Palo Alto Networks Monitored Users API API
Endpoint to retrieve the device count histogram with possible filters.
OpenAPI Specification
openapi: 3.2.0
info:
contact:
email: support@paloaltonetworks.com
description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.
The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of
your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access
customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group
(TSG) identifier.
These APIs use the common SASE authentication mechanism and base URL. See the
[Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.
This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see
[Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).
© 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at
[https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)
All other marks mentioned herein may be trademarks of their respective companies.
'
license:
name: MIT
url: https://opensource.org/license/mit
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
title: Palo Alto Networks 3.0 Monitored Users API API
version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: 'Endpoint to retrieve the device count histogram with possible filters.
'
name: Monitored Users API
paths:
/insights/v3.0/resource/query/user/monitored/user_count:
post:
description: 'Retrieve the number of monitored users, with options for applying filters.
'
operationId: post-insights-v3.0-resource-query-user-monitored-user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: user_connection_method
values:
- monitored
- operator: in
property: device_connection_method
values:
- monitored
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name
values:
- DHCP
- operator: in
property: client_agent_version
values:
- 10.2.3
- operator: in
property: client_os_version
values:
- Windows 10
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- USA
- operator: in
property: client_public_address
values:
- 1.1.1.1
- operator: in
property: usergroups
values:
- admins
- operator: in
property: edge_location_display_name
values:
- US West
- operator: gt
property: experience_score
values:
- 70
- operator: gt
property: device_score
values:
- 80
- operator: gt
property: lan_score
values:
- 60
- operator: gt
property: wifi_score
values:
- 70
- operator: gt
property: pa_score
values:
- 80
- operator: gt
property: internet_score
values:
- 50
- operator: eq
property: device_self_serve_status
values:
- true
- operator: in
property: device_isp_name
values:
- Verizon
- operator: in
property: instance_name
values:
- PA-VM
- operator: in
property: project_name
values:
- Project Alpha
- operator: in
property: location_group_name
values:
- HQ
- operator: in
property: domain_name
values:
- example.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
client_agent_version:
description: Version of the client agent.
example: 10.2.3
type: string
client_os_version:
description: Version of the client OS.
example: Windows 10
type: string
client_public_address:
description: Public IP address of the client.
example: 1.1.1.1
type: string
device_connection_method:
description: Device connection method.
example: monitored
type: string
device_isp_name:
description: Name of the ISP.
example: Verizon
type: string
device_name_source:
description: Source of the device name.
example: DHCP
type: string
device_score:
description: Device score.
example: 90
type: number
device_self_serve_status:
description: Indicates if self-serve user is enabled.
example: true
type: boolean
domain_name:
description: Name of the application domain.
example: example.com
type: string
edge_location_display_name:
description: Prisma Access location name.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: Experience score.
example: 80
type: number
instance_name:
description: Name of the firewall.
example: PA-VM
type: string
internet_score:
description: Internet score.
example: 70
type: number
lan_score:
description: LAN score.
example: 75
type: number
location_group_name:
description: Name of the location group.
example: HQ
type: string
pa_score:
description: Prisma Access score.
example: 95
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
project_name:
description: Name of the project.
example: Project Alpha
type: string
source_city:
description: Name of the source city.
example: San Jose
type: string
source_country:
description: Name of the source country.
example: USA
type: string
user_connection_method:
description: User connection method.
example: monitored
type: string
usergroups:
description: User groups.
example: admins
type: string
username:
description: Username.
example: john.doe
type: string
wifi_score:
description: WiFi score.
example: 85
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of users.
example: 100
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Monitored User Data
tags:
- Monitored Users API
/insights/v3.0/resource/query/user/monitored/user_count_histogram:
post:
description: 'Retrieve a histogram of monitored user data.
'
operationId: post-insights-v3.0-resource-query-user-monitored-user_count_histogram
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
histogram:
enableEmptyInterval: true
property: event_time
range: minute
value: 30
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: user_connection_method
values:
- monitored
- operator: in
property: device_connection_method
values:
- monitored
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name
values:
- DHCP
- operator: in
property: client_agent_version
values:
- 1.0.0
- operator: in
property: client_os_version
values:
- Windows 10
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- USA
- operator: in
property: user_source_ip_address
values:
- 203.0.113.45
- operator: in
property: usergroups
values:
- admins
- operator: in
property: edge_location_display_name
values:
- US West
- operator: gt
property: experience_score
values:
- 70
- operator: gt
property: device_score
values:
- 70
- operator: gt
property: lan_score
values:
- 70
- operator: gt
property: wifi_score
values:
- 70
- operator: gt
property: pa_score
values:
- 70
- operator: gt
property: internet_score
values:
- 70
- operator: eq
property: device_self_serve_status
values:
- true
- operator: in
property: device_isp_name
values:
- Comcast
- operator: in
property: instance_name
values:
- PA-VM
- operator: in
property: project_name
values:
- Project Alpha
- operator: in
property: location_group_name
values:
- US Locations
- operator: in
property: domain_name
values:
- example.com
histogram:
enableEmptyInterval: true
property: event_time
range: minute
value: 30
schema:
properties:
filter:
properties:
rules:
items:
properties:
client_agent_version:
description: Version of the client agent.
