Palo Alto Networks

Palo Alto Networks Firewalls API

Cloud NGFW firewall instance management.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 5

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /config/ngfirewalls List Cloud NGFW firewalls in an AWS account · Palo Alto Networks List Cloud NGFW Firewalls #
Ask an LLM
“Which Cloud NGFW firewalls are running in my AWS account?”
“Can I see only the firewalls attached to one VPC?”
Tell an agent
List all Cloud NGFW firewalls in the account.
List the Cloud NGFW firewalls attached to VPC {vpcid}.
POST /config/ngfirewalls Create a Cloud NGFW firewall in a VPC · Palo Alto Networks Create Cloud NGFW Firewall #
Ask an LLM
“How do I deploy a new Cloud NGFW firewall into one of my AWS VPCs?”
“What do I need to specify when creating a cloud firewall, like the rule stack and subnet mappings?”
Tell an agent
Create a Cloud NGFW firewall named {FirewallName} with configuration {FirewallEntry}.
Provision a new cloud firewall {FirewallName} using these VPC, subnet and rule stack settings: {FirewallEntry}.
GET /config/ngfirewalls/{firewall} Get a Cloud NGFW firewall's configuration · Palo Alto Networks Get Cloud NGFW Firewall #
Ask an LLM
“What is the current status of a specific Cloud NGFW firewall?”
“Which rule stack and subnets is a given cloud firewall using?”
Tell an agent
Show the configuration and status of firewall {firewall}.
Check whether Cloud NGFW firewall {firewall} is active.
PUT /config/ngfirewalls/{firewall} Update an existing Cloud NGFW firewall · Palo Alto Networks Update Cloud NGFW Firewall #
Ask an LLM
“How do I switch an existing cloud firewall to a different rule stack?”
“Can I change the subnet mappings of a firewall that's already deployed?”
Tell an agent
Update firewall {firewall} with the new configuration {FirewallEntry}.
Point existing firewall {firewall} ({FirewallName}) at the rule stack in {FirewallEntry}.
DELETE /config/ngfirewalls/{firewall} Delete a Cloud NGFW firewall · Palo Alto Networks Delete Cloud NGFW Firewall #
Ask an LLM
“How do I tear down a Cloud NGFW firewall and remove its VPC endpoints?”
“In what state must a firewall be before it can be deleted?”
Tell an agent destructive · confirm first
Delete Cloud NGFW firewall {firewall}.
Remove firewall {firewall} and disassociate it from its VPC.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-firewalls-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-firewalls-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-firewalls-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Cloud NGFW for AWS REST Firewalls API
  description: REST API for managing Palo Alto Networks Cloud Next-Generation Firewall (Cloud NGFW) deployments on Amazon Web Services.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/cloudngfw/aws/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
  description: Cloud NGFW for AWS regional API endpoint.
  variables:
    region:
      description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
      default: us-east-1
security:
- awsSigV4: []
tags:
- name: Firewalls
  description: Cloud NGFW firewall instance management.
paths:
  /config/ngfirewalls:
    get:
      operationId: listFirewalls
      summary: Palo Alto Networks List Cloud NGFW Firewalls
      description: Returns a paginated list of all Cloud NGFW firewall instances in the AWS account. Each entry includes configuration, associated rule stack, VPC attachment, and operational status.
      tags:
      - Firewalls
      parameters:
      - name: maxresults
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      - name: nexttoken
        in: query
        schema:
          type: string
        example: example-nexttoken
      - name: vpcid
        in: query
        description: Filter firewalls by AWS VPC ID.
        schema:
          type: string
        example: '161612'
      responses:
        '200':
          description: Firewalls returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    type: object
                    properties:
                      Firewalls:
                        type: array
                        items:
                          $ref: '#/components/schemas/FirewallSummary'
                      NextToken:
                        type: string
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                ListFirewalls200Example:
                  summary: Default listFirewalls 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      Firewalls:
                      - FirewallName: Production Gateway 93
                        VpcId: '780399'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        Status: running
                      NextToken: example-NextToken
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createFirewall
      summary: Palo Alto Networks Create Cloud NGFW Firewall
      description: Creates a new Cloud NGFW firewall instance in the specified VPC. Specify the associated rule stack, VPC and subnet mappings for endpoint creation, and optional logging configuration.
      tags:
      - Firewalls
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              CreateFirewallRequestExample:
                summary: Default createFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                CreateFirewall200Example:
                  summary: Default createFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          $ref: '#/components/responses/Conflict'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /config/ngfirewalls/{firewall}:
    get:
      operationId: getFirewall
      summary: Palo Alto Networks Get Cloud NGFW Firewall
      description: Returns the configuration and status of a specific Cloud NGFW firewall instance.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                GetFirewall200Example:
                  summary: Default getFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateFirewall
      summary: Palo Alto Networks Update Cloud NGFW Firewall
      description: Updates the configuration of an existing Cloud NGFW firewall instance, such as changing the associated rule stack or updating subnet mappings.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirewallRequest'
            examples:
              UpdateFirewallRequestExample:
                summary: Default updateFirewall request
                x-microcks-default: true
                value:
                  FirewallName: Production Sensor 15
                  FirewallEntry:
                    Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
                    VpcId: '911913'
                    AssociatedRuleStack: example-AssociatedRuleStack
                    SubnetMappings:
                    - SubnetId: '671001'
                    - SubnetId: '304867'
                    Tags:
                    - Key: example-Key
                      Value: example-Value
      responses:
        '200':
          description: Firewall updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  Response:
                    $ref: '#/components/schemas/Firewall'
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                UpdateFirewall200Example:
                  summary: Default updateFirewall 200 response
                  x-microcks-default: true
                  value:
                    Response:
                      FirewallName: Corporate Policy 70
                      FirewallEntry:
                        Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
                        VpcId: '325753'
                        AssociatedRuleStack: example-AssociatedRuleStack
                        SubnetMappings:
                        - SubnetId: '207407'
                          AvailabilityZone: untrust
                        Tags:
