Palo Alto Networks

Palo Alto Networks IP Allowlist API

Manage a list of trusted IP addresses with respect to alerts and a list of trusted login IP addresses.

GitHub OpenAPI

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /allow_list/network List trusted public networks · List Networks #
Ask an LLM
“Which public networks are on my trusted IP allow list?”
“What trusted networks has my tenant defined for alerting?”
Tell an agent
List all trusted public networks.
Show my allow list networks.
POST /allow_list/network Add a trusted public network · Add Network #
Ask an LLM
“How do I add a new trusted network to the IP allow list?”
“Does a newly created trusted network start with any CIDR blocks?”
Tell an agent
Create a trusted network named {name}.
Add public network {name} to the allow list.
GET /allow_list/network/{networkUuid} Get a trusted network · Network Info #
Ask an LLM
“What CIDRs are in a specific trusted network?”
“Can I look up one allow list network by its ID?”
Tell an agent
Get trusted network {networkUuid}.
Show the details of allow list network {networkUuid}.
PUT /allow_list/network/{networkUuid} Rename a trusted network · Rename Network #
Ask an LLM
“Can I rename a trusted network without recreating it?”
“Is it possible to change the label on an existing allow list network?”
Tell an agent
Rename trusted network {networkUuid} to {name}.
Change the name of network {networkUuid} to {name}.
POST /allow_list/network/{networkUuid}/cidr Add a CIDR block to a trusted network · Add CIDR #
Ask an LLM
“How do I add an IP range to one of my trusted networks?”
“Can a new CIDR block overlap ranges in my other trusted networks?”
Tell an agent
Add CIDR {cidr} to trusted network {networkUuid}.
Add range {cidr} with description {description} to network {networkUuid}.
PUT /allow_list/network/{networkUuid}/cidr/{cidrUuid} Update a CIDR block in a trusted network · Update CIDR #
Ask an LLM
“Can I change an existing CIDR range in a trusted network?”
“What happens to the description if I send it blank when editing a CIDR block?”
Tell an agent
Change CIDR {cidrUuid} in network {networkUuid} to {cidr}.
Update the description of CIDR block {cidrUuid} in network {networkUuid} to {description}, keeping range {cidr}.
DELETE /allow_list/network/{networkUuid}/cidr/{cidrUuid} Remove a CIDR block from a trusted network · Delete CIDR #
Ask an LLM
“How do I drop an IP range from a trusted network?”
“Can I delete one CIDR block without removing the whole network?”
Tell an agent destructive · confirm first
Delete CIDR {cidrUuid} from network {networkUuid}.
Remove range {cidrUuid} from trusted network {networkUuid}.
GET /ip_allow_list_login List login IP allow lists · List Login IP Allow Lists #
Ask an LLM
“Which IP ranges are allowed to log in to my Prisma Cloud tenant?”
“What named login allow lists do we have?”
Tell an agent
List all login IP allow lists.
Show every CIDR allowed for tenant login.
POST /ip_allow_list_login Add a login IP allow list · Add Login IP Allow List #
Ask an LLM
“How many CIDRs can I put in a single login allow list?”
“Can I restrict console login to our office IP ranges?”
Tell an agent
Create login allow list {name} with CIDRs {cidr}.
Allow login from {cidr} under a new list called {name}.
GET /ip_allow_list_login/{id} Get a login IP allow list · Get Login IP Allow List #
Ask an LLM
“What CIDRs are in one particular login allow list?”
“Can I look up a single login IP allow list by ID?”
Tell an agent
Get login IP allow list {id}.
Show the CIDRs in login allow list {id}.
PUT /ip_allow_list_login/{id} Update a login IP allow list · Update Login IP Allow List #
Ask an LLM
“Can I replace the CIDRs in an existing login allow list?”
“Is it possible to rename a login IP allow list?”
Tell an agent
Set login allow list {id} to CIDRs {cidr}, keeping name {name}.
Rename login allow list {id} to {name} with CIDRs {cidr}.
DELETE /ip_allow_list_login/{id} Delete a login IP allow list · Delete Login IP Allow List #
Ask an LLM
“Why can't I delete my last login allow list entry?”
“How do I remove a named login IP allow list?”
Tell an agent destructive · confirm first
Delete login IP allow list {id}.
Remove login allow list {id} from the tenant.
GET /ip_allow_list_login/status Check if login IP allow listing is on · Get Login IP Allow List Status #
Ask an LLM
“Is the login IP allow list currently enforced on my tenant?”
“Are logins restricted by IP right now?”
Tell an agent
Check whether the login IP allow list is enabled.
Tell me if login IP restriction is on.
PATCH /ip_allow_list_login/status Turn login IP allow listing on or off · Update Login IP Allow List Status #
Ask an LLM
“Can I switch on login IP restriction for the whole tenant?”
“What's the call to temporarily disable the login allow list?”
Tell an agent
Enable the login IP allow list.
Disable login IP allow list enforcement.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-ip-allowlist-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-ip-allowlist-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-ip-allowlist-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact: {}
  description: 'Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only