example: 1.0.0
type: string
client_os_version:
description: Version of the client OS.
example: Windows 10
type: string
device_connection_method:
description: Device connection method.
example: monitored
type: string
device_isp_name:
description: Name of the ISP.
example: Comcast
type: string
device_name:
description: Source of the device name.
example: DHCP
type: string
device_score:
description: Device score.
example: 85
type: number
device_self_serve_status:
description: Indicates if self-serve user is enabled.
example: true
type: boolean
domain_name:
description: Name of the application domain.
example: example.com
type: string
edge_location_display_name:
description: Prisma Access location name.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: User experience score.
example: 90
type: number
instance_name:
description: Name of the firewall.
example: PA-VM
type: string
internet_score:
description: Internet score.
example: 70
type: number
lan_score:
description: LAN score.
example: 95
type: number
location_group_name:
description: Name of the location group.
example: US Locations
type: string
pa_score:
description: Prisma Access score.
example: 75
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
project_name:
description: Name of the project.
example: Project Alpha
type: string
source_city:
description: Name of the source city.
example: San Jose
type: string
source_country:
description: Name of the source country.
example: USA
type: string
user_connection_method:
description: User connection method.
example: monitored
type: string
user_source_ip_address:
description: Public address of the client.
example: 203.0.113.45
type: string
usergroups:
description: User groups.
example: admins
type: string
username:
description: Username.
example: john.doe
type: string
wifi_score:
description: WiFi score.
example: 80
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
event_time:
description: Event time
example: 1709226000000
type: number
user_count:
description: Count of users
example: 10
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Monitored User Histogram Data
tags:
- Monitored Users API
/insights/v3.0/resource/query/users/monitored/device_count:
post:
description: 'Retrieve the number of monitored devices, with options for applying filters.
'
operationId: post-insights-v3.0-resource-query-users-monitored-device_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: user_connection_method
values:
- monitored
- operator: in
property: device_connection_method
values:
- monitored
- operator: in
property: username
values:
- john.doe
- operator: in
property: device_name
values:
- DHCP
- operator: in
property: client_agent_version
values:
- 1.0.0
- operator: in
property: client_os_version
values:
- Windows 10
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: source_country
values:
- USA
- operator: in
property: user_source_ip_address
values:
- 192.0.2.1
- operator: in
property: usergroups
values:
- admins
- operator: in
property: edge_location_display_name
values:
- US West
- operator: gt
property: experience_score
values:
- 70
- operator: gt
property: device_score
values:
- 65
- operator: gt
property: lan_score
values:
- 80
- operator: gt
property: wifi_score
values:
- 75
- operator: gt
property: pa_score
values:
- 90
- operator: gt
property: internet_score
values:
- 60
- operator: eq
property: device_self_serve_status
values:
- true
- operator: in
property: device_isp_name
values:
- Comcast
- operator: in
property: instance_name
values:
- fw00
- operator: in
property: project_name
values:
- ProjectA
- operator: in
property: location_group_name
values:
- LocationGroup1
- operator: in
property: domain_name
values:
- example.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
client_agent_version:
description: Version of the client agent.
example: 1.0.0
type: string
client_os_version:
description: Version of the client OS.
example: Windows 10
type: string
device_connection_method:
description: Device connection method.
example: monitored
type: string
device_isp_name:
description: Name of the ISP.
example: Comcast
type: string
device_name:
description: Source of the device name.
example: DHCP
type: string
device_score:
description: Device score.
example: 75
type: number
device_self_serve_status:
description: Indicates if self-serve user is enabled.
example: true
type: boolean
domain_name:
description: Application domain name.
example: example.com
type: string
edge_location_display_name:
description: Prisma Access location name.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: Experience score.
example: 80
type: number
instance_name:
description: Firewall name.
example: fw00
type: string
internet_score:
description: Internet score.
example: 70
type: number
lan_score:
description: LAN score.
example: 90
type: number
location_group_name:
description: Location group name.
example: LocationGroup1
type: string
pa_score:
description: PA score.
example: 95
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
project_name:
description: Project name.
example: ProjectA
type: string
source_city:
description: Name of the source city.
example: San Jose
type: string
source_country:
description: Name of the source country.
example: USA
type: string
user_connection_method:
# --- truncated at 32 KB (55 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-monitored-users-api-api-openapi.yml