                        - Key: example-Key
                          Value: example-Value
                      FirewallStatus:
                        FirewallStatus: DELETING
                        Attachments:
                        - SubnetId: '241296'
                          EndpointId: '635794'
                          Status: enabled
                        - SubnetId: '713413'
                          EndpointId: '622390'
                          Status: active
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteFirewall
      summary: Palo Alto Networks Delete Cloud NGFW Firewall
      description: Deletes a Cloud NGFW firewall instance. This disassociates the firewall from the VPC and removes all associated endpoints. The firewall must be in a PROVISIONING or ACTIVE state to be deleted.
      tags:
      - Firewalls
      parameters:
      - $ref: '#/components/parameters/firewall'
      responses:
        '200':
          description: Firewall deletion initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ResponseStatus:
                    $ref: '#/components/schemas/ResponseStatus'
              examples:
                DeleteFirewall200Example:
                  summary: Default deleteFirewall 200 response
                  x-microcks-default: true
                  value:
                    ResponseStatus:
                      ErrorCode: 0
                      Reason: ''
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid AWS credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: A resource with the specified name already exists or cannot be modified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    FirewallRequest:
      type: object
      required:
      - FirewallName
      - FirewallEntry
      properties:
        FirewallName:
          type: string
          example: Production Sensor 15
        FirewallEntry:
          type: object
          required:
          - VpcId
          - AssociatedRuleStack
          - SubnetMappings
          properties:
            Description:
              type: string
              example: Activity incident alert configured firewall suspicious policy.
            VpcId:
              type: string
              example: '226288'
            AssociatedRuleStack:
              type: string
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '436036'
              example:
              - SubnetId: '355983'
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Monitoring alert applied blocked policy monitoring traffic activity network policy threat.
            VpcId: '911913'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '671001'
            - SubnetId: '304867'
            Tags:
            - Key: example-Key
              Value: example-Value
    ResponseStatus:
      type: object
      description: Standard API response status envelope included in all responses.
      properties:
        ErrorCode:
          type: integer
          description: Error code. 0 indicates success.
          example: 0
        Reason:
          type: string
          description: Human-readable status message.
          example: ''
    Firewall:
      type: object
      description: A Cloud NGFW firewall instance deployed in an AWS VPC.
      properties:
        FirewallName:
          type: string
          example: Corporate Policy 70
        FirewallEntry:
          type: object
          properties:
            Description:
              type: string
              example: Malware endpoint incident policy endpoint on applied rule applied.
            VpcId:
              type: string
              description: AWS VPC ID where the firewall is deployed.
              example: '886305'
            AssociatedRuleStack:
              type: string
              description: Name of the rule stack associated with this firewall.
              example: example-AssociatedRuleStack
            SubnetMappings:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    description: AWS subnet ID for the firewall endpoint.
                    example: '124164'
                  AvailabilityZone:
                    type: string
                    example: untrust
              example:
              - SubnetId: '297621'
                AvailabilityZone: dmz
              - SubnetId: '781667'
                AvailabilityZone: untrust
            Tags:
              type: array
              items:
                type: object
                properties:
                  Key:
                    type: string
                    example: example-Key
                  Value:
                    type: string
                    example: example-Value
              example:
              - Key: example-Key
                Value: example-Value
              - Key: example-Key
                Value: example-Value
          example:
            Description: Firewall violation traffic monitoring firewall blocked suspicious traffic rule investigation applied malware.
            VpcId: '325753'
            AssociatedRuleStack: example-AssociatedRuleStack
            SubnetMappings:
            - SubnetId: '207407'
              AvailabilityZone: untrust
            Tags:
            - Key: example-Key
              Value: example-Value
        FirewallStatus:
          type: object
          properties:
            FirewallStatus:
              type: string
              enum:
              - PROVISIONING
              - ACTIVE
              - DELETING
              - FAILED
              example: FAILED
            Attachments:
              type: array
              items:
                type: object
                properties:
                  SubnetId:
                    type: string
                    example: '513355'
                  EndpointId:
                    type: string
                    example: '268654'
                  Status:
                    type: string
                    example: active
              example:
              - SubnetId: '690238'
                EndpointId: '699787'
                Status: active
              - SubnetId: '994368'
                EndpointId: '479951'
                Status: running
          example:
            FirewallStatus: DELETING
            Attachments:
            - SubnetId: '241296'
              EndpointId: '635794'
              Status: enabled
            - SubnetId: '713413'
              EndpointId: '622390'
              Status: active
    FirewallSummary:
      type: object
      properties:
        FirewallName:
          type: string
          example: Production Gateway 93
        VpcId:
          type: string
          example: '780399'
        AssociatedRuleStack:
          type: string
          example: example-AssociatedRuleStack
        Status:
          type: string
          example: running
    ErrorResponse:
      type: object
      properties:
        ResponseStatus:
          type: object
          properties:
            ErrorCode:
              type: integer
              example: 869
            Reason:
              type: string
              example: Blocked investigation activity firewall activity malware network on applied.
          example:
            ErrorCode: 719
            Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
  parameters:
    firewall:
      name: firewall
      in: path
      required: true
      description: Name of the Cloud NGFW firewall instance.
      schema:
        type: string
  securitySchemes:
    awsSigV4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4 (SigV4) signed request. Use an AWS IAM role or user with CloudNGFW IAM permissions. Sign requests using the service name cloudngfw and the target AWS region. Include x-amz-date and x-amz-security-token headers as required.