OpenAPI Specification
openapi: 3.2.0
info:
title: TLS Protect Cloud API for Strata Cloud Manager Machines API
description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
version: 1.0.0
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Machines
description: APIs for Machines.
paths:
/v1/machines:
get:
description: Retrieves the details of all machines.
operationId: machines_getAll
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MachinesResponse'
description: Details of Machines in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Get the details of all machines
tags:
- Machines
post:
description: Creates a machine corresponding to the specified `pluginId`.
operationId: machines_create
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MachineCreationRequest'
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineInformation'
description: Machine was created; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Add a machine
tags:
- Machines
/v1/machines/{id}:
get:
description: Retrieves the details of the machine that matches the specified `id`.
operationId: machines_getById
parameters:
- description: UUID of a Machine
in: path
name: id
required: true
schema:
description: UUID of a Machine
format: uuid
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineInformation'
description: Machine was found; details in the response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Machine not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Get a machine details
tags:
- Machines
delete:
description: Deletes a machine that has the specified `id`.
operationId: machines_delete
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
responses:
'204':
description: Machine deleted.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Request conditions failed.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Certificate installation not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Request conditions failed.
summary: Delete a machine
tags:
- Machines
patch:
description: Updates specific details of the machine that matches the specified `id`.
operationId: machines_update
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MachineUpdateRequest'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineInformation'
description: Machine was updated; details in the response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Machine not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Update a machine details
tags:
- Machines
/v1/machines/{id}/workflows:
post:
description: Triggers the beginning of the workflow.
operationId: machines_initiateWorkflow
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MachineWorkflowRequest'
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineInformation'
description: Workflow initiated successfully.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Request conditions failed.
summary: Initiate the workflow
tags:
- Machines
/v1/machinesearch:
post:
description: Retrieves the details of machines that match the specified [search expression](https://docs.venafi.cloud/CSH_api_search).
operationId: getMachinesByExpression
parameters:
- description: Indicates whether response should include nested ownership data (e.g., `owningContainers`)
in: query
name: ownershipTree
schema:
default: false
type: boolean
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MachinesSearchRequest'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineDocumentResponse'
description: Details of Machines in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Get the details of machines matching
tags:
- Machines
/v1/machines/{id}/batchprovisionings/abort:
post:
description: Triggers the abort operation on the current batch provisioning process for the machine with the specified `id`.
operationId: abort-v1-batchprovisionings-forMachineId
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
responses:
'202':
description: Batch provisioning abort success.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Operation forbidden.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Active batch provisioning not found.
'405':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Abort batch provisioning not allowed.
'500':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Internal server error.
summary: Abort active batch provisioning for a
tags:
- Machines
/v1/machines/{id}/discovery:
get:
description: Retrieves the details of the machine's discovery.
operationId: machineDiscoveryResults_getByMachineId
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineDiscoveryResultInformation'
description: Discovery result for machine was found; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: The discovery result for the machine was not found. It is possible that discovery was never initiated. Run discovery and try again.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Incomplete or malformed request.
summary: Get the discovery results for a
tags:
- Machines
/v1/machines/{id}/discovery/abort:
post:
description: Aborts an active discovery.
operationId: machineDiscoveryResults_abortdiscovery
parameters:
- description: UUID of a Machine.
in: path
name: id
required: true
schema:
description: UUID of a Machine.
format: uuid
type: string
responses:
'202':
content:
application/json:
schema:
$ref: '#/components/schemas/MachineInformation'
description: Abort discovery success.
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Operation forbidden.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Active discovery not found.
'405':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: Abort discovery not allowed.