    the System Admin has API access and can enable API access for other administrators. If you have API access,

    you can create up to two access keys. Create an access key for a limited time period and regenerate your API

    keys periodically to minimize exposure and follow security best practices.'
  title: Prisma Cloud Access Keys API Overview IP Allow List API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- description: Manage a list of trusted IP addresses with respect to alerts and a list of trusted login IP addresses.
  name: IP Allowlist
paths:
  /allow_list/network:
    get:
      description: Returns an array of public networks.
      operationId: get-networks-list
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/PublicNetwork'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Networks
      tags:
      - IP Allowlist
    post:
      description: 'Adds a public network.


        The resulting new network does not have any CIDR blocks, so none will be in the response object. You can add a CIDR to the network with Add CIDR'
      operationId: add-a-network
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetwork'
        description: Model for Public Network
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetwork'
          description: successful operation
        '400':
          description: invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add Network
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}:
    get:
      description: Returns the public network with the specified network ID.
      operationId: get-network-info
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetwork'
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Network Info
      tags:
      - IP Allowlist
    put:
      description: Renames an existing network.
      operationId: rename-a-network
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetwork'
        description: Model for Public Network
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Rename Network
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}/cidr:
    post:
      description: Adds a new CIDR block. The CIDR block cannot overlap CIDR blocks that already exist in the networks you manage. Also, IP addresses in the CIDR block must be routable to the public internet.
      operationId: add-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetworkCidrBlock'
        description: Model for Public Network CIDR Block
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetworkCidrBlock'
          description: successful operation
        '400':
          description: invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add CIDR
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}/cidr/{cidrUuid}:
    put:
      description: 'Updates an existing CIDR block.


        Note that the value for the request body parameter **description** will update the description for the CIDR block, even if the **description**

