Palo Alto Networks IDP API

openapi: 3.2.0
info:
  title: Palo Alto Networks IDP API
  version: '1.0'
  description: 'Operations tagged IDP across 3 of this provider''s published API definitions: palo-alto-identity-security-posture-management-api-openapi-original.yml, palo-alto-networks-idp-api-openapi.yml, palo-alto-sase-identity-sspm-latest-identity-sspm-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
tags:
- name: IDP
paths:
  /sspm/identity/v1/idps:
    get:
      summary: Palo Alto Networks Get All Identity Providers
      description: Retrieve a list of identity providers (Identity Providers) configured for the tenant. You can optionally filter the results to view only designated identity providers.
      operationId: idps_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseIdpInfo'
              examples:
                IdpsGet200Example:
                  summary: Default idps_get 200 response
                  x-microcks-default: true
                  value:
                    total: 620
                    items:
                    - displayName: Branch Sensor 08
                      idpId: '800802'
                      appType: standard
        '404':
          description: Not Found
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
        example: false
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      summary: Palo Alto Networks Create Identity Provider
      description: Create a new identity provider (Identity Provider) entry for the tenant. You can specify the type, identifier, and whether it should be marked as designated.
      operationId: idps_post
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
        example: true
      - name: idpId
        in: query
        schema:
          type: string
        example: '101857'
      - name: idpType
        in: query
        schema:
          type: string
        example: advanced
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/accounts/logout:
    get:
      summary: Palo Alto Networks Get Logout Status
      description: Retrieve the logout status of user accounts associated with the specified identity provider (Identity Provider). This is useful for tracking the outcome of account logout actions in batch operations.
      operationId: idps_accounts_logout_get
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '339256'
      - name: batch_id
        in: query
        schema:
          type: string
        example: '465701'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      summary: Palo Alto Networks Trigger Account Logout
      description: Initiate a logout request for user accounts associated with the specified identity provider (Identity Provider). This action helps enforce session termination for compliance or security purposes.
      operationId: idps_accounts_logout_post
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '650260'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationRequest'
            examples:
              IdpsAccountsLogoutPostRequestExample:
                summary: Default idps_accounts_logout_post request
                x-microcks-default: true
                value:
                  users:
                  - example-users_item
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/feature_state:
    get:
      summary: Palo Alto Networks Get Identity Provider Feature State
      description: Retrieve the current status and last scan timestamp of a specific feature enabled for the identity provider (Identity Provider). This helps assess feature health and scan recency.
      operationId: idps_feature_state_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeatureState'
              examples:
                IdpsFeatureStateGet200Example:
                  summary: Default idps_feature_state_get 200 response
                  x-microcks-default: true
                  value:
                    status: enabled
                    lastScannedAt: 2022-03-10 16:15:50+00:00
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '359166'
      - name: feature
        in: query
        schema:
          $ref: '#/components/schemas/Feature'
        example: ENROLLMENT
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/idp_accounts/count:
    get:
      summary: Palo Alto Networks Get Identity Provider Account Count
      description: Return the number of user accounts linked to the specified identity provider (Identity Provider). Filtering options can be applied to count specific types of accounts such as orphaned or privileged users.
      operationId: idps_idp_accounts_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
              examples:
                IdpsIdpAccountsCountGet200Example:
                  summary: Default idps_idp_accounts_count_get 200 response
                  x-microcks-default: true
                  value: {}
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '479701'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report:
    post:
      summary: Palo Alto Networks Generate Identity Provider Account CSV Report
      description: Generate a CSV report of accounts associated with the specified identity provider (Identity Provider). The report supports compliance audits and user access reviews.
      operationId: idps_idp_accounts_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '489324'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
            examples:
              IdpsIdpAccountsCsvReportGetRequestExample:
                summary: Default idps_idp_accounts_csv_report_get request
                x-microcks-default: true
                value:
                  userFullName: soc-analyst
                  userEmail: example-userEmail
                  service: example-service
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/mfa_activity:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Logs
      description: Retrieve a list of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). The logs include user identities, timestamps, IP Address addresses, and Multi-factor authentication methods used.
