Palo Alto Networks NAT Rules API
NAT policy rule management.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-natrules-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks NAT Rules API
version: '1.0'
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
description: 'Operations tagged NATRules across 2 of this provider''s published API definitions: palo-alto-networks-natrules-api-openapi.yml, palo-alto-strata-cloud-manager-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://api.strata.paloaltonetworks.com
description: Strata Cloud Manager API production endpoint.
tags:
- name: NATRules
description: NAT policy rule management.
paths:
/sse/config/v1/nat-rules:
get:
operationId: listNatRules
summary: Palo Alto Networks List NAT Rules
description: Returns a paginated list of NAT rules in the specified scope. NAT rules define source and destination address translation policies.
tags:
- NATRules
parameters:
- $ref: '#/components/parameters/folder'
- $ref: '#/components/parameters/snippet'
- $ref: '#/components/parameters/device'
- $ref: '#/components/parameters/position'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- name: name
in: query
description: Filter by NAT rule name.
schema:
type: string
example: Primary Sensor 79
responses:
'200':
description: NAT rules returned successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/NatRuleList'
examples:
ListNatRules200Example:
summary: Default listNatRules 200 response
x-microcks-default: true
value:
data:
- id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
name: Primary Sensor 71
folder: example-folder
position: post
from:
- example-from_item
to:
- example-to_item
source:
- example-source_item
destination:
- example-destination_item
service: example-service
source_translation:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: false
destination_translation:
translated_address: example-translated_address
translated_port: 475
nat_type: nptv6
disabled: false
description: Detected firewall applied network alert violation suspicious investigation.
tag:
- critical-asset
offset: 459
total: 479
limit: 624
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
post:
operationId: createNatRule
summary: Palo Alto Networks Create NAT Rule
description: Creates a new NAT rule in the specified folder or snippet.
tags:
- NATRules
parameters:
- $ref: '#/components/parameters/folder'
- $ref: '#/components/parameters/snippet'
- $ref: '#/components/parameters/device'
- $ref: '#/components/parameters/position'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/NatRuleRequest'
examples:
CreateNatRuleRequestExample:
summary: Default createNatRule request
x-microcks-default: true
value:
name: Production Agent 98
from:
- example-from_item
to:
- example-to_item
- example-to_item
source:
- example-source_item
- example-source_item
destination:
- example-destination_item
- example-destination_item
service: example-service
source_translation:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: true
destination_translation:
translated_address: example-translated_address
translated_port: 210
disabled: false
description: Activity violation Security firewall applied violation investigation suspicious blocked activity.
tag:
- pci-scope
responses:
'201':
description: NAT rule created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/NatRule'
examples:
CreateNatRule201Example:
summary: Default createNatRule 201 response
x-microcks-default: true
value:
id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
name: Primary Sensor 71
folder: example-folder
position: post
from:
- example-from_item
to:
- example-to_item
source:
- example-source_item
destination:
- example-destination_item
service: example-service
source_translation:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: false
destination_translation:
translated_address: example-translated_address
translated_port: 475
nat_type: nptv6
disabled: false
description: Detected firewall applied network alert violation suspicious investigation.
tag:
- critical-asset
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'409':
$ref: '#/components/responses/Conflict'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- oauth2Bearer: []
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
components:
responses:
Forbidden:
description: Insufficient permissions for the requested operation.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
BadRequest:
description: Malformed request or invalid parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Missing or invalid authentication token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Conflict:
description: A resource with the specified name already exists or the resource cannot be modified due to existing references.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
parameters:
device:
name: device
in: query
description: Device name for device-scoped configuration.
schema:
type: string
position:
name: position
in: query
description: Rulebase position filter.
schema:
type: string
enum:
- pre
- post
limit:
name: limit
in: query
description: Maximum number of results per page.
schema:
type: integer
default: 200
maximum: 5000
folder:
name: folder
in: query
description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections).
schema:
type: string
snippet:
name: snippet
in: query
description: Configuration snippet name.
schema:
type: string
offset:
name: offset
in: query
description: Pagination offset (number of records to skip).
