Palo Alto Networks

Palo Alto Networks Issuer Sub CA Providers API

APIs for Issuer Sub CA Providers.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 5

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /v1/distributedissuers/subcaproviders Create a subordinate CA provider · Create a new Sub CA provider #
Ask an LLM
“How do I set up a new subordinate CA provider for distributed issuers?”
“What key algorithm and validity period does a sub CA provider need?”
Tell an agent
Create sub CA provider {name} for {commonName} with key algorithm {keyAlgorithm} valid for {validityPeriod}.
Set up a {caType} sub CA provider on CA account {caAccountId} with product option {caProductOptionId}.
GET /v1/distributedissuers/subcaproviders List subordinate CA providers · Get the details of all Sub #
Ask an LLM
“Which subordinate CA providers are set up for distributed issuance?”
“What sub CA providers do I have and how are they configured?”
Tell an agent
List all subordinate CA providers.
Show every sub CA provider for my distributed issuers.
GET /v1/distributedissuers/subcaproviders/{id} Get a subordinate CA provider · Get a Sub CA provider details #
Ask an LLM
“What are the settings of one specific sub CA provider?”
“Can I look up a subordinate CA provider by ID?”
Tell an agent
Show sub CA provider {id}.
Get details of subordinate CA provider {id}.
PATCH /v1/distributedissuers/subcaproviders/{id} Update a subordinate CA provider · Update a Sub CA provider details #
Ask an LLM
“Can I change just the validity period on an existing sub CA provider?”
“Which sub-tenants can I share an existing subordinate CA provider with?”
Tell an agent
Set validity period {validityPeriod} on sub CA provider {id}.
Share subordinate CA provider {id} with sub-tenants {sharedWithSubTsgIds}.
DELETE /v1/distributedissuers/subcaproviders/{id} Delete a subordinate CA provider · Remove a Sub CA provider #
Ask an LLM
“How do I remove a subordinate CA provider?”
“Is deleting a sub CA provider permanent?”
Tell an agent destructive · confirm first
Delete sub CA provider {id}.
Remove the retired subordinate CA provider {id}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-issuer-sub-ca-providers-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-issuer-sub-ca-providers-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-issuer-sub-ca-providers-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Issuer Sub…
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Issuer Sub CA Providers
  description: APIs for Issuer Sub CA Providers.
paths:
  /v1/distributedissuers/subcaproviders:
    post:
      description: Creates a sub ca provider
      operationId: subcaproviders_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubCaProviderCreateRequest'
        description: Details of the new sub CA provider.
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Sub CA Provider was created; details in response body;
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Create a new Sub CA provider
      tags:
      - Issuer Sub CA Providers
    get:
      description: Returns a list of all the subordinate CA providers along with their details.
      operationId: subcaprovider_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderResponse'
          description: All Sub CA providers with details.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get the details of all Sub
      tags:
      - Issuer Sub CA Providers
  /v1/distributedissuers/subcaproviders/{id}:
    get:
      description: Retrieves the details of the subordinate CA provider that has the specified `id`.
      operationId: subcaproviders_getById
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Specified sub CA provider found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Get a Sub CA provider details
      tags:
      - Issuer Sub CA Providers
    patch:
      description: Updates (replaces) details of the subordinate CA provider that has the specified `id`. Only fields specified in the request will be updated.
      operationId: subcaproviders_update
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubCaProviderUpdateRequest'
        description: Sub CA provider's details to update.
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderInformation'
          description: Sub CA provider updated; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified Sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Update a Sub CA provider details
      tags:
      - Issuer Sub CA Providers
    delete:
      description: Deletes the subordinate CA provider that has the specified `id`.
      operationId: subcaproviders_delete
      parameters:
      - description: Sub CA provider UUID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubCaProviderDeleteResponse'
          description: Specified Sub CA provider was deleted.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Specified sub CA provider was not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse7'
          description: Incomplete or malformed request.
      summary: Remove a Sub CA provider
      tags:
      - Issuer Sub CA Providers
components:
  schemas:
    SubCaProviderPkcs11ConfigurationInformation:
      properties:
        allowedClientLibraries:
          description: A collection of strings each of which represents SHA256 hash of an allowed HSM client library
          example:
          - c34d199f2e30bb679cd9b8533b99975465aefe8b023be1b37972f1ab43ab7b2d
          items:
            type: string
          type: array
        partitionLabel:
          description: HSM Partition Label
          example: workload-identity-manager-hsm-partition
          type: string
        partitionSerialNumber:
          description: HSM Partition Serial Number
          example: '1444210958933'
          pattern: ^[A-Fa-fx0-9]{0,18}$
          type: string
        pin:
          description: HSM PIN
          example: '1234'
          type: string
          writeOnly: true
        signingEnabled:
          description: Indicates whether HSM signing is enabled or not
          example: true
          type: boolean
      type: object
    SubCaProviderCreateRequest:
      properties:
        caAccountId:
          description: UUID of the CA account used by this Sub CA provider
          example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
          format: uuid
          type: string