      operationId: idps_mfa_activity_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseMfaActivity'
              examples:
                IdpsMfaActivityGet200Example:
                  summary: Default idps_mfa_activity_get 200 response
                  x-microcks-default: true
                  value:
                    total: 724
                    items:
                    - id: example-id
                      tenant: example-tenant
                      userId: '820434'
                      idpId: '389141'
                      idpType: custom
                      mfaStrength: example-mfaStrength
                      admin: true
                      appType: advanced
                      appId: '226503'
                      timestamp: &id001 2022-03-10 16:15:50+00:00
                      mfaFactors: example-mfaFactors
                      saasProviderMfaType: custom
                      fullName: Corporate Sensor 50
                      email: soc-admin@example.com
                      ipAddress: 10.129.29.50
                      location: example-location
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                    - id: example-id
                      tenant: example-tenant
                      userId: '829660'
                      idpId: '133263'
                      idpType: standard
                      mfaStrength: example-mfaStrength
                      admin: true
                      appType: advanced
                      appId: '947066'
                      timestamp: *id001
                      mfaFactors: example-mfaFactors
                      saasProviderMfaType: standard
                      fullName: Corporate Firewall 28
                      email: security-ops@example.com
                      ipAddress: 10.81.194.228
                      location: example-location
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '701548'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 896
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 778
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Count
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities recorded for the specified identity provider (Identity Provider). This count helps evaluate authentication volume and usage patterns.
      operationId: idps_mfa_activity_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
              examples:
                IdpsMfaActivityCountGet200Example:
                  summary: Default idps_mfa_activity_count_get 200 response
                  x-microcks-default: true
                  value: {}
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '726859'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type:
    get:
      summary: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider), grouped by application type. This helps analyze authentication trends across different SaaS applications.
      operationId: idps_mfa_activity_count_by_app_type_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/MfaActivityCountByAppType'
              examples:
                IdpsMfaActivityCountByAppTypeGet200Example:
                  summary: Default idps_mfa_activity_count_by_app_type_get 200 response
                  x-microcks-default: true
                  value:
                  - appType: advanced
                    count: 967
                    iconAppType: standard
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '826348'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 853
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 567
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
  /sspm/identity/v1/idps/{idpId}/mfa_activity/csv_report:
    post:
      summary: Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
      description: Generate a comma-separated values (CSV) report of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). This report helps audit authentication patterns and policy compliance.
      operationId: idps_mfa_activity_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
        example: '993198'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
            examples:
              IdpsMfaActivityCsvReportGetRequestExample:
                summary: Default idps_mfa_activity_csv_report_get request
                x-microcks-default: true
                value:
                  userFullName: soc-analyst
                  userEmail: example-userEmail
                  service: example-service
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    servers:
    - url: https://api.sase.paloaltonetworks.com
    - url: https://api.strata.paloaltonetworks.com
components:
  schemas:
    ListResponseIdpInfo:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 620
        items:
          type: array
          items:
            $ref: '#/components/schemas/IdpInfo'
          example:
          - displayName: Branch Sensor 08
            idpId: '800802'
            appType: standard
    MfaActivityCountByAppType:
      type: object
      properties:
        appType:
          type: string
          example: advanced
        count:
          format: int64
          type: integer
          example: 967
        iconAppType:
          type: string
          example: standard
    FeatureState:
      type: object
      properties:
        status:
          type: string
          example: enabled
        lastScannedAt:
          $ref: '#/components/schemas/Instant'
    Feature:
      enum:
      - ENROLLMENT
      - ACTIVITY
      - LOGOUT
      - IDENTITY_NHI
      - IDENTITY_ACTIVITY
      type: string
    DownloadCsvRequest:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