summary: Abort machine discovery
tags:
- Machines
components:
schemas:
ErrorInformation3:
properties:
args:
items:
$ref: '#/components/schemas/AnyValue3'
type: array
code:
format: int32
type: integer
message:
type: string
type: object
Expression:
type: object
MachineOwnership:
properties:
owningTeams:
items:
format: uuid
type: string
type: array
uniqueItems: true
type: object
OrderObject:
properties:
direction:
enum:
- ASC
- DESC
type: string
field:
type: string
type: object
Ordering:
properties:
orders:
items:
$ref: '#/components/schemas/OrderObject'
type: array
type: object
MachineDiscoveryResultInformation:
properties:
certificatesCountCurrent:
format: int64
type: integer
certificatesCountTotal:
format: int64
type: integer
companyId:
format: uuid
type: string
discoveryStatus:
enum:
- NEVER INITIATED
- INITIATED
- RUNNING
- COMPLETED
- ABORTED
- ABORTING
- FAILED
type: string
endDate:
format: date-time
type: string
errorCount:
format: int32
type: integer
machineIdentitiesCount:
format: int64
type: integer
machineIdentitiesDeletedCount:
format: int64
type: integer
machineIdentitiesMissingCount:
format: int64
type: integer
startDate:
format: date-time
type: string
type: object
ErrorResponse3:
properties:
errors:
items:
$ref: '#/components/schemas/ErrorInformation3'
type: array
type: object
Paging:
properties:
pageNumber:
format: int32
type: integer
pageSize:
format: int32
type: integer
type: object
MachineDocumentInformation:
properties:
companyId:
format: uuid
type: string
creationDate:
format: date-time
type: string
id:
format: uuid
type: string
integrationId:
format: uuid
type: string
machineIdentitiesCount:
format: int32
type: integer
machineName:
type: string
machineType:
deprecated: true
type: string
machineTypeId:
deprecated: true
format: uuid
type: string
modificationDate:
format: date-time
type: string
ownership:
$ref: '#/components/schemas/MachineOwnership'
owningTeam:
format: uuid
type: string
pluginId:
format: uuid
type: string
pluginName:
type: string
status:
enum:
- DRAFT
- VERIFIED
- UNVERIFIED
- DELETING
type: string
tsgId:
type: string
type: object
MachineDocumentResponse:
properties:
machines:
items:
$ref: '#/components/schemas/MachineDocumentInformation'
type: array
totalCount:
format: int64
type: integer
type: object
MachineWorkflowRequest:
properties:
workflowInput:
$ref: '#/components/schemas/AnyValue3'
workflowName:
type: string
type: object
MachineBatchProvisioningResultInformation:
properties:
endDate:
format: date-time
type: string
errorMessage:
type: string
machineIdentitiesCount:
format: int64
type: integer
machineIdentitiesFailedCount:
format: int64
type: integer
machineIdentitiesSucceedCount:
format: int64
type: integer
startDate:
format: date-time
type: string
type:
enum:
- MANUAL
- SCHEDULED
type: string
type: object
MachinesSearchRequest:
properties:
expression:
$ref: '#/components/schemas/Expression'
ordering:
$ref: '#/components/schemas/Ordering'
paging:
$ref: '#/components/schemas/Paging'
type: object
MachineCreationRequest:
properties:
connectionDetails:
$ref: '#/components/schemas/AnyValue3'
dekId:
type: string
edgeInstanceId:
format: uuid
type: string
machineTypeId:
deprecated: true
format: uuid
type: string
name:
minLength: 1
type: string
owningTeamId:
format: uuid
type: string
pluginId:
format: uuid
type: string
status:
enum:
- DRAFT
- VERIFIED
- UNVERIFIED
- DELETING
type: string
tags:
items:
type: string
type: array
required:
- connectionDetails
- name
- pluginId
type: object
SchedulerPatternInformation2:
discriminator:
propertyName: recurrenceType
properties:
recurrenceType:
type: string
required:
- recurrenceType
type: object
MachinesResponse:
properties:
machines:
items:
$ref: '#/components/schemas/MachineInformation'
type: array
type: object
MachineUpdateRequest:
properties:
batchProvisioningSchedulerEnabled:
type: boolean
batchProvisioningSchedulerPattern:
$ref: '#/components/schemas/SchedulerPatternInformation2'
connectionDetails:
$ref: '#/components/schemas/AnyValue3'
discoveryJson:
$ref: '#/components/schemas/AnyValue3'
discoverySchedulerEnabled:
type: boolean
discoverySchedulerPattern:
$ref: '#/components/schemas/SchedulerPatternInformation2'
edgeInstanceId:
format: uuid
type: string
name:
type: string
owningTeamId:
format: uuid
type: string
status:
enum:
- DRAFT
- VERIFIED
- UNVERIFIED
- DELETING
type: string
type: object
AnyValue3:
description: Can be any value - string, number, boolean, array or object.
MachineInformation:
properties:
batchProvisioningResult:
$ref: '#/components/schemas/MachineBatchProvisioningResultInformation'
batchProvisioningSchedulerEnabled:
type: boolean
batchProvisioningSchedulerPattern:
$ref: '#/components/schemas/SchedulerPatternInformation2'
batchProvisioningStatus:
enum:
- NEVER_INITIATED
- INITIATED
- RUNNING
- COMPLETED
- ABORTED
- ABORTING
- FAILED
type: string
companyId:
format: uuid
type: string
creationDate:
format: date-time
type: string
discoveryJson:
$ref: '#/components/schemas/AnyValue3'
discoverySchedulerEnabled:
type: boolean
discoverySchedulerPattern:
$ref: '#/components/schemas/SchedulerPatternInformation2'
discoveryStatus:
enum:
- NEVER INITIATED
- INITIATED
- RUNNING
- COMPLETED
- ABORTED
- ABORTING
- FAILED
type: string
edgeInstanceId:
format: uuid
type: string
id:
format: uuid
type: string
integrationId:
format: uuid
type: string
machineType:
deprecated: true
type: string
modificationDate:
format: date-time
type: string
name:
type: string
owningTeamId:
format: uuid
type: string
pluginId:
format: uuid
type: string
status:
enum:
- DRAFT
- VERIFIED
- UNVERIFIED
- DELETING
type: string
tsgId:
type: string
type: object
securitySchemes:
scmOAuth:
type: oauth2
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
flows:
clientCredentials:
tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
scopes: {}
scmToken:
type: http
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
scheme: bearer
bearerFormat: JWT