Palo Alto Networks IDP API
The IDP API from Palo Alto Networks — 9 operation(s) for idp.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-idp-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Incident Security Service Posture Management IDP API
version: '1.0'
description: Endpoint to retrieve Identity Posture Security information This Open API spec file was created on July 01, 2025. © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
tags:
- name: IDP
paths:
/sspm/identity/v1/idps:
get:
summary: Palo Alto Networks Get All Identity Providers
description: Retrieve a list of identity providers (Identity Providers) configured for the tenant. You can optionally filter the results to view only designated identity providers.
operationId: idps_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseIdpInfo'
examples:
IdpsGet200Example:
summary: Default idps_get 200 response
x-microcks-default: true
value:
total: 620
items:
- displayName: Branch Sensor 08
idpId: '800802'
appType: standard
'404':
description: Not Found
parameters:
- name: designated
in: query
schema:
type: boolean
example: false
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
summary: Palo Alto Networks Create Identity Provider
description: Create a new identity provider (Identity Provider) entry for the tenant. You can specify the type, identifier, and whether it should be marked as designated.
operationId: idps_post
responses:
'201':
description: Created
'400':
description: Bad Request
parameters:
- name: designated
in: query
schema:
type: boolean
example: true
- name: idpId
in: query
schema:
type: string
example: '101857'
- name: idpType
in: query
schema:
type: string
example: advanced
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/accounts/logout:
get:
summary: Palo Alto Networks Get Logout Status
description: Retrieve the logout status of user accounts associated with the specified identity provider (Identity Provider). This is useful for tracking the outcome of account logout actions in batch operations.
operationId: idps_accounts_logout_get
responses:
'200':
description: OK
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '339256'
- name: batch_id
in: query
schema:
type: string
example: '465701'
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
summary: Palo Alto Networks Trigger Account Logout
description: Initiate a logout request for user accounts associated with the specified identity provider (Identity Provider). This action helps enforce session termination for compliance or security purposes.
operationId: idps_accounts_logout_post
responses:
'200':
description: OK
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '650260'
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RemediationRequest'
examples:
IdpsAccountsLogoutPostRequestExample:
summary: Default idps_accounts_logout_post request
x-microcks-default: true
value:
users:
- example-users_item
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/feature_state:
get:
summary: Palo Alto Networks Get Identity Provider Feature State
description: Retrieve the current status and last scan timestamp of a specific feature enabled for the identity provider (Identity Provider). This helps assess feature health and scan recency.
operationId: idps_feature_state_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/FeatureState'
examples:
IdpsFeatureStateGet200Example:
summary: Default idps_feature_state_get 200 response
x-microcks-default: true
value:
status: enabled
lastScannedAt: 2022-03-10 16:15:50+00:00
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '359166'
- name: feature
in: query
schema:
$ref: '#/components/schemas/Feature'
example: ENROLLMENT
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/idp_accounts/count:
get:
summary: Palo Alto Networks Get Identity Provider Account Count
description: Return the number of user accounts linked to the specified identity provider (Identity Provider). Filtering options can be applied to count specific types of accounts such as orphaned or privileged users.
operationId: idps_idp_accounts_count_get
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
additionalProperties:
format: int64
type: integer
examples:
IdpsIdpAccountsCountGet200Example:
summary: Default idps_idp_accounts_count_get 200 response
x-microcks-default: true
value: {}
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '479701'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report:
post:
summary: Palo Alto Networks Generate Identity Provider Account CSV Report
description: Generate a CSV report of accounts associated with the specified identity provider (Identity Provider). The report supports compliance audits and user access reviews.
operationId: idps_idp_accounts_csv_report_get
responses:
'201':
description: Created
'400':
description: Bad Request
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '489324'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DownloadCsvRequest'
examples:
IdpsIdpAccountsCsvReportGetRequestExample:
summary: Default idps_idp_accounts_csv_report_get request
x-microcks-default: true
value:
userFullName: soc-analyst
userEmail: example-userEmail
service: example-service
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/mfa_activity:
get:
summary: Palo Alto Networks Get Multi-factor Authentication Activity Logs
description: Retrieve a list of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). The logs include user identities, timestamps, IP Address addresses, and Multi-factor authentication methods used.
operationId: idps_mfa_activity_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseMfaActivity'
examples:
IdpsMfaActivityGet200Example:
summary: Default idps_mfa_activity_get 200 response
x-microcks-default: true
value:
total: 724
items:
- id: example-id
tenant: example-tenant
userId: '820434'
idpId: '389141'
idpType: custom
mfaStrength: example-mfaStrength
admin: true
appType: advanced
appId: '226503'
timestamp: &id001 2022-03-10 16:15:50+00:00
mfaFactors: example-mfaFactors
saasProviderMfaType: custom
fullName: Corporate Sensor 50
email: soc-admin@example.com
ipAddress: 10.129.29.50
location: example-location
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
- id: example-id
tenant: example-tenant
userId: '829660'
idpId: '133263'
idpType: standard
mfaStrength: example-mfaStrength
admin: true
appType: advanced
appId: '947066'
timestamp: *id001
mfaFactors: example-mfaFactors
saasProviderMfaType: standard
fullName: Corporate Firewall 28
email: security-ops@example.com
ipAddress: 10.81.194.228
location: example-location
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '701548'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: limit
in: query
schema:
format: int32
type: integer
example: 896
- name: page
in: query
schema:
format: int32
type: integer
example: 778
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/mfa_activity/count:
get:
summary: Palo Alto Networks Get Multi-factor Authentication Activity Count
description: Return the number of multi-factor authentication (Multi-factor authentication) activities recorded for the specified identity provider (Identity Provider). This count helps evaluate authentication volume and usage patterns.
operationId: idps_mfa_activity_count_get
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
additionalProperties:
format: int64
type: integer
examples:
IdpsMfaActivityCountGet200Example:
summary: Default idps_mfa_activity_count_get 200 response
x-microcks-default: true
value: {}
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '726859'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type:
get:
summary: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
description: Return the number of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider), grouped by application type. This helps analyze authentication trends across different SaaS applications.
operationId: idps_mfa_activity_count_by_app_type_get
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/MfaActivityCountByAppType'
examples:
IdpsMfaActivityCountByAppTypeGet200Example:
summary: Default idps_mfa_activity_count_by_app_type_get 200 response
x-microcks-default: true
value:
- appType: advanced
count: 967
iconAppType: standard
'404':
description: Not Found
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '826348'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: limit
in: query
schema:
format: int32
type: integer
example: 853
- name: page
in: query
schema:
format: int32
type: integer
example: 567
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/sspm/identity/v1/idps/{idpId}/mfa_activity/csv_report:
post:
summary: Palo Alto Networks Generate Identity Provider Multi-factor Authentication…
description: Generate a comma-separated values (CSV) report of multi-factor authentication (Multi-factor authentication) activities for the specified identity provider (Identity Provider). This report helps audit authentication patterns and policy compliance.
operationId: idps_mfa_activity_csv_report_get
responses:
'201':
description: Created
'400':
description: Bad Request
parameters:
- name: idpId
in: path
required: true
schema:
type: string
example: '993198'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- IDP
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DownloadCsvRequest'
examples:
IdpsMfaActivityCsvReportGetRequestExample:
summary: Default idps_mfa_activity_csv_report_get request
x-microcks-default: true
value:
userFullName: soc-analyst
userEmail: example-userEmail
service: example-service
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
schemas:
RemediationRequest:
type: object
properties:
users:
type: array
items:
type: string
example:
- example-users_item
MfaActivity:
type: object
properties:
id:
type: string
example: example-id
tenant:
type: string
example: example-tenant
userId:
type: string
example: '988415'
idpId:
type: string
example: '797020'
idpType:
type: string
example: custom
mfaStrength:
type: string
example: example-mfaStrength
admin:
type: boolean
example: false
appType:
type: string
example: advanced
appId:
type: string
example: '282235'
timestamp:
$ref: '#/components/schemas/Instant'
mfaFactors:
type: string
example: example-mfaFactors
saasProviderMfaType:
type: string
example: advanced
fullName:
type: string
example: Branch Policy 87
email:
type: string
example: soc-admin@example.com
ipAddress:
type: string
example: 10.152.115.236
location:
type: string
example: example-location
ticketKey:
type: string
example: example-ticketKey
ticketUrl:
type: string
example: example-ticketUrl
FeatureState:
type: object
properties:
status:
type: string
example: enabled
lastScannedAt:
$ref: '#/components/schemas/Instant'
Feature:
enum:
- ENROLLMENT
- ACTIVITY
- LOGOUT
- IDENTITY_NHI
- IDENTITY_ACTIVITY
type: string
ListResponseMfaActivity:
type: object
properties:
total:
format: int64
type: integer
example: 724
items:
type: array
items:
$ref: '#/components/schemas/MfaActivity'
example:
- id: example-id
tenant: example-tenant
userId: '820434'
idpId: '389141'
idpType: custom
mfaStrength: example-mfaStrength
admin: true
appType: advanced
appId: '226503'
timestamp: &id002 2022-03-10 16:15:50+00:00
mfaFactors: example-mfaFactors
saasProviderMfaType: custom
fullName: Corporate Sensor 50
email: soc-admin@example.com
ipAddress: 10.129.29.50
location: example-location
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
- id: example-id
tenant: example-tenant
userId: '829660'
idpId: '133263'
idpType: standard
mfaStrength: example-mfaStrength
admin: true
appType: advanced
appId: '947066'
timestamp: *id002
mfaFactors: example-mfaFactors
saasProviderMfaType: standard
fullName: Corporate Firewall 28
email: security-ops@example.com
ipAddress: 10.81.194.228
location: example-location
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
MfaActivityCountByAppType:
type: object
properties:
appType:
type: string
example: advanced
count:
format: int64
type: integer
example: 967
iconAppType:
type: string
example: standard
ListResponseIdpInfo:
type: object
properties:
total:
format: int64
type: integer
example: 620
items:
type: array
items:
$ref: '#/components/schemas/IdpInfo'
example:
- displayName: Branch Sensor 08
idpId: '800802'
appType: standard
IdpInfo:
type: object
properties:
displayName:
type: string
example: Branch Sensor 08
idpId:
type: string
example: '800802'
appType:
type: string
example: standard
DownloadCsvRequest:
required:
- userFullName
- userEmail
- service
type: object
properties:
userFullName:
type: string
example: soc-analyst
userEmail:
type: string
example: example-userEmail
service:
type: string
example: example-service
Instant:
format: date-time
type: string
example: 2022-03-10 16:15:50+00:00