Palo Alto Networks

Palo Alto Networks Manage NGFW API

The ManageNGFW API from Palo Alto Networks — 4 operation(s) for managengfw.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 6

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /v1/config/ngfirewalls List cloud NGFW firewalls · List firewall resources #
Ask an LLM
“Which Cloud NGFW firewalls are deployed in my account?”
“Can I list only firewalls attached to specific VPCs?”
Tell an agent
List NGFW firewalls in VPCs {VpcIds}.
Show firewalls using rulestack {RuleStackName}.
POST /v1/config/ngfirewalls Create a cloud NGFW firewall · Create firewall resource #
Ask an LLM
“How do I deploy a new Cloud NGFW firewall into my VPC?”
“Can I attach a rulestack when I create a firewall?”
Tell an agent
Create firewall {FirewallName} in VPC {VpcId} with subnets {SubnetMappings} and endpoint mode {EndpointMode}.
Deploy NGFW {FirewallName} in {VpcId}, subnets {SubnetMappings}, mode {EndpointMode}, rulestack {RuleStackName}.
DELETE /v1/config/ngfirewalls/{ngfirewallname} Delete a cloud NGFW firewall · Delete firewall resource #
Ask an LLM
“How do I tear down an NGFW firewall safely?”
“What must I change in route tables before deleting a firewall?”
Tell an agent destructive · confirm first
Delete firewall {ngfirewallname}.
Remove NGFW {ngfirewallname} from account {AccountId}.
GET /v1/config/ngfirewalls/{ngfirewallname} Get a cloud NGFW firewall · Retrieve firewall resource #
Ask an LLM
“What is the configuration of one of my NGFW firewalls?”
“Which subnets and rulestack does a named firewall use?”
Tell an agent
Get firewall {ngfirewallname}.
Show configuration for NGFW {ngfirewallname} in account {AccountId}.
PUT /v1/config/ngfirewalls/{ngfirewallname}/description Update a firewall's description · Update firewall description #
Ask an LLM
“How do I change the description on an NGFW firewall?”
“Can I relabel a firewall so it is easier to identify?”
Tell an agent
Set the description of firewall {ngfirewallname} to {Description}.
Relabel NGFW {ngfirewallname} as {Description}.
PUT /v1/config/ngfirewalls/{ngfirewallname}/subnets Change a firewall's subnet mappings · Update subnet mappings #
Ask an LLM
“How do I add a subnet to an existing NGFW firewall?”
“Can I detach a subnet from a firewall's endpoints?”
Tell an agent
Associate subnets {AssociateSubnetMappings} with firewall {ngfirewallname}.
Disassociate subnets {DisassociateSubnetMappings} from NGFW {ngfirewallname}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-managengfw-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-managengfw-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-managengfw-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact: {}
  description: Add and modify the user IAM rules and permission policies required to expand or reduce their access and permissions.
  title: Manage Cloud NGFW Manage NGFW API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:
- name: ManageNGFW
paths:
  /v1/config/ngfirewalls:
    get:
      description: Retrieve all firewalls in the Global Firewall Admin (FMS) account along with their associated firewall policy metadata.
      operationId: get-v1-config-ngfirewalls
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListFWResourceResponse'
          description: OK
      summary: List firewall resources
      tags:
      - ManageNGFW
    post:
      description: Create an AWS Network Firewall by specifying firewall policy, subnets in your VPC, and associated tags.
      operationId: post-v1-config-ngfirewalls
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateFWResourceResponse'
          description: OK
      summary: Create firewall resource
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}:
    delete:
      description: Delete the specified NGFW. Verify the NGFW is not in use by reviewing route tables for Availability Zones where NGFW subnet mappings exist. Update route tables to remove NGFW endpoints before deletion.
      operationId: delete-v1-config-ngfirewalls-ngfirewallname
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteFWResourceResponse'
          description: OK
      summary: Delete firewall resource
      tags:
      - ManageNGFW
    get:
      description: Retrieve the configuration data for a specific NGFW resource.
