Palo Alto Networks HTTPS Destinations API

openapi: 3.2.0
info:
  title: Palo Alto Networks Strata Logging Service HTTPS…
  description: Strata Logging Service API (formerly Cortex Data Lake) for log forwarding configuration management. Provides programmatic control over log forwarding profiles and their destinations including syslog servers, HTTPS endpoints, and email recipients. Enables centralized management of where SASE and NGFW log data is forwarded for SIEM integration, compliance archival, and security operations workflows.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/logging-service/v1
  description: Strata Logging Service API production server.
security:
- oauth2Bearer: []
tags:
- name: HTTPS Destinations
  description: HTTPS forwarding destination management.
paths:
  /log-forwarding-profiles/{profile_id}/destinations/https:
    get:
      operationId: listHTTPSDestinations
      summary: Palo Alto Networks List HTTPS Destinations
      description: Returns the HTTPS destinations configured for a log forwarding profile.
      tags:
      - HTTPS Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '514363'
      responses:
        '200':
          description: HTTPS destinations returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/HTTPSDestination'
              examples:
                ListHttpsdestinations200Example:
                  summary: Default listHTTPSDestinations 200 response
                  x-microcks-default: true
                  value:
                    total: 749
                    items:
                    - destination_id: '447836'
                      name: Primary Agent 22
                      uri: https://portal.acme-systems.org/76c1c6
                      http_method: POST
                      tls_verify: true
                      enabled: false
                      created_at: '2025-12-06T21:23:39Z'
                    - destination_id: '447836'
                      name: Primary Agent 22
                      uri: https://portal.acme-systems.org/76c1c6
                      http_method: POST
                      tls_verify: true
                      enabled: false
                      created_at: '2025-12-06T21:23:39Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListHttpsdestinations401Example:
                  summary: Default listHTTPSDestinations 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListHttpsdestinations403Example:
                  summary: Default listHTTPSDestinations 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListHttpsdestinations404Example:
                  summary: Default listHTTPSDestinations 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListHttpsdestinations500Example:
                  summary: Default listHTTPSDestinations 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createHTTPSDestination
      summary: Palo Alto Networks Create HTTPS Destination
      description: Adds an HTTPS webhook destination to a log forwarding profile.
      tags:
      - HTTPS Destinations
      parameters:
      - name: profile_id
        in: path
        required: true
        description: Unique identifier of the log forwarding profile.
        schema:
          type: string
        example: '359073'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HTTPSDestinationRequest'
            examples:
              CreateHttpsdestinationRequestExample:
                summary: Default createHTTPSDestination request
                x-microcks-default: true
                value:
                  name: Primary Gateway 87
                  uri: https://portal.test-corp.net/ab0d1d
                  http_method: POST
                  headers: {}
                  tls_verify: true
                  enabled: true
      responses:
        '201':
          description: HTTPS destination created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPSDestination'
              examples:
                CreateHttpsdestination201Example:
                  summary: Default createHTTPSDestination 201 response
                  x-microcks-default: true
                  value:
                    destination_id: '447836'
                    name: Primary Agent 22
                    uri: https://portal.acme-systems.org/76c1c6
                    http_method: POST
                    tls_verify: true
                    enabled: false
                    created_at: '2025-12-06T21:23:39Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateHttpsdestination400Example:
                  summary: Default createHTTPSDestination 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateHttpsdestination401Example:
                  summary: Default createHTTPSDestination 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateHttpsdestination403Example:
                  summary: Default createHTTPSDestination 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '404':
          description: Log forwarding profile not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateHttpsdestination404Example:
                  summary: Default createHTTPSDestination 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateHttpsdestination500Example:
                  summary: Default createHTTPSDestination 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
                    request_id: 59fcc104-7100-494b-b0c4-09f9dcc477d9
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    HTTPSDestinationRequest:
      type: object
      required:
      - name
      - uri
      properties:
        name:
          type: string
          description: Display name for this HTTPS destination.
          example: Primary Gateway 87
        uri:
          type: string
          format: uri
          description: HTTPS endpoint URL.
          example: https://portal.test-corp.net/ab0d1d
        http_method:
          type: string
          enum:
          - POST
          - PUT
          default: POST
          example: POST
        headers:
          type: object
          description: Additional HTTP headers to include in log delivery requests.
          additionalProperties:
            type: string
          example: {}
        tls_verify:
          type: boolean
          default: true
          example: true
        enabled:
          type: boolean
          default: true
          example: true
    HTTPSDestination:
      type: object
      properties:
        destination_id:
          type: string
          description: Unique identifier of the HTTPS destination.
          example: '447836'
        name:
          type: string
          description: Display name of the destination.
          example: Primary Agent 22
        uri:
          type: string
          format: uri
          description: HTTPS endpoint URL where logs are posted.
          example: https://portal.acme-systems.org/76c1c6
        http_method:
          type: string
          enum:
          - POST
          - PUT
          description: HTTP method used to deliver logs.
          example: POST
        tls_verify:
          type: boolean
          description: Whether TLS certificate verification is enabled.
          example: true
        enabled:
          type: boolean
          example: false
        created_at:
          type: string
          format: date-time
          example: '2025-12-06T21:23:39Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Monitoring investigation network on activity investigation blocked malware alert activity rule activity.
        request_id:
          type: string
          description: Request identifier for support correlation.
          example: 59fcc104-7100-494b-b0c4-09f9dcc477d9
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.