Palo Alto Networks

Palo Alto Networks Manage NGFW V2 API

The ManageNGFW-V2 API from Palo Alto Networks — 15 operation(s) for managengfw-v2.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 28

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

DELETE /v2/linkaccounts Unlink an AWS account from Cloud NGFW · Delete link account #
Ask an LLM
“Can I remove a linked AWS account from Cloud NGFW?”
“What happens when I unlink an account that was onboarded for firewall management?”
Tell an agent destructive · confirm first
Unlink AWS account {account} from Cloud NGFW.
Delete the link account entry for {account}.
GET /v2/linkaccounts List linked AWS accounts for Cloud NGFW · List link accounts #
Ask an LLM
“Which AWS accounts are linked to my Cloud NGFW tenant?”
“Can I page through linked accounts and get full descriptions of each one?”
Tell an agent
List every account linked to my Cloud NGFW tenant.
Show up to {maxresults} linked accounts with full details.
POST /v2/linkaccounts Link an AWS account to Cloud NGFW · Create link account #
Ask an LLM
“How do I onboard a new AWS account into Cloud NGFW?”
“Can I link an account using an AWS Marketplace token and pick its onboarding region?”
Tell an agent
Link AWS account {account} to Cloud NGFW.
Onboard account {account} in {region} using marketplace token {token}.
GET /v2/ngfirewalls List Cloud NGFW firewalls in a region · List V2 firewalls #
Ask an LLM
“Which Cloud NGFW firewalls do I have running in a given AWS region?”
“Can I filter my firewalls to those using a specific rulestack or global rulestack?”
Tell an agent
List all Cloud NGFW firewalls in {region}.
Show firewalls in {region} that use rulestack {rulestack}.
POST /v2/ngfirewalls Create a Cloud NGFW firewall · Create V2 firewall #
Ask an LLM
“How do I deploy a new Cloud NGFW firewall across availability zones?”
“Can I turn on egress NAT and change protection when creating a firewall?”
Tell an agent
Create a Cloud NGFW firewall in {region} covering zones {zones}.
Create a firewall in {region} for zones {zones} using rulestack {rulestack}.
GET /v2/ngfirewalls/ List legacy V1 firewalls via the V2 endpoint · List V1 firewalls #
Ask an LLM
“Can I still list my older V1-style firewalls through the V2 API?”
“What does the v1 route flag do when listing legacy firewalls?”
Tell an agent
List my legacy V1 firewalls in {region} using the v1 route.
Show V1 firewalls in {region} with v1route set to {v1route}.
POST /v2/ngfirewalls/ Create a legacy V1 firewall in a VPC · Create V1 firewall #
Ask an LLM
“What does it take to create a V1-style firewall tied to a VPC and subnet mappings?”
“Which fields are required to create a legacy V1 firewall through the V2 endpoint?”
Tell an agent
Create V1 firewall {name} in VPC {vpc} for account {account}.
Create legacy firewall {name} in {region} with subnet mappings {subnets} and endpoint mode {mode}.
DELETE /v2/ngfirewalls/{firewall_id} Delete a firewall by its ID · Delete firewall by ID #
Ask an LLM
“What is the call to tear down a Cloud NGFW firewall using its firewall ID?”
“Is deleting a firewall by ID permanent?”
Tell an agent destructive · confirm first
Delete firewall {firewall_id} in {region}.
Remove the Cloud NGFW firewall with ID {firewall_id}.
GET /v2/ngfirewalls/{firewall_id} Get a firewall by its ID · Retrieve firewall by ID #
Ask an LLM
“Can I look up a single Cloud NGFW firewall by its firewall ID?”
“What details come back for one firewall when I fetch it by ID?”
Tell an agent
Get firewall {firewall_id} in {region}.
Show the configuration of firewall ID {firewall_id}.
PATCH /v2/ngfirewalls/{firewall_id} Update a firewall's settings by ID · update ngfirewall #
Ask an LLM
“Can I change a firewall's allow-listed accounts, endpoints or egress NAT after it is created?”
“Why does updating a firewall require an update token and deployment update token?”
Tell an agent
Update firewall {firewall_id} to use availability zones {zones}.
Set the GWLB TCP idle timeout on firewall {firewall_id} to {timeout} seconds.
POST /v2/ngfirewalls/{firewall_id}/link Associate a link with a firewall · associate fw link #
Ask an LLM
“Can I attach a link ID to an existing firewall?”
“Can I associate a cross-account link with a firewall I already deployed?”
Tell an agent
Associate link {link} with firewall {firewall_id}.
Attach link {link} to firewall {firewall_id} in {region}.
GET /v2/ngfirewalls/{firewall_id}/logprofile Read a firewall's log profile by ID · read logprofile #
Ask an LLM
“Where is my firewall sending its logs, looked up by firewall ID?”
“Can I see whether CloudWatch metrics and advanced threat logs are on for a firewall ID?”
Tell an agent
Show the log profile for firewall {firewall_id}.
Read the logging configuration of firewall {firewall_id} in {region}.
POST /v2/ngfirewalls/{firewall_id}/logprofile Update a firewall's log profile by ID · update logprofile #
Ask an LLM
“How do I change log destinations for a firewall I reference by ID?”
“Can I enable advanced threat logging on a firewall by its ID?”
Tell an agent
Update the log config of firewall {firewall_id} to {log_config}.
Turn advanced threat logging {setting} on firewall ID {firewall_id}.
DELETE /v2/ngfirewalls/{firewall_id}/rulestack Detach a rulestack from a firewall by ID · disassociate rulestack #
Ask an LLM
“Can I disassociate a rulestack from a firewall by firewall ID?”
“What happens to a firewall's policy when I detach its rulestack?”
Tell an agent destructive · confirm first
Disassociate the rulestack from firewall {firewall_id}.
Detach rulestack {rulestack} from firewall ID {firewall_id}.