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        caType:
          description: Type of CA this Sub CA provider works with
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          example: BUILTIN
          type: string
        commonName:
          description: Common name
          example: example.com
          maxLength: 64
          type: string
        country:
          description: Country
          example: US
          maxLength: 64
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          maxLength: 64
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA provider
          maxLength: 64
          type: string
        organization:
          description: Organization
          example: Some organization
          maxLength: 64
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          maxLength: 64
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        stateOrProvince:
          description: State or province
          example: Texas
          maxLength: 64
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      required:
      - caAccountId
      - caProductOptionId
      - caType
      - commonName
      - keyAlgorithm
      - name
      - validityPeriod
      type: object
    SubCaProviderResponse:
      properties:
        subCaProviders:
          items:
            $ref: '#/components/schemas/SubCaProviderInformation'
          type: array
      type: object
    ErrorResponse7:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation7'
          type: array
      type: object
    SubCaProviderUpdateRequest:
      properties:
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        commonName:
          description: Common name
          example: example.com
          maxLength: 64
          type: string
        country:
          description: Country
          example: US
          maxLength: 64
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          maxLength: 64
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA
          maxLength: 64
          type: string
        organization:
          description: Organization
          example: Some organization
          maxLength: 64
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          maxLength: 64
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Share with all sub-TSGs
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Specific sub-TSG IDs to share with
            example: '["1378242802","1896239460"]'
            type: string
          type: array
        stateOrProvince:
          description: State or province
          example: Texas
          maxLength: 64
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: PnYnMnDTnHnMnS
          type: string
      type: object
    SubCaProviderInformation:
      properties:
        caAccountId:
          description: UUID of the CA account used by this Sub CA provider
          example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
          format: uuid
          type: string
        caProductOptionId:
          description: UUID of the CA product option used by this Sub CA provider
          example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
          format: uuid
          type: string
        caType:
          description: Type of CA this Sub CA provider works with
          enum:
          - MOCKCA
          - DIGICERT
          - GLOBALSIGN
          - BUILTIN
          - ENTRUST
          - MICROSOFT
          - ACME
          - ZTPKI
          - GLOBALSIGNMSSL
          - TPP
          example: BUILTIN
          type: string
        commonName:
          description: Common name
          example: example.com
          type: string
        companyId:
          description: UUID specific to your company
          example: 03eb6e61-9806-11ed-84f2-c747fb71e467
          format: uuid
          type: string
        country:
          description: Country
          example: US
          type: string
        creationDate:
          description: When the Sub CA provider was initially created
          example: '2022-10-10T14:50:41.710+00:00'
          type: string
        id:
          description: UUID of the Sub CA provider
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
        keyAlgorithm:
          description: Key algorithm type
          enum:
          - RSA_2048
          - RSA_3072
          - RSA_4096
          - EC_P256
          - EC_P384
          - EC_P521
          - EC_ED25519
          example: EC_P256
          type: string
        locality:
          description: Locality
          example: San Antonio
          type: string
        modificationDate:
          description: When the Sub CA provider was last modified
          example: '2023-12-12T20:00:10.500+00:00'
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA provider
          type: string
        organization:
          description: Organization
          example: Some organization
          type: string
        organizationalUnit:
          description: Organizational unit
          example: Some organizational unit
          type: string
        pkcs11:
          $ref: '#/components/schemas/SubCaProviderPkcs11ConfigurationInformation'
        shareWithAll:
          description: Shared with all sub-TSGs
          example: false
          type: boolean
        sharedWithSubTsgIds:
          items:
            description: Sub-TSG IDs this SubCA provider is shared with
            type: string
          type: array
          uniqueItems: true
        stateOrProvince:
          description: State or province
          example: Texas
          type: string
        validityPeriod:
          description: ISO8601 Period Format
          example: P30D
          format: PnYnMnDTnHnMnS
          type: string
      type: object
    ErrorInformation7:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue7'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    AnyValue7:
      description: Can be any value - string, number, boolean, array or object.
    SubCaProviderDeleteResponse:
      properties:
        id:
          description: UUID of the Sub CA provider
          example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
          format: uuid
          type: string
        name:
          description: Name of the Sub CA provider
          example: Some Sub CA
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT