only)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            regKeys:
              type: array
              items:
                $ref: '#/components/schemas/RegKey'
              description: Registry key configurations to validate
          required:
          - enabled
        locationServices:
          type: object
          description: Check if the device's location services can be accessed by Prisma Browser
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
        runningProcesses:
          type: object
          description: Check if the device has all of the specified processes running
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            win:
              type: array
              items:
                $ref: '#/components/schemas/WinRunningProcessMetadata'
              description: Windows process requirements to check for
            macOS:
              type: array
              items:
                $ref: '#/components/schemas/MacOSRunningProcessMetadata'
              description: macOS process requirements to check for
          required:
          - enabled
        fileExistence:
          type: object
          description: Check if the device has all of the specified files present
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            win:
              type: array
              items:
                $ref: '#/components/schemas/WinFileExistenceMetadata'
              description: Windows file paths to check for existence
            macOS:
              type: array
              items:
                $ref: '#/components/schemas/MacOSFileExistenceMetadata'
              description: macOS file paths to check for existence
          required:
          - enabled
        browserEol:
          type: object
          description: Check if the device has browser versions that are end-of-life
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
          - enabled
      additionalProperties: false
    WinFileExistenceMetadata:
      type: object
      properties:
        path:
          type: string
          description: Full path to the file on Windows
        certificateThumbprint:
          type: string
          description: Certificate thumbprint to validate the file signature
      required:
      - path
    ManagementSystemType:
      type: string
      description: Device management system type
      enum:
      - Microsoft Intune
      - Jamf
      - Active Directory
      - Azure AD
    LastDefinitionUpdateAttribute:
      type: object
      properties:
        enabled:
          type: boolean
        timeframe:
          $ref: '#/components/schemas/DefinitionUpdateTimeframe'
      required:
      - enabled
      - timeframe
    FirewallVendorName:
      type: string
      description: Firewall vendor name
      enum:
      - Agnitum Ltd.
      - NETGATE Technologies s.r.o.
      - ParetoLogic, Inc.
      - LANDESK Software, Inc.
      - AT&T
      - Bitdefender
      - Mysecuritywin
      - G Data Software AG
      - Max Secure Software
      - AhnLab, Inc.
      - AVG Technologies CZ, s.r.o.
      - Symantec Corporation
      - Kaspersky Lab
      - Avira GmbH
      - Panda Security, S.L.
      - Webroot Software, Inc.
      - Quick Heal Technologies (P) Ltd.
      - nProtect, Inc.
      - F-Secure Corporation
      - ThreatTrack Security, Inc.
      - McAfee, Inc.
      - eEye Digital Security
      - Arcabit
      - BeyondTrust, Inc.
      - Telefónica S.A.
      - GEN-X Technologies
      - K7 Computing Pvt Ltd
      - Faronics Corporation
      - TELUS
      - Kingsoft Corporation
      - BiniSoft.org
      - GFI Software Ltd.
      - TG Soft S.a.s.
      - Scandium Security Inc.
      - Datpol
      - Tech Guard Technologies
      - NCP engineering GmbH
      - SoftSphere Technologies
      - Quick Guard Technologies
      - Emsisoft Ltd
      - Datalink Industrial Corporation
      - COMODO Security Solutions
      - MicroWorld Technologies Inc.
      - AVAST Software a.s.
      - ESET
      - Beijing Rising Information Technology Co., Ltd.
      - Smart Heal
      - Rogers
      - Check Point Software Technologies
      - CellSecurity
      - AS3 Soft4U
      - Ates Software & Internet Technologies
      - MSecure Data Labs
      - SGA SOLUTIONS
      - ALLIT Service, LLC.
      - adaware
      - SentinelOne
      - CrowdStrike, Inc.
      - CSIS Security Group
      - SOURCENEXT CORPORATION
      - Microsoft Corporation
      - SecureMix LLC
      - Swiss security laboratory.
      - AsiaInfo, Inc.
      - INCA Internet Co., Ltd.
      - ESTsoft Corp.
      - Sunrise Antivirus
      - Hauri, Inc.
      - SecuraShield India Pvt. Ltd.
      - NIFTY Corporation
      - Trend Micro, Inc.
      - Fujitsu Services Ltd.
      - LogMeIn, Inc.
      - Stormshield
      - Palo Alto Networks, Inc.
      - Chili Security
      - Sophos Limited
      - NortonLifeLock Inc
      - Massachusetts Institute of Technology
      - WatchGuard Technologies Inc
      - Beijing Huorong Network Technology Co., Ltd.
      - Le Minh Thanh
      - Qi An Xin Group
      - Avast Software s.r

# --- truncated at 32 KB (49 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-device-groups-api-openapi.yml