Palo Alto Networks IDP API

openapi: 3.2.0
info:
  title: Incident Security Service Posture Management IDP API
  version: '1.0'
  description: Endpoint to retrieve Identity Posture Security information This Open API spec file was created on July 01, 2025. © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
tags:
- name: IDP
paths:
  /sspm/identity/v1/idps:
    get:
      summary: Get all Identity Providers
      description: Retrieve a list of identity providers (Identity Providers) configured for the tenant. You can optionally filter the results to view only designated identity providers.
      operationId: idps_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseIdpInfo'
        '404':
          description: Not Found
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
    post:
      summary: Create identity provider
      description: Create a new identity provider (Identity Provider) entry for the tenant. You can specify the type, identifier, and whether it should be marked as designated.
      operationId: idps_post
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: designated
        in: query
        schema:
          type: boolean
      - name: idpId
        in: query
        schema:
          type: string
      - name: idpType
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/accounts/logout:
    get:
      summary: Get logout status
      description: Retrieve the logout status of user accounts associated with the specified identity provider (Identity Provider). This is useful for tracking the outcome of account logout actions in batch operations.
      operationId: idps_accounts_logout_get
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: batch_id
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
    post:
      summary: Trigger account logout
      description: Initiate a logout request for user accounts associated with the specified identity provider (Identity Provider). This action helps enforce session termination for compliance or security purposes.
      operationId: idps_accounts_logout_post
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationRequest'
  /sspm/identity/v1/idps/{idpId}/feature_state:
    get:
      summary: Get Identity Provider feature state
      description: Retrieve the current status and last scan timestamp of a specific feature enabled for the identity provider (Identity Provider). This helps assess feature health and scan recency.
      operationId: idps_feature_state_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeatureState'
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: feature
        in: query
        schema:
          $ref: '#/components/schemas/Feature'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/idp_accounts/count:
    get:
      summary: Get Identity Provider account count
      description: Return the number of user accounts linked to the specified identity provider (Identity Provider). Filtering options can be applied to count specific types of accounts such as orphaned or privileged users.
      operationId: idps_idp_accounts_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report:
    post:
      summary: Generate Identity Provider account CSV report
      description: Generate a CSV report of accounts associated with the specified identity provider (Identity Provider). The report supports compliance audits and user access reviews.
      operationId: idps_idp_accounts_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
  /sspm/identity/v1/idps/{idpId}/mfa_activity:
    get:
      summary: Get Multi-factor authentication activity logs
      description: Retrieve a list of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). The logs include user identities, timestamps, IP Address addresses, and Multi-factor authentication methods used.
      operationId: idps_mfa_activity_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseMfaActivity'
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count:
    get:
      summary: Get Multi-factor authentication activity count
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities recorded for the specified identity provider (Identity Provider). This count helps evaluate authentication volume and usage patterns.
      operationId: idps_mfa_activity_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type:
    get:
      summary: Get Multi-factor authentication activity count by app type
      description: Return the number of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider), grouped by application type. This helps analyze authentication trends across different SaaS applications.
      operationId: idps_mfa_activity_count_by_app_type_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/MfaActivityCountByAppType'
        '404':
          description: Not Found
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
  /sspm/identity/v1/idps/{idpId}/mfa_activity/csv_report:
    post:
      summary: Generate Identity Provider Multi-factor authentication activity CSV report
      description: Generate a comma-separated values (CSV) report of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). This report helps audit authentication patterns and policy compliance.
      operationId: idps_mfa_activity_csv_report_get
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: idpId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - IDP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
components:
  schemas:
    FeatureState:
      type: object
      properties:
        status:
          type: string
        lastScannedAt:
          $ref: '#/components/schemas/Instant'
    MfaActivity:
      type: object
      properties:
        id:
          type: string
        tenant:
          type: string
        userId:
          type: string
        idpId:
          type: string
        idpType:
          type: string
        mfaStrength:
          type: string
        admin:
          type: boolean
        appType:
          type: string
        appId:
          type: string
        timestamp:
          $ref: '#/components/schemas/Instant'
        mfaFactors:
          type: string
        saasProviderMfaType:
          type: string
        fullName:
          type: string
        email:
          type: string
        ipAddress:
          type: string
        location:
          type: string
        ticketKey:
          type: string
        ticketUrl:
          type: string
    MfaActivityCountByAppType:
      type: object
      properties:
        appType:
          type: string
        count:
          format: int64
          type: integer
        iconAppType:
          type: string
    IdpInfo:
      type: object
      properties:
        displayName:
          type: string
        idpId:
          type: string
        appType:
          type: string
    Feature:
      enum:
      - ENROLLMENT
      - ACTIVITY
      - LOGOUT
      - IDENTITY_NHI
      - IDENTITY_ACTIVITY
      type: string
    Instant:
      format: date-time
      type: string
      example: 2022-03-10 16:15:50+00:00
    DownloadCsvRequest:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
        userEmail:
          type: string
        service:
          type: string
    RemediationRequest:
      type: object
      properties:
        users:
          type: array
          items:
            type: string
    ListResponseIdpInfo:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/IdpInfo'
    ListResponseMfaActivity:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/MfaActivity'