POST /v2/ngfirewalls/{firewall_id}/rulestack Attach a rulestack to a firewall by ID · associate rulestack #
Ask an LLM
“How do I associate a rulestack with a firewall using the firewall ID?”
“Can I attach a rulestack owned by another account to my firewall ID?”
Tell an agent
Associate rulestack {rulestack} with firewall {firewall_id}.
Attach rulestack {rulestack} from account {account} to firewall ID {firewall_id}.
DELETE /v2/ngfirewalls/{firewall_name} Delete a firewall by its name · v1 delete firewall #
Ask an LLM
“Is there a way to delete a legacy firewall using its name rather than its ID?”
“Does the V1 route let me remove a firewall by name?”
Tell an agent destructive · confirm first
Delete firewall {firewall_name} in {region} via the v1 route.
Remove a firewall by name in {region} with v1route {v1route}.
GET /v2/ngfirewalls/{firewall_name} Get a firewall by its name · Retrieve firewall by name #
Ask an LLM
“Can I look up a firewall by its name instead of its firewall ID?”
“What does the firewall-by-name lookup return through the V1 route?”
Tell an agent
Get firewall {firewall_name} in {region} using the v1 route.
Look up a named firewall in {region} with v1route {v1route}.
PUT /v2/ngfirewalls/{firewall_name}/contentversion Update a firewall's App-ID content version · Update firewall content version #
Ask an LLM
“How do I upgrade the App-ID content version on a firewall?”
“Can I turn on automatic App-ID content upgrades for a firewall?”
Tell an agent
Set firewall {firewall_name} to App-ID version {version}.
Enable automatic App-ID upgrades on firewall {name}: {auto}.
PUT /v2/ngfirewalls/{firewall_name}/description Change a firewall's description · Update firewall description #
Ask an LLM
“Where do I change the description text on a firewall?”
“Can I update only a firewall's description without touching other settings?”
Tell an agent
Change the description of firewall {firewall_name} to {description}.
Set firewall {name} description to {description} in {region}.
PUT /v2/ngfirewalls/{firewall_name}/features Configure feature flags on a firewall · Configure firewall features #
Ask an LLM
“Which firewall features can I switch on or off by firewall name?”
“How do I configure optional features on an existing firewall?”
Tell an agent
Configure features {features} on firewall {firewall_name}.
Update the feature settings of firewall {name} in {region}.
GET /v2/ngfirewalls/{firewall_name}/logprofile Read a firewall's log profile by name · v1 read logprofile #
Ask an LLM
“Where does a firewall I know by name send its logs?”
“Can I read a legacy firewall's log profile using its account ID and name?”
Tell an agent
Show the log profile for firewall {firewall_name} in account {account}.
Read logging settings of the firewall named {name} in {region}.
POST /v2/ngfirewalls/{firewall_name}/logprofile Update a firewall's log profile by name · v1 update logprofile #
Ask an LLM
“Can I set log destinations for a firewall referenced by name?”
“Can I choose a CloudWatch metric namespace for a legacy firewall's logs?”
Tell an agent
Send logs from firewall {firewall_name} to destinations {destinations}.
Publish metrics for firewall {name} under CloudWatch namespace {namespace}.
POST /v2/ngfirewalls/{firewall_name}/rulestack Attach a rulestack to a firewall by name · v1 associate rulestack #
Ask an LLM
“How do I associate a rulestack with a legacy firewall I know by name?”
“Can the V1 route attach a rulestack to a named firewall?”
Tell an agent
Associate rulestack {rulestack} with the firewall named {firewall_name}.
Attach rulestack {rulestack} to firewall {name} in {region} via the v1 route.
POST /v2/ngfirewalls/{firewall_name}/subnets Change a firewall's subnet mappings · v1 update subnet mappings #
Ask an LLM
“Can I add or remove subnets on a legacy firewall?”
“Can I enable multi-VPC on a firewall while updating its subnet mappings?”
Tell an agent
Associate subnets {subnets} with firewall {firewall_name}.
Disassociate subnets {subnets} from firewall {name}.
DELETE /v2/ngfirewalls/{firewall_name}/tags Remove tags from a firewall · Remove firewall tags #
Ask an LLM
“How do I strip specific tag keys off a firewall?”
“Can I remove tags from a firewall without deleting the firewall itself?”
Tell an agent destructive · confirm first
Remove tag keys {keys} from firewall {firewall_name}.
Untag firewall {name} in {region}, dropping keys {keys}.
GET /v2/ngfirewalls/{firewall_name}/tags List tags on a firewall · Retrieve firewall tags #
Ask an LLM
“What tags are applied to a given firewall?”
“Can I see a named firewall's tags for a specific account?”
Tell an agent
List the tags on firewall {firewall_name}.
Show tags for firewall {name} in account {account}.
POST /v2/ngfirewalls/{firewall_name}/tags Add tags to a firewall · Add firewall tags #
Ask an LLM
“What's the way to tag a firewall for cost tracking or ownership?”
“Can I add several tags to a firewall in one call?”
Tell an agent
Add tags {tags} to firewall {firewall_name}.
Tag firewall {name} in {region} with {tags}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-managengfw-v2-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-managengfw-v2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-managengfw-v2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact: {}
  description: The V2 API provides enhanced operations for managing Cloud NGFW resources.
  title: Manage Cloud NGFW (V2) Manage NGFW V2 API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:


# --- truncated at 32 KB (82 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-managengfw-v2-api-openapi.yml