          example: soc-analyst
        userEmail:
          type: string
          example: example-userEmail
        service:
          type: string
          example: example-service
    MfaActivity:
      type: object
      properties:
        id:
          type: string
          example: example-id
        tenant:
          type: string
          example: example-tenant
        userId:
          type: string
          example: '988415'
        idpId:
          type: string
          example: '797020'
        idpType:
          type: string
          example: custom
        mfaStrength:
          type: string
          example: example-mfaStrength
        admin:
          type: boolean
          example: false
        appType:
          type: string
          example: advanced
        appId:
          type: string
          example: '282235'
        timestamp:
          $ref: '#/components/schemas/Instant'
        mfaFactors:
          type: string
          example: example-mfaFactors
        saasProviderMfaType:
          type: string
          example: advanced
        fullName:
          type: string
          example: Branch Policy 87
        email:
          type: string
          example: soc-admin@example.com
        ipAddress:
          type: string
          example: 10.152.115.236
        location:
          type: string
          example: example-location
        ticketKey:
          type: string
          example: example-ticketKey
        ticketUrl:
          type: string
          example: example-ticketUrl
    IdpInfo:
      type: object
      properties:
        displayName:
          type: string
          example: Branch Sensor 08
        idpId:
          type: string
          example: '800802'
        appType:
          type: string
          example: standard
    RemediationRequest:
      type: object
      properties:
        users:
          type: array
          items:
            type: string
          example:
          - example-users_item
    ListResponseMfaActivity:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 724
        items:
          type: array
          items:
            $ref: '#/components/schemas/MfaActivity'
          example:
          - id: example-id
            tenant: example-tenant
            userId: '820434'
            idpId: '389141'
            idpType: custom
            mfaStrength: example-mfaStrength
            admin: true
            appType: advanced
            appId: '226503'
            timestamp: &id002 2022-03-10 16:15:50+00:00
            mfaFactors: example-mfaFactors
            saasProviderMfaType: custom
            fullName: Corporate Sensor 50
            email: soc-admin@example.com
            ipAddress: 10.129.29.50
            location: example-location
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
          - id: example-id
            tenant: example-tenant
            userId: '829660'
            idpId: '133263'
            idpType: standard
            mfaStrength: example-mfaStrength
            admin: true
            appType: advanced
            appId: '947066'
            timestamp: *id002
            mfaFactors: example-mfaFactors
            saasProviderMfaType: standard
            fullName: Corporate Firewall 28
            email: security-ops@example.com
            ipAddress: 10.81.194.228
            location: example-location
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
    Instant:
      format: date-time
      type: string
      example: 2022-03-10 16:15:50+00:00
    ListResponseIdpInfo_2:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/IdpInfo_2'
    MfaActivityCountByAppType_2:
      type: object
      properties:
        appType:
          type: string
        count:
          format: int64
          type: integer
        iconAppType:
          type: string
    FeatureState_2:
      type: object
      properties:
        status:
          type: string
        lastScannedAt:
          $ref: '#/components/schemas/Instant'
    DownloadCsvRequest_2:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
        userEmail:
          type: string
        service:
          type: string
    MfaActivity_2:
      type: object
      properties:
        id:
          type: string
        tenant:
          type: string
        userId:
          type: string
        idpId:
          type: string
        idpType:
          type: string
        mfaStrength:
          type: string
        admin:
          type: boolean
        appType:
          type: string
        appId:
          type: string
        timestamp:
          $ref: '#/components/schemas/Instant'
        mfaFactors:
          type: string
        saasProviderMfaType:
          type: string
        fullName:
          type: string
        email:
          type: string
        ipAddress:
          type: string
        location:
          type: string
        ticketKey:
          type: string
        ticketUrl:
          type: string
    IdpInfo_2:
      type: object
      properties:
        displayName:
          type: string
        idpId:
          type: string
        appType:
          type: string
    RemediationRequest_2:
      type: object
      properties:
        users:
          type: array
          items:
            type: string
    ListResponseMfaActivity_2:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/MfaActivity_2'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-identity-security-posture-management-api-openapi-original.yml
- palo-alto-networks-idp-api-openapi.yml
- palo-alto-sase-identity-sspm-latest-identity-sspm-openapi.yaml