Palo Alto Networks Objects API
Address objects, address groups, service objects, service groups, and tag management.
Operations 20
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Ask an LLM
“Which IP addresses, subnets and FQDNs are defined as address objects on my firewall?”
“Can I see only the address objects shared across device groups rather than one vsys?”
Tell an agent
List all address objects on the firewall.
Show address objects in virtual system {vsys}.
POST
/Objects/Addresses
Create a firewall address object · Palo Alto Networks Create Address Object
#
Ask an LLM
“How do I define a new IP netmask, IP range or FQDN as a named address object?”
“Does a new address object name have to be unique within its location?”
Tell an agent
Create address object {name} with {entry}.
Add a new address object {name} at {location} defined as {entry}.
PUT
/Objects/Addresses
Replace an address object's definition · Palo Alto Networks Update Address Object
#
Ask an LLM
“How do I change the IP subnet an existing address object points to?”
“Does editing an address object replace its whole definition or just the fields I send?”
Tell an agent
Replace address object {name} with the definition {entry}.
Update address object {name} in vsys {vsys} so it resolves to {entry}.
DELETE
/Objects/Addresses
Delete a firewall address object · Palo Alto Networks Delete Address Object
#
Ask an LLM
“Why can't I remove an address object that a security rule still references?”
“What happens if I delete an address object that belongs to an address group?”
Tell an agent destructive · confirm first
Delete address object {name}.
Remove the address object {name} from vsys {vsys}.
Ask an LLM
“Which address groups are configured on my firewall, static and dynamic?”
“Can I see which address groups exist in a particular vsys or device group?”
Tell an agent
List every address group on the firewall.
Show the address group named {name}.
POST
/Objects/AddressGroups
Create a static or dynamic address group · Palo Alto Networks Create Address Group
#
Ask an LLM
“Can I build an address group that picks up addresses automatically by tag?”
“What is needed to group several address objects into one new static group?”
Tell an agent
Create address group {name} with members {entry}.
Create a dynamic address group {name} in vsys {vsys} using the tag filter {entry}.
PUT
/Objects/AddressGroups
Replace an address group definition · Palo Alto Networks Update Address Group
#
Ask an LLM
“How do I change the members of an existing static address group?”
“Can I rewrite the tag filter on a dynamic address group I already have?”
Tell an agent
Replace address group {name} with the definition {entry}.
Update the members of address group {name} to {entry}.
DELETE
/Objects/AddressGroups
Delete a firewall address group · Palo Alto Networks Delete Address Group
#
Ask an LLM
“Is it possible to remove an address group without deleting the address objects inside it?”
“Which call removes an address group by name from the firewall?”
Tell an agent destructive · confirm first
Delete address group {name}.
Remove address group {name} from location {location}.
Ask an LLM
“Which TCP and UDP port definitions exist as service objects on my firewall?”
“Can I check whether a service object for a given port already exists by name?”
Tell an agent
List all service objects on the firewall.
Show the service object named {name}.
POST
/Objects/Services
Create a TCP or UDP service object · Palo Alto Networks Create Service Object
#
Ask an LLM
“How do I define a custom port or port range as a service for firewall rules?”
“Can a new service object cover a range of destination ports?”
Tell an agent
Create service object {name} for {entry}.
Add a new service {name} at location {location} with protocol and port {entry}.
Ask an LLM
“How do I change the destination port on an existing service object?”
“Can I switch a service object from TCP to UDP after creating it?”
Tell an agent
Update service object {name} to {entry}.
Change the port definition of service {name} in vsys {vsys} to {entry}.
Ask an LLM
“What removes a custom port service object I no longer use?”
“Can I delete a service object from one specific vsys only?”
Tell an agent destructive · confirm first
Delete service object {name}.
Remove service {name} from vsys {vsys}.
Ask an LLM
“Which service groups bundle my port definitions together on the firewall?”
“Can I look up one service group by name to see what it contains?”
Tell an agent
List all service groups.
Show the service group {name}.
Ask an LLM
“Can I bundle several service objects into one group for use in a policy rule?”
“What does it take to create a new service group on the firewall?”
Tell an agent
Create service group {name} with services {entry}.
Create a new service group {name} at {location} containing {entry}.
PUT
/Objects/ServiceGroups
Update a service group's members · Palo Alto Networks Update Service Group
#
Ask an LLM
“How do I add or remove services in an existing service group?”
“Can I edit a service group's membership in place by name?”
Tell an agent
Update service group {name} to contain {entry}.
Replace the members of service group {name} in vsys {vsys} with {entry}.
Ask an LLM
“Which call removes a service group by name?”
“Can I delete a service group but keep the individual service objects?”
Tell an agent destructive · confirm first
Delete service group {name}.
Remove service group {name} from location {location}.
Ask an LLM
“Which tags are defined on my firewall for grouping addresses and rules?”
“Can I list the tags available in a particular vsys?”
Tell an agent
List all tags on the firewall.
Show the tag named {name}.
Ask an LLM
“How do I create a tag with a color so I can drive dynamic address groups from it?”
“Can I add a comment to a new tag when I create it?”
Tell an agent
Create tag {name} with {entry}.
Add a new tag {name} at location {location} with color and comment {entry}.
Ask an LLM
“How do I change the color or comment on an existing firewall tag?”
“Can I edit a tag that is already used by dynamic address groups?”
Tell an agent
Update tag {name} with {entry}.
Change the color and comment of tag {name} in vsys {vsys} to {entry}.
Ask an LLM
“Which call deletes a tag I no longer use on the firewall?”
“Can I remove a tag from one vsys by name?”
Tell an agent destructive · confirm