schema:
type: integer
default: 0
schemas:
NatRuleList:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/NatRule'
example:
- id: c0e38509-af62-4dd8-98d7-f4b3d68d793e
name: Primary Sensor 71
folder: example-folder
position: post
from:
- example-from_item
to:
- example-to_item
source:
- example-source_item
destination:
- example-destination_item
service: example-service
source_translation:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: false
destination_translation:
translated_address: example-translated_address
translated_port: 475
nat_type: nptv6
disabled: false
description: Detected firewall applied network alert violation suspicious investigation.
tag:
- critical-asset
offset:
type: integer
example: 459
total:
type: integer
example: 479
limit:
type: integer
example: 624
NatRule:
type: object
description: A NAT policy rule defining source or destination address translation for matching traffic flows.
properties:
id:
type: string
format: uuid
readOnly: true
example: c0e38509-af62-4dd8-98d7-f4b3d68d793e
name:
type: string
example: Primary Sensor 71
folder:
type: string
readOnly: true
example: example-folder
position:
type: string
enum:
- pre
- post
example: post
from:
type: array
items:
type: string
description: Source zones.
example:
- example-from_item
to:
type: array
items:
type: string
description: Destination zones.
example:
- example-to_item
source:
type: array
items:
type: string
example:
- example-source_item
destination:
type: array
items:
type: string
example:
- example-destination_item
service:
type: string
description: Service object name or any.
example: example-service
source_translation:
type: object
properties:
dynamic_ip_and_port:
type: object
properties:
translated_address:
type: array
items:
type: string
example:
- example-translated_address_item
example:
translated_address:
- example-translated_address_item
- example-translated_address_item
static_ip:
type: object
properties:
translated_address:
type: string
example: example-translated_address
bi_directional:
type: boolean
example: true
example:
translated_address: example-translated_address
bi_directional: false
example:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: false
destination_translation:
type: object
properties:
translated_address:
type: string
example: example-translated_address
translated_port:
type: integer
example: 447
example:
translated_address: example-translated_address
translated_port: 475
nat_type:
type: string
enum:
- ipv4
- nat64
- nptv6
example: nptv6
disabled:
type: boolean
default: false
example: false
description:
type: string
example: Detected firewall applied network alert violation suspicious investigation.
tag:
type: array
items:
type: string
example:
- critical-asset
ErrorResponse:
type: object
properties:
_errors:
type: array
items:
type: object
properties:
code:
type: string
example: example-code
message:
type: string
example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity.
details:
type: object
example: {}
example:
- code: example-code
message: Security monitoring rule configured endpoint on network blocked.
details: {}
- code: example-code
message: Security on on threat monitoring activity policy.
details: {}
_request_id:
type: string
description: Unique request identifier for troubleshooting.
example: '574499'
NatRuleRequest:
type: object
required:
- name
properties:
name:
type: string
example: Production Agent 98
from:
type: array
items:
type: string
example:
- example-from_item
to:
type: array
items:
type: string
example:
- example-to_item
- example-to_item
source:
type: array
items:
type: string
example:
- example-source_item
- example-source_item
destination:
type: array
items:
type: string
example:
- example-destination_item
- example-destination_item
service:
type: string
example: example-service
source_translation:
type: object
properties:
dynamic_ip_and_port:
type: object
properties:
translated_address:
type: array
items:
type: string
example:
- example-translated_address_item
- example-translated_address_item
example:
translated_address:
- example-translated_address_item
- example-translated_address_item
static_ip:
type: object
properties:
translated_address:
type: string
example: example-translated_address
bi_directional:
type: boolean
example: false
example:
translated_address: example-translated_address
bi_directional: false
example:
dynamic_ip_and_port:
translated_address:
- example-translated_address_item
- example-translated_address_item
static_ip:
translated_address: example-translated_address
bi_directional: true
destination_translation:
type: object
properties:
translated_address:
type: string
example: example-translated_address
translated_port:
type: integer
example: 897
example:
translated_address: example-translated_address
translated_port: 210
disabled:
type: boolean
example: false
description:
type: string
example: Activity violation Security firewall applied violation investigation suspicious blocked activity.
tag:
type: array
items:
type: string
example:
- pci-scope
securitySchemes:
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 access token obtained from https://auth.apps.paloaltonetworks.com/oauth2/access_token using a client credentials grant. Generate a service account and client credentials from the Strata Cloud Manager identity settings. Tokens expire and must be refreshed periodically.
x-refined-from:
- palo-alto-networks-natrules-api-openapi.yml
- palo-alto-strata-cloud-manager-api-openapi-original.yml