        value is blank. Providing a blank description will remove an existing CIDR block description.'
      operationId: update-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      - description: CIDR ID
        in: path
        name: cidrUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetworkCidrBlock'
        description: Model for Public Network CIDR Block
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Update CIDR
      tags:
      - IP Allowlist
    delete:
      description: Deletes an existing CIDR block.
      operationId: delete-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      - description: CIDR ID
        in: path
        name: cidrUuid
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Delete CIDR
      tags:
      - IP Allowlist
  /ip_allow_list_login:
    get:
      description: Returns a list of data objects that contain the CIDRs in the allow list to access the Prisma Cloud tenant.
      operationId: list-login-ip-allow-lists
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/LoginIpAllowListData'
                type: array
          description: successful operation
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Login IP Allow Lists
      tags:
      - IP Allowlist
    post:
      description: Adds a named list of CIDRs (IP addresses) that are in the allow list to access Prisma Cloud. You can add up to 10 CIDRs per named list, and there can be up to 50 named lists.
      operationId: insert-login-ip-allow-list
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IpAllowListParams'
        description: Model for login IP allow list parameters
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '400':
          description: login_ip_allow_list_invalid_cidr_format / login_ip_allow_list_missing_cidr_field / login_ip_allow_list_size_exceeded / login_ip_allow_list_cidr_list_size_exceeded
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '409':
          description: login_ip_allow_list_duplicate_key
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add Login IP Allow List
      tags:
      - IP Allowlist
  /ip_allow_list_login/{id}:
    get:
      description: Returns a data object that contains a list of CIDRs that are in allow list for login access, for the specified login IP allow list ID.
      operationId: get-login-ip-allow-list
      parameters:
      - description: Login IP Allow List ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Login IP Allow List
      tags:
      - IP Allowlist
    put:
      description: Updates a named list of CIDRs (IP addresses) that are in the allow list for login access.
      operationId: update-login-ip-allow-list
      parameters:
      - description: ID of named network
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IpAllowListParams'
        description: Model for login IP allow list parameters
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '400':
          description: login_ip_allow_list_invalid_cidr_format / login_ip_allow_list_missing_cidr_field / login_ip_allow_list_enable_not_allowed_ip_absent / login_ip_allow_list_not_allowed_ip_present
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '409':
          description: login_ip_allow_list_duplicate_name
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Login IP Allow List
      tags:
      - IP Allowlist
    delete:
      description: Deletes a named list of CIDRs that are in the allow list for login access. If only one allow list entry exists, you will not be able to delete it while the login IP allow list is enabled.
      operationId: delete-login-ip-allow-list
      parameters:
      - description: ID of named network
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: login_ip_allow_list_not_allowed_ip_absent / login_ip_allow_list_size_only_one_entry / login_ip_allow_list_not_allowed_ip_present
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Delete Login IP Allow List
      tags:
      - IP Allowlist
  /ip_allow_list_login/status:
    get:
      description: Indicates whether or not the login IP allow list is enabled.
      operationId: get-login-ip-allow-list-status
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties:
                  type: boolean
                type: object
          description: successful operation
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Login IP Allow List Status
      tags:
      - IP Allowlist
    patch:
      description: Enable or disable the login IP allow list.
      operationId: update-login-ip-allow-list-status
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: 'The property name is **enabled**. Valid values are **true**, **false**. JSON example: {"enabled":false}'
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: login_ip_allow_list_enable_not_allowed_ip_absent / login_ip_allow_list_enable_not_allowed_empty_list
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Login IP Allow List Status
      tags:
      - IP Allowlist
components:
  schemas:
    LoginIpAllowListData:
      description: Model for login IP allow list data
      properties:
        cidr:
          description: List of CIDR blocks (IP addresses) from which access is allowed when Login IP Allow List is enabled.
          items:
            type: string
          type: array
        description:
          description: Description
          type: string
        id:
          description: Login IP allow list ID
          type: string
        lastModifiedTs:
          description: Timestamp for last modification of CIDR block list
          format: int64
          type: integer
        name:
          description: Name of the list of CIDR blocks that are in allow list for access
          type: string
      type: object
    PublicNetworkCidrBlock:
      properties:
        cidr:
          description: Valid CIDR. CIDR must be of the form [0-255].[0-255].[0-255].[0-255]/[1-32], must not have non-zero bits right of the netmask, and must not overlap any of the RFC 1918 defined private networks.
          type: string
        createdOn:
          description: Created On
          format: int64
          readOnly: true
          type: integer
        description:
          description: Description
          type: string
        uuid:
          description: CIDR ID
          readOnly: true
          type: string
      required:
      - cidr
      type: object
    PublicNetwork:
      properties:
        cidrs:
          description: CIDRs
          items:
            $ref: '#/components/schemas/PublicNetworkCidrBlock'
          readOnly: true
          type: array
        name:
          description: Network Name
          type: string
        uuid:
          description: Network ID
          readOnly: true
          type: string
      required:
      - name
      type: object
    IpAllowListParams:
      description: Model for login IP allow list parameters
      properties:
        cidr:
          description: List of CIDRs to Allow List for login access. You can include from 1 to 10 CIDRs
          items:
            type: string
          type: array
        description:
          description: Description of CIDR (IP addresses) allow list
          type: string
        name:
          description: Unique name for CIDR (IP addresses) allow list
          type: string
      required:
      - cidr
      - name
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey