Palo Alto Networks Interconnect API
The Interconnect API from Palo Alto Networks — 6 operation(s) for interconnect.
OpenAPI Specification
openapi: 3.2.0
info:
title: SP Manage Interconnect API
version: '1.0'
description: "These APIs provide the administrative tools necessary to configure and manage the lifecycle of Service Provider (SP) Interconnects \nand virtual VlanAttachments within the management plane. They enable administrators to establish private, secure bridges between Service Providers \nand Prisma Access to bypass public cloud backbones. Use these tools during initial deployment or regional expansion to provision high-capacity physical and virtual links. \nBy submitting specific interconnect requests, you can manage bandwidth allocations and routing parameters to ensure secure, dedicated connectivity for your global infrastructure. This spec was created on February 13, 2026. © 2026 Palo Alto Networks, Inc."
servers:
- url: https://api.sase.paloaltonetworks.com
security:
- authKey: []
tags:
- name: Interconnect
paths:
/mt/sp-interconnect/interconnects:
get:
tags:
- Interconnect
summary: Retrieve All Interconnects
description: Access a complete inventory of Service Provider Interconnects configured within the multi-tenant environment. This inventory resides in the management plane and allows administrators to audit existing connectivity across AWS and GCP providers. Use this during system audits or when mapping regional resource availability to verify that backbones align with tenant requirements. Query parameters facilitate targeted searches by including default interconnects or expanding associated tenant data.
parameters:
- name: includeDefaultInterconnect
in: query
schema:
type: boolean
- name: includeTenantsAssociated
in: query
schema:
type: boolean
responses:
'200':
description: Success
content:
application/json:
examples:
Get interconnects:
value:
data:
- cloudProvider: GCP
id: 1689a56a-9386-40b5-aa9a-0cebad2650d8
name: new-ic
partnerEmail: acme@abc.com
partnerName: acme
permittedActions: []
region: us-west2
regionDisplayName: US Southwest
status: INACTIVE
tenantActivationCount: 0
tenantType: MT_ROOT
tsgId: '1669501385'
type: PARTNER
usage: SHARED
vlanAttachments:
- bfdEnabled: false
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758576695399
edgeAvailability: AVAILABILITY_DOMAIN_2
id: d06a04c9-b6aa-4e40-8722-cfee46fc786c
msg: Error getting network from gcp,Not Found
name: test-2
permittedActions:
- DELETE_CONNECTION
stackType: IPV4_ONLY
state: CREATE_VLAN_ATTACHMENT_FAILED
status: INACTIVE
tenantCount: 0
updateTime: 1758576779732
- cloudProvider: GCP
id: 9fbb3e68-1760-4447-a8fa-381a28208477
name: sp-auto-pt
partnerEmail: sp@example.com
partnerName: equinix
permittedActions: []
region: europe-southwest1
regionDisplayName: Andorra
rootTsgId: '1669501385'
status: DELETING
tenantActivationCount: 0
tenantId: '1033430256'
tenantType: MT_CHILD
tsgId: '1021202872'
type: PARTNER
usage: PER_TENANT
requestId: f6d99966-f98e-484d-a4f2-74237eaf79ab
Get AWS interconnects:
value:
data:
- cloudProvider: AWS
id: 424f9837-68b3-11f0-92e9-4201ac16024e
name: aws-ic-east
partnerEmail: ops@company.com
partnerName: company-ops
permittedActions:
- DELETE_BACKBONE
region: us-east-1
regionDisplayName: US East
status: ACTIVE
tenantActivationCount: 5
tenantType: MT_ROOT
tsgId: '1669501385'
type: PARTNER
usage: SHARED
vlanAttachments:
- awsAccountId: '123456789012'
awsConnectionName: dx-connection-1
bandwidth: BPS_1G
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
bgpPeerMd5AuthEnabled: true
createTime: 1758576695376
edgeAvailability: AVAILABILITY_DOMAIN_1
id: aa465af0-d241-4097-8ee6-31b1c29924f7
name: aws-vlan-1
permittedActions:
- DELETE_CONNECTION
stackType: IPV4_ONLY
state: ACTIVE
status: ACTIVE
tenantCount: 3
updateTime: 1758576695404
requestId: b66e6d42-0af3-4b92-8ef9-1be242ded8f3
'500':
description: Server Error
operationId: GetMtSp-interconnectInterconnects
post:
tags:
- Interconnect
summary: Create New Interconnect
description: Provision a top-level Interconnect resource to serve as the logical container for all subsequent virtual connectivity. This resource creates a private bridge between a Service Provider and Prisma Access to bypass public internet routes. Initialize this when onboarding a new region or establishing isolated per-tenant infrastructure for high-compliance environments. Provide the cloud provider, region, and usage model (SHARED or PER_TENANT) along with partner contact details to begin the automated setup process.
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InterconnectRequest'
examples:
Create GCP Partner Interconnect:
value:
name: new-ic
region: us-west2
partnerName: acme
partnerEmail: acme@abc.com
usage: SHARED
cloudProvider: GCP
type: PARTNER
vlanAttachment:
name: test
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: false
Create AWS Partner Interconnect:
value:
name: aws-ic
region: us-east-1
partnerName: equinix
partnerEmail: sp@equinix.com
usage: SHARED
cloudProvider: AWS
type: PARTNER
vlanAttachment:
name: aws-conn-1
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
bgpPeerBfdMinTransmitInterval: 1000
bgpPeerBfdMinReceiveInterval: 1000
bgpPeerBfdMultiplier: 5
Create GCP Dedicated Interconnect:
value:
name: ded-ic
region: us-west2
partnerName: datacenter-ops
partnerEmail: ops@datacenter.com
usage: SHARED
cloudProvider: GCP
type: DEDICATED
vlanAttachment:
name: ded-vlan-1
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: ACTIVE
bandwidth: BPS_10G
bgpPeerMd5AuthEnabled: true
dedicatedConnectionDetails:
- edgeAvailability: ZONE1
bandwidth: BPS_10G
- edgeAvailability: ZONE2
bandwidth: BPS_10G
Create Per-Tenant Interconnect:
value:
name: tenant-ic
region: europe-west1
partnerName: tenant-partner
partnerEmail: partner@tenant.com
usage: PER_TENANT
tsgId: '1021202872'
cloudProvider: GCP
type: PARTNER
vlanAttachment:
name: tenant-conn
bgpPeerAsn: 65100
bgpPeerBfdSessionInitMode: DISABLED
Create Interconnect with Custom IP Addresses:
value:
name: custom-ip-ic
region: us-west2
partnerName: service-provider
partnerEmail: sp@example.com
usage: SHARED
cloudProvider: GCP
type: PARTNER
vlanAttachment:
name: custom-vlan
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: false
primaryAttachmentCustomIpAddress:
candidateCloudRouterIpAddress: 169.254.1.1/29
candidateCustomerRouterIpAddress: 169.254.1.2/29
redundantAttachmentCustomIpAddress:
candidateCloudRouterIpAddress: 169.254.2.1/29
candidateCustomerRouterIpAddress: 169.254.2.2/29
required: true
responses:
'200':
description: Success
content:
application/json:
examples:
Add an interconnect:
value:
data:
cloudProvider: GCP
id: 1689a56a-9386-40b5-aa9a-0cebad2650d8
name: new-ic
partnerEmail: acme@abc.com
partnerName: acme
permittedActions: []
region: us-west2
regionDisplayName: US Southwest
status: INACTIVE
tenantActivationCount: 0
tenantType: MT_ROOT
tsgId: '1669501385'
type: PARTNER
usage: SHARED
vlanAttachments:
- bfdEnabled: false
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758576695376
edgeAvailability: AVAILABILITY_DOMAIN_1
id: aa465af0-d241-4097-8ee6-31b1c29924f7
name: test-1
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758576695404
- bfdEnabled: false
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758576695399
edgeAvailability: AVAILABILITY_DOMAIN_2
id: d06a04c9-b6aa-4e40-8722-cfee46fc786c
name: test-2
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758576695404
requestId: ae1dcb52-7086-4e18-a5a8-8ef8b991c585
'400':
description: Bad Request
content:
application/json:
examples:
Add an interconnect with invalid payload:
value:
error:
errorCode: 52046
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Connection input region unsupported
requestId: 3c84be78-eee9-4751-ba03-91759a6e9321
Invalid interconnect name:
value:
error:
errorCode: 52051
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Name must be lowercase letters,numbers or hyphens; max length 13 characters
requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
BGP ASN 16550 not allowed:
value:
error:
errorCode: 52028
errorType: VALIDATION_ERROR
httpStatus: 400
msg: BGP Peer ASN with value 16550 is not allowed
requestId: b2c3d4e5-6f78-9012-bcde-f12345678901
Missing VPC association:
value:
error:
errorCode: 52003
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Missing VPC association entry for tenant
requestId: c3d4e5f6-7890-1234-cdef-012345678901
'409':
description: Conflict
content:
application/json:
examples:
Interconnect already exists:
value:
error:
errorCode: 52004
errorType: VALIDATION_ERROR
httpStatus: 409
msg: Interconnect with same usage/cloud_provider/region already exists
requestId: d4e5f678-9012-3456-def0-123456789012
Interconnect name exists:
value:
error:
errorCode: 52049