      operationId: get-v1-config-ngfirewalls-ngfirewallname
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReadFWResourceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadFWResourceResponse'
          description: OK
      summary: Retrieve firewall resource
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}/description:
    put:
      description: Modify the description of a specific NGFW to help identify the firewall during management operations.
      operationId: put-v1-config-ngfirewalls-ngfirewallname-description
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFWResourceDescriptionRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse'
          description: OK
      summary: Update firewall description
      tags:
      - ManageNGFW
  /v1/config/ngfirewalls/{ngfirewallname}/subnets:
    put:
      description: Update the subnet IDs associated with an NGFW.
      operationId: put-v1-config-ngfirewalls-ngfirewallname-subnets
      parameters:
      - description: 'The name of the NGFW.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse'
          description: OK
      summary: Update subnet mappings
      tags:
      - ManageNGFW
components:
  schemas:
    ListFWResourceResponse.ResponseData:
      properties:
        Firewalls:
          items:
            $ref: '#/components/schemas/ListFWResourceResponse.FirewallInfo'
          title: Firewalls
          type: array
        NextToken:
          title: Nexttoken
          type: string
      title: ResponseData
      type: object
    UpdateFWResourceSubnetsResponse.ResponseData:
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        UpdateToken:
          title: Updatetoken
          type: string
      title: ResponseData
      type: object
    CreateFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ListFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/ListFWResourceResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/ListFWResourceResponse.Result'
      title: ListFWResourceResponse
      type: object
    CreateFWResourceRequest.SubnetMappingsType:
      additionalProperties: false
      properties:
        AvailabilityZone:
          title: Availabilityzone
          type: string
        SubnetId:
          title: Subnetid
          type: string
      title: SubnetMappingsType
      type: object
    CreateFWResourceResponse.FirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: FirewallResource
      type: object
    DeleteFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/DeleteFWResourceResponse.FirewallResource'
        ResponseStatus:
          $ref: '#/components/schemas/DeleteFWResourceResponse.Result'
      title: DeleteFWResourceResponse
      type: object
    ListFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    CreateFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          maxLength: 512
          pattern: ^.*$
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            $ref: '#/components/schemas/CreateFWResourceRequest.SubnetMappingsType'
          title: Subnetmappings
          type: array
        Tags:
          items:
            $ref: '#/components/schemas/CreateFWResourceRequest.TagEntry'
          maxItems: 50
          title: Tags
          type: array
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: CreateFWResourceRequest
      type: object
    CreateFWResourceRequest.TagEntry:
      additionalProperties: false
      properties:
        Key:
          title: Key
          type: string
        Value:
          title: Value
          type: string
      required:
      - Key
      - Value
      title: TagEntry
      type: object
    UpdateFWResourceDescriptionResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          title: Description
          type: string
        FirewallName:
          title: Firewallname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      title: ResponseData
      type: object
    DeleteFWResourceResponse.FirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: FirewallResource
      type: object
    ReadFWResourceResponse.ResourceAttachment:
      properties:
        EndpointId:
          title: Endpointid
          type: string
        RejectedReason:
          title: Rejectedreason
          type: string
        Status:
          enum:
          - ACCEPTED
          - PENDING
          - REJECTED
          title: Status
          type: string
        SubnetId:
          title: Subnetid
          type: string
      required:
      - EndpointId
      - Status
      title: ResourceAttachment
      type: object
    UpdateFWResourceDescriptionRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        Description:
          maxLength: 512
          pattern: ^.*$
          title: Description
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      required:
      - Description
      title: UpdateFWResourceDescriptionRequest
      type: object
    ReadFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/ReadFWResourceResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/ReadFWResourceResponse.Result'
      title: ReadFWResourceResponse
      type: object
    ReadFWResourceResponse.ResponseData:
      properties:
        Firewall:
          $ref: '#/components/schemas/ReadFWResourceResponse.ReadFirewallResource'
        Status:
          $ref: '#/components/schemas/ReadFWResourceResponse.ResourceStatus'
      title: ResponseData
      type: object
    ReadFWResourceResponse.ResourceStatus:
      properties:
        Attachments:
          items:
            $ref: '#/components/schemas/ReadFWResourceResponse.ResourceAttachment'
          title: Attachments
          type: array
        FailureReason:
          title: Failurereason
          type: string
        FirewallStatus:
          enum:
          - CREATING
          - UPDATING
          - DELETING
          - CREATE_COMPLETE
          - UPDATE_COMPLETE
          - CREATE_FAIL
          - UPDATE_FAIL
          - DELETE_FAIL
          title: Firewallstatus
          type: string
        RuleStackStatus:
          title: Rulestackstatus
          type: string
      required:
      - Attachments
      - FirewallStatus
      title: ResourceStatus
      type: object
    UpdateFWResourceSubnetsResponse:
      properties:
        Response:
          $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/UpdateFWResourceSubnetsResponse.Result'
      title: UpdateFWResourceSubnetsResponse
      type: object
    UpdateFWResourceDescriptionResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    DeleteFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
      title: DeleteFWResourceRequest
      type: object
    DeleteFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    UpdateFWResourceSubnetsResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ListFWResourceResponse.FirewallInfo:
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
      required:
      - FirewallName
      title: FirewallInfo
      type: object
    UpdateFWResourceSubnetsRequest.SubnetMappingsType:
      additionalProperties: false
      properties:
        AvailabilityZone:
          title: Availabilityzone
          type: string
        SubnetId:
          title: Subnetid
          type: string
      title: SubnetMappingsType
      type: object
    CreateFWResourceResponse:
      properties:
        Response:
          $ref: '#/components/schemas/CreateFWResourceResponse.FirewallResource'
        ResponseStatus:
          $ref: '#/components/schemas/CreateFWResourceResponse.Result'
      title: CreateFWResourceResponse
      type: object
    ReadFWResourceRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
      title: ReadFWResourceRequest
      type: object
    UpdateFWResourceSubnetsRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        AssociateSubnetMappings:
          items:
            $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest.SubnetMappingsType'
          title: Associatesubnetmappings
          type: array
        DisassociateSubnetMappings:
          items:
            $ref: '#/components/schemas/UpdateFWResourceSubnetsRequest.SubnetMappingsType'
          title: Disassociatesubnetmappings
          type: array
        UpdateToken:
          title: Updatetoken
          type: string
      title: UpdateFWResourceSubnetsRequest
      type: object
    ReadFWResourceResponse.ReadFirewallResource:
      properties:
        AccountId:
          title: Accountid
          type: string
        AppIdVersion:
          maxLength: 64
          minLength: 1
          pattern: ^[0-9]+-[0-9]+$
          title: Appidversion
          type: string
        AutomaticUpgradeAppIdVersion:
          default: true
          title: Automaticupgradeappidversion
          type: boolean
        Description:
          title: Description
          type: string
        EndpointMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Endpointmode
          type: string
        EndpointServiceName:
          default: Creating
          title: Endpointservicename
          type: string
        FirewallName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Firewallname
          type: string
        GlobalRuleStackName:
          title: Globalrulestackname
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        SubnetMappings:
          items:
            type: object
          title: Subnetmappings
          type: array
        Tags:
          items:
            type: object
          title: Tags
          type: array
        UpdateToken:
          default: '1'
          title: Updatetoken
          type: string
        VpcId:
          title: Vpcid
          type: string
      required:
      - EndpointMode
      - FirewallName
      - SubnetMappings
      - VpcId
      title: ReadFirewallResource
      type: object
    ListFWResourceRequest:
      additionalProperties: false
      properties:
        MaxResults:
          default: 1024
          maximum: 1024
          minimum: 1
          title: Maxresults
          type: integer
        NextToken:
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
        RuleStackName:
          title: Rulestackname
          type: string
        VpcIds:
          items:
            type: string
          title: Vpcids
          type: array
      title: ListFWResourceRequest
      type: object
    UpdateFWResourceDescriptionResponse:
      properties:
        Response:
          $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/UpdateFWResourceDescriptionResponse.Result'
      title: UpdateFWResourceDescriptionResponse
      type: object
    ReadFWResourceResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object