Palo Alto Networks Devices API

openapi: 3.2.0
info:
  title: Palo Alto Networks Devices API
  version: '1.0'
  description: 'Operations tagged Devices across 5 of this provider''s published API definitions: palo-alto-access-browser-mgmt-prismaaccess-browser-management-latest-openapi.yaml, palo-alto-iot-security-api-openapi-original.yml, palo-alto-networks-devices-api-openapi.yml, palo-alto-prisma-access-browser-api-openapi-original.yml, palo-alto-scm-config-cloudngfw-setup-config-setup-feb-v1-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
  description: IoT Security API production server.
  variables:
    customer:
      description: Customer-specific tenant identifier.
      default: customer-tenant
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com/browser-mgmt
  description: SASE Prisma Access Browser Management API production server.
- url: https://api.strata.paloaltonetworks.com/config/setup/v1
  description: Current
tags:
- name: Devices
paths:
  /seb-api/v1/devices:
    get:
      summary: Returns a list of devices
      description: Retrieve the devices details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Devices
      responses:
        '200':
          description: A list of devices with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Device'
        '400':
          description: Bad request
        '500':
          description: Internal server error
      parameters:
      - name: limit
        in: query
        description: Number of devices to return
        required: false
        schema:
          type: integer
          format: int32
      - name: device.hostname
        in: query
        description: Filter by hostname
        required: false
        schema:
          type: string
      - name: user.name
        in: query
        description: Filter by user name
        required: false
        schema:
          type: string
      - name: device.os_type
        in: query
        description: Filter by OS type
        required: false
        schema:
          type: string
      - name: device.first_seen_gte
        in: query
        description: Filter by first seen time or after
        required: false
        schema:
          type: string
          format: date-time
      - name: device.last_seen_lte
        in: query
        description: Filter by last seen time or before
        required: false
        schema:
          type: string
          format: date-time
      - name: device.last_seen_gte
        in: query
        description: Filter by last seen time or after
        required: false
        schema:
          type: string
          format: date-time
      - name: device.type
        in: query
        description: Filter by device type
        required: false
        schema:
          type: string
      - name: device.firewall_status
        in: query
        description: Filter by firewall status
        required: false
        schema:
          type: string
      - name: device.screen_lock_status
        in: query
        description: Filter by screen lock status
        required: false
        schema:
          type: string
      - name: device.disk_encryption_status
        in: query
        description: Filter by disk encryption status
        required: false
        schema:
          type: string
      - name: cursor
        in: query
        description: An optional opaque string that defines from where to start listing
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: The field to sort by
        required: false
        schema:
          type: string
          enum:
          - device.hostname
          - device.os_type
          - device.browser_version
          - device.first_seen
          - device.last_seen
          - user.name
      - name: order
        in: query
        description: The sort order
        required: false
        schema:
          $ref: '#/components/schemas/Order'
      tags:
      - Devices
      security:
      - BearerAuth: []
  /seb-api/v1/devices/{id}:
    get:
      summary: Returns a device by ID
      description: Retrieve the {id} details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Devicesbyid
      responses:
        '200':
          description: A device
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Device'
        '404':
          description: Device not found
      parameters:
      - name: id
        in: path
        description: Device ID
        required: true
        schema:
          type: string
      tags:
      - Devices
      security:
      - BearerAuth: []
  /seb-api/v1/devices/archive:
    post:
      summary: Archive devices
      description: Archive one or more devices by changing their status to archived.
      operationId: PostSeb-apiV1DevicesArchive
      responses:
        '200':
          description: Devices archived successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceArchiveResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/devices/restore:
    post:
      summary: Restore archived devices
      description: Restore one or more archived devices by changing their status to active.
      operationId: PostSeb-apiV1DevicesRestore
      responses:
        '200':
          description: Devices restored successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceRestoreResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/devices/suspend:
    post:
      summary: Suspend devices
      description: Suspend one or more devices by changing their status to suspended.
      operationId: PostSeb-apiV1DevicesSuspend
      responses:
        '200':
          description: Devices suspended successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceSuspendResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/devices/resume:
    post:
      summary: Resume suspended devices
      description: Resume one or more suspended devices by changing their status to active.
      operationId: PostSeb-apiV1DevicesResume
      responses:
        '200':
          description: Devices resumed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceResumeResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/devices/delete:
    post:
      summary: Delete devices
      description: Delete one or more devices permanently. Suspended devices cannot be deleted - they must be resumed first.
      operationId: PostSeb-apiV1DevicesDelete
      responses:
        '200':
          description: Devices deleted successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceDeleteResponse'
        '400':
          description: Bad request - invalid input or attempting to delete suspended devices
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/devices/force-reauth:
    post:
      summary: Force re-authentication for devices
      description: Force re-authentication on one or more specific devices. Upon execution, targeted devices will require their user to re-authenticate to the browser.
      operationId: PostSeb-apiV1DevicesForce-reauth
      responses:
        '200':
          description: Force re-authentication initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceForceReauthResponse'
        '400':
          description: Bad request - invalid input or too many devices
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Devices
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      security:
      - BearerAuth: []
  /device/list:
    get:
      operationId: listDevices
      summary: Palo Alto Networks List Discovered Devices
      description: Returns a paginated list of IoT and OT devices discovered on the network. Supports filtering by monitoring status and time range. Each device record includes identification details, network information, risk assessment, and classification metadata.
      tags:
      - Devices
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '858936'
      - name: offset
        in: query
        description: Pagination offset for results.
        schema:
          type: integer
          default: 0
        example: 0
      - name: pagelength
        in: query
        description: Number of devices to return per page.
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      - name: detail
        in: query
        description: Level of detail to include in the response.
        schema:
          type: string
          enum:
          - full
          - summary
          default: summary
        example: summary
      - name: filter_monitored
        in: query
        description: Filter for monitored or unmonitored devices.
        schema:
          type: string
          enum:
          - 'yes'
          - 'no'
        example: 'no'
      - name: stime
        in: query
        description: Start time filter as a Unix epoch timestamp in seconds. Returns devices active since this time.
        schema:
          type: string
        example: example-stime
      - name: etime
        in: query
        description: End time filter as a Unix epoch timestamp in seconds. Returns devices active before this time.
        schema:
          type: string
        example: example-etime
      responses:
        '200':
          description: Device list returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of devices matching the query.
                  devices:
                    type: array
                    items:
                      $ref: '#/components/schemas/Device_2'
              examples:
                ListDevices200Example:
                  summary: Default listDevices 200 response
                  x-microcks-default: true
                  value:
                    total: 0
                    devices:
                    - deviceid: '805631'
                      ip: 10.178.141.130
                      mac: 42:f0:fc:53:1d:d1
                      hostname: host-03a3
                      profile: Network Printer
                      category: advanced
                      risk_score: 53
                      os: Ubuntu 22.04
                      os_version: 10.5.0
                      vendor: Fortinet
                      model: VM-300
                      site: Branch-London
                      subnet: 10.32.40.0/24
                      first_seen: '2024-12-19T02:52:11Z'
                      last_seen: '2025-01-24T06:19:11Z'
                      monitored: 'no'
                      confidence_score: 533
                      tags:
                      - pci-scope
                    - deviceid: '805631'
                      ip: 10.178.141.130
                      mac: 42:f0:fc:53:1d:d1
                      hostname: host-03a3
                      profile: Network Printer
                      category: advanced
                      risk_score: 53
                      os: Ubuntu 22.04
                      os_version: 10.5.0
                      vendor: Fortinet
                      model: VM-300
                      site: Branch-London
                      subnet: 10.32.40.0/24
                      first_seen: '2024-12-19T02:52:11Z'
                      last_seen: '2025-01-24T06:19:11Z'
                      monitored: 'no'
                      confidence_score: 533
                      tags:
                      - pci-scope
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - keyId: []
        accessKey: []
    servers:
    - url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
      description: IoT Security API production server.
      variables:
        customer:
          description: Customer-specific tenant identifier.
          default: customer-tenant
  /device/detail:
    get:
      operationId: getDeviceDetail
      summary: Palo Alto Networks Get Device Details
      description: Returns detailed information for the device associated with the specified device identifier. Includes full device profile, risk score breakdown, network activity summary, and classification details.
      tags:
      - Devices
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '904445'
      - name: deviceid
        in: query
        required: true
        description: Unique device identifier.
        schema:
          type: string
        example: '348066'
      responses:
        '200':
          description: Device details returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  device:
                    $ref: '#/components/schemas/Device_2'
              examples:
                GetDeviceDetail200Example:
                  summary: Default getDeviceDetail 200 response
                  x-microcks-default: true
                  value:
                    device:
                      deviceid: '805631'
                      ip: 10.178.141.130
                      mac: 42:f0:fc:53:1d:d1
                      hostname: host-03a3
                      profile: Network Printer
                      category: advanced
                      risk_score: 53
                      os: Ubuntu 22.04
                      os_version: 10.5.0
                      vendor: Fortinet
                      model: VM-300
                      site: Branch-London
                      subnet: 10.32.40.0/24
                      first_seen: '2024-12-19T02:52:11Z'
                      last_seen: '2025-01-24T06:19:11Z'
                      monitored: 'no'
                      confidence_score: 533
                      tags:
                      - pci-scope
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - keyId: []
        accessKey: []
    servers:
    - url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
      description: IoT Security API production server.
      variables:
        customer:
          description: Customer-specific tenant identifier.
          default: customer-tenant
  /v1/devices:
    get:
      operationId: listManagedDevices
      summary: Palo Alto Networks List Managed Devices
      description: Returns the inventory of managed devices running the Prisma Access Browser. Includes device platform, browser version, compliance status, and last seen timestamp.
      tags:
      - Devices
      parameters:
      - name: platform
        in: query
        description: Filter devices by operating system platform.
        schema:
          type: string
          enum:
          - windows
          - macos
          - linux
          - chromeos
        example: linux
      - name: compliance_status
        in: query
        description: Filter devices by compliance status.
        schema:
          type: string
          enum:
          - compliant
          - non_compliant
          - unknown
        example: compliant
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of devices to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Managed devices returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ManagedDevice'
              examples:
                ListManagedDevices200Example:
                  summary: Default listManagedDevices 200 response
                  x-microcks-default: true
                  value:
                    total: 241
                    offset: 328
                    limit: 731
                    items:
                    - device_id: '923062'
                      hostname: host-9746
                      platform: windows
                      browser_version: 9.6.7
                      compliance_status: unknown
                      user_id: '942976'
                      last_seen_at: '2025-01-16T12:14:13Z'
                    - device_id: '923062'
                      hostname: host-9746
                      platform: windows
                      browser_version: 9.6.7
                      compliance_status: unknown
                      user_id: '942976'
                      last_seen_at: '2025-01-16T12:14:13Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2_2'
              examples:
                ListManagedDevices401Example:
                  summary: Default listManagedDevices 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2_2'
              examples:
                ListManagedDevices403Example:
                  summary: Default listManagedDevices 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2_2'
              examples:
                ListManagedDevices500Example:
                  summary: Default listManagedDevices 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /devices:
    get:
      summary: List devices
      description: 'Retrieve a list of devices.

        '
      tags:
      - Devices
      operationId: ListDevices
      parameters:
      - $ref: '#/components/parameters/pagination-optional'
      - $ref: '#/components/parameters/limit-optional'
      - $ref: '#/components/parameters/offset-optional'
      - $ref: '#/components/parameters/name-optional'
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    allOf:
                    - type: array
                      items:
                        $ref: '#/components/schemas/devices'
                  limit:
                    type: integer
                    default: 200
                  offset:
                    type: integer
                    default: 0
                  total:
                    type: integer
          description: OK
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    servers:
    - url: https://api.strata.paloaltonetworks.com/config/setup/v1
      description: Current
  /devices/{id}:
    get:
      summary: Get a device
      description: 'Retrieve an existing device.

        '
      tags:
      - Devices
      operationId: GetDeviceByID
      parameters:
      - $ref: '#/components/parameters/uuid'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/devices'
          description: OK
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    put:
      summary: Update a device
      description: 'Update an existing device.

        '
      tags:
      - Devices
      operationId: UpdateDeviceByID
      parameters:
      - $ref: '#/components/parameters/uuid'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/devices-put'
        description: The `device` resource definition.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/devices'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic_with_body'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
      security:
      - scmToken: []
    servers:
    - url: https://api.strata.paloaltonetworks.com/config/setup/v1
      description: Current
components:
  schemas:
    SystemIntegrityPosture:
      type: object
      required:
      - status
      - services
      properties:
        status:
          $ref: '#/components/schemas/SystemIntegrityPostureStatus'
        services:
          $ref: '#/components/schemas/SystemIntegrityPostureServices'
    DeviceEPP:
      type: object
      required:
      - products
      - enabled
      properties:
        products:
          type: array
          items:
            $ref: '#/components/schemas/EPP'
        enabled:
          type: boolean
    DeviceBrowserBrand:
      type: string
      description: Browser brand
      enum:
      - Arc
      - Brave
      - Chrome
      - Edge
      - Opera
      - Dia
      - Comet
      - Prisma Browser
      - Unknown
    DeviceManagementSystem:
      type: object
      properties:
        system:
          type: string
          enum:
          - ad
          - azureAd
          - intune
          - jamf
        details:
          type: string
    FirewallProduct:
      type: object
      description: Firewall product information
      required:
      - vendorName
      - productName
      - enabled
      properties:
        vendorName:
          $ref: '#/components/schemas/FirewallVendorName'
        productName:
          type: string
          description: Product name of the firewall
        enabled:
          type: boolean
          description: Whether the firewall is enabled
    DeviceDiskEncryptionDetails:
      type: object
      description: Disk encryption details for the device
      required:
      - products
      properties:
        products:
          type: array
          description: List of disk encryption products detected on the device
          items:
            $ref: '#/components/schemas/DiskEncryptionProduct'
    SystemIntegrityPostureStatus:
      type: string
      description: System integrity status
      enum:
      - pass
      - fail
      - unknown
    DeviceRestoreResponse:
      type: object
      properties:
        restoredDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were restored
        message:
          type: string
          example: 3 devices restored successfully
    DevicePlatform:
      type: string
      description: Device platform
      enum:
      - Desktop Browser
      - Mobile Browser
      - Browser Extension
      - Unknown
    PageInfo:
      type: object
      properties:
        hasNextPage:
          type: boolean
          description: When paginating forwards, are there more items?
        cursor:
          type:
          - string
          - 'null'
          description: When paginating forwards, the cursor to continue.
      required:
      - hasNextPage
    CrowdstrikeZTAPosture:
      type: object
      required:
      - score
      - sensorScore
      - osScore
      - CID
      properties:
        score:
          type: integer
        sensorScore:
          type: integer
        osScore:
          type: inte

# --- truncated at 32 KB (77 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-devices-api-openapi.yml