errorType: VALIDATION_ERROR
httpStatus: 409
msg: Interconnect with same name already exists
requestId: e5f67890-1234-5678-ef01-234567890123
'500':
description: Server Error
content:
application/json:
examples:
Add backbone failed due to internal error:
value:
error:
errorCode: 50002
errorType: INTERNAL_ERROR
httpStatus: 500
msg: Failed to add Backbone in db
requestId: 432568e0-05e2-4baa-8595-ed6bb4f98b64
operationId: PostMtSp-interconnectInterconnects
/mt/sp-interconnect/interconnects/summary:
get:
tags:
- Interconnect
summary: Summarize All Interconnects
description: View a high-level statistical snapshot of the current Interconnect ecosystem. This summary provides active/inactive counts, total IP Address pool usage, and bandwidth distribution across cloud providers. Utilize this for executive summaries or operational dashboards to monitor global health at a glance. Filtering by usage type allows you to isolate metrics for SHARED versus PER_TENANT deployment models.
parameters:
- name: usage
in: query
schema:
$ref: '#/components/schemas/InterconnectUsage'
responses:
'200':
description: Success
content:
application/json:
examples:
Get interconnect summary:
value:
data:
- active: 4
bandwidth: 20Mbps
cloudProvider: GCP
inactive: 2
ipPoolCount: 1
requestId: b66e6d42-0af3-4b92-8ef9-1be242ded8f3
'400':
description: Bad Request
'500':
description: Server Error
operationId: GetMtSp-interconnectInterconnectsSummary
/mt/sp-interconnect/interconnects/{interconnectId}:
get:
tags:
- Interconnect
summary: Retrieve Specific Interconnect
description: Fetch the full configuration data and current operational state of a single Interconnect container. This reveals regional placement, current status, and the collection of virtual circuits (VlanAttachments) grouped within the Interconnect. Use this when diagnosing regional connectivity issues or retrieving internal IDs for sub-resource management. The response details cloud-specific parameters and optional data regarding tenants currently utilizing the resource.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
- name: includeTenantsAssociated
in: query
schema:
type: boolean
responses:
'200':
description: Success
content:
application/json:
examples:
Get interconnects by id:
value:
data:
cloudProvider: GCP
id: 1689a56a-9386-40b5-aa9a-0cebad2650d8
name: new-ic
partnerEmail: acme@abc.com
partnerName: acme
permittedActions: []
region: us-west2
regionDisplayName: US Southwest
status: INACTIVE
tenantActivationCount: 0
tenantType: MT_ROOT
tsgId: '1669501385'
type: PARTNER
usage: SHARED
vlanAttachments:
- bfdEnabled: false
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758576695376
edgeAvailability: AVAILABILITY_DOMAIN_1
id: aa465af0-d241-4097-8ee6-31b1c29924f7
msg: Error getting network from gcp,Not Found
name: test-1
permittedActions: []
stackType: IPV4_ONLY
state: DELETING
status: INACTIVE
tenantCount: 0
updateTime: 1758577091897
- bfdEnabled: false
bgpPeerAsn: 9493
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758576695399
edgeAvailability: AVAILABILITY_DOMAIN_2
id: d06a04c9-b6aa-4e40-8722-cfee46fc786c
msg: Error getting network from gcp,Not Found
name: test-2
permittedActions:
- DELETE_CONNECTION
stackType: IPV4_ONLY
state: CREATE_VLAN_ATTACHMENT_FAILED
status: INACTIVE
tenantCount: 0
updateTime: 1758576779732
requestId: 18b1bf70-8b07-42e2-907d-10365382dc63
'404':
description: Not Found
content:
application/json:
examples:
Get interconnect by Id, interconnect not found:
value:
error:
errorCode: 52008
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Interconnect not found
requestId: d1c5b994-3ce5-4011-acff-498a2080535c
'400':
description: Bad Request
'500':
description: Server Error
operationId: GetMtSp-interconnectInterconnectsBy_interconnectid
delete:
summary: Delete Interconnect by ID
description: Permanently remove an Interconnect and its associated configuration from the environment. This retirees the bridge once all virtual attachments have been deleted and egress traffic has been rerouted. Execute this only when a regional Interconnect is no longer required for egress traffic. Success removes the resource from the database and ends its logical association with the Prisma Access backend.
tags:
- Interconnect
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
examples:
Delete Interconnect:
value:
data: Successfully Deleted Backbone
requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9
'400':
description: Bad Request
'404':
description: Not Found
content:
application/json:
examples:
Delete Interconnect not found:
value:
error:
errorCode: 52008
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Interconnect not found
requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94
'500':
description: Server Error
operationId: DeleteMtSp-interconnectInterconnectsBy_interconnectid
/mt/sp-interconnect/regions:
get:
tags:
- Interconnect
summary: List of Regions and Edge Locations
description: Fetch the master list of all geographical regions and edge locations supported by the SP Interconnect service. This assists in network planning by identifying optimal locations for Interconnect placement. Consult this data to determine the closest edge location to your physical infrastructure for low-latency traffic egress. The response is dynamically filtered based on the cloudProvider to ensure regional compatibility.
parameters:
- name: cloudProvider
in: query
schema:
$ref: '#/components/schemas/CloudProvider'
responses:
'200':
description: Success
content:
application/json:
examples:
Get IP Pool regions/edge locations:
value:
data:
- edge_locations:
- display_name: US Southwest
edge_location: us-west-201
- display_name: US West
edge_location: us-west-1
compute_region: us-west2
theater: North Americas
- edge_locations:
- display_name: US Central West
edge_location: us-west-3
compute_region: us-west3
theater: North Americas
requestId: e459bba9-ca17-4bfa-a55a-f7305a7e8f75
operationId: GetMtSp-interconnectRegions
/mt/sp-interconnect/regions/physical-connections:
get:
tags:
- Interconnect
summary: List of Physical Connection Regions in GCP
description: Retrieve the specific regions and colocation facilities available for physical interconnect deployments on the GCP network. This informs network engineers of the precise locations where high-speed physical links can be provisioned. Use this when developing a dedicated physical connectivity strategy for large-scale multi-tenant environments. The data provides a hierarchy of continents, cities, and specific facility names.
responses:
'200':
description: Success
content:
application/json:
examples:
Get regions for Physical Interconencts in GCP:
value:
data:
regions:
- cities:
- coloFacilities:
- address: 'Cologix, Inc.
1050 W Pender Street
Vancouver, V6E 3S7
Canada
'
city: Vancouver
continent: C_NORTH_AMERICA
description: Cologix VAN2
status: AVAILABLE
zones:
- availabilityZone: zone1
facilityProvider: Cologix
facilityProviderFacilityId: Cologix
id: 1377
name: yvr-zone1-1881
peeringdbFacilityId: '1881'
selfLink: https://www.googleapis.com/compute/v1/projects/host-gpcs-dev-01/global/interconnectLocations/yvr-zone1-1881
status: AVAILABLE
- availabilityZone: zone2
facilityProvider: Cologix
facilityProviderFacilityId: Cologix
id: 1378
name: yvr-zone2-1881
peeringdbFacilityId: '1881'
selfLink: https://www.googleapis.com/compute/v1/projects/host-gpcs-dev-01/global/interconnectLocations/yvr-zone2-1881
status: AVAILABLE
name: Vancouver
region: C_NORTH_AMERICA
requestId: 709de72e-8004-41c8-9dc5-9d9b852876c4
operationId: GetMtSp-interconnectRegionsPhysical-connections
/mt/sp-interconnect/settings:
post:
tags:
- Interconnect
summary: Configure Egress Settings
description: Apply traffic routing preferences and egress behavior for a specific Tenant Service Group (TSG). This determines whether egress traffic utilizes the private Service Provider (SP) path or the standard Prisma Access (PA) path. Set this during tenant onboarding or when modifying existing regional traffic policies. If SP egress is selected, you must specify the CIDR ranges that should participate in the private routing.
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SettingsEntry'
examples:
Set SP egress type with CIDRs:
value:
egressType: SP
cidr:
- 2.1.1.1/29
- 3.2.2.2/29
Set PA egress type:
value:
egressType: PA
required: true
responses:
'200':
description: Success
content:
application/json:
examples:
Update Egress type and cidr:
value:
data:
cidr:
- 2.1.1.1/29
- 3.2.2.2/29
egressType: SP
requestId: 996e250d-e1bc-4499-a408-7ccbfdda0368
'400':
description: Bad Request
content:
application/json:
examples:
Update Egress type and cidr failed on not vpc entry:
value:
error:
errorCode: 52003
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Missing VPC association entry for tenant
requestId: c33354e9-6fd0-491d-9dac-010240132fed
'409':
description: Conflict
operationId: PostMtSp-interconnectSettings
get:
summary: Get Egress Settings
description: View the current egress and routing configuration for the authenticated tenant context. This verifies whether the tenant is currently utilizing the SP Interconnect or the default public path for their egress traffic. Access this to validate that your network architecture policies have been correctly applied at the management plane. The response provides the egress type and all participating CIDR blocks.
tags:
- Interconnect
responses:
'200':
description: Success
content:
application/json:
examples:
Get Egress type and cidr:
value:
data:
cidr:
- 3.2.2.2/29
- 2.1.1.1/29
egressType: SP
requestId: d10ee1b0-b8ed-461b-af14-dfad5a782dc5
'400':
description: Bad Request
content:
application/json:
examples:
Get Egress type and cidr failed on not vpc entry:
value:
error:
errorCode: 52030
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Tenant does not have shared vpc assigned
requestId: 130cb837-b3d8-43af-b15f-cd60724cab8d
'404':
description: Not Found
operationId: GetMtSp-interconnectSettings
components:
schemas:
CloudProvider:
type: string
enum:
- GCP
- AWS
SessionInitializationMode:
type: string
enum:
- ACTIVE
- PASSIVE
- DISABLED
IPBlockEntry:
type: object
required:
- cidr
properties:
edgeLocation:
type: string
cidr:
type: array
minItems: 1
uniqueItems: true
items:
type: string
type:
$ref: '#/components/schemas/IPBlockType'
ConnectionType:
type: string
enum:
- DEDICATED
- PARTNER
InterconnectUsage:
type: string
enum:
- SHARED
- PER_TENANT
IPProvider:
type: string
enum:
- SP
- PANW
VlanAttachmentRequest:
type: object
required:
- name
- bgpPeerAsn
- bgpPeerBfdSessionInitMode
properties:
name:
type: string
pattern: ^([-0-9a-z]){1,13}$
stackType:
$ref: '#/components/schemas/StackType'
bandwidth:
$ref: '#/components/schemas/Bandwidth'
bgpPeerAsn:
type: integer
format: int64
minimum: 1
bgpPeerBfdSessionInitMode:
$ref: '#/components/schemas/SessionInitializationMode'
bgpPeerBfdMinTransmitInterval:
type: integer
format: int64
maximum: 30000
minimum: 1000
bgpPeerBfdMinReceiveInterval:
type: integer
format: int64
maximum: 30000
minimum: 1000
bgpPeerBfdMultiplier:
type: integer
format: int64
maximum: 16
minimum: 5
dedicatedConnectionDetails:
type: array
items:
$ref: '#/components/schemas/DedicatedVlanAttachmentDetailsEntry'
primaryAttachmentCustomIpAddress:
$ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
redundantAttachmentCustomIpAddress:
$ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
bgpPeerMd5AuthEnabled:
type: boolean
InterconnectRequest:
type: object
required:
- name
- region
- partnerName
- partnerEmail
- usage
- cloudProvider
- type
# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-interconnect-api-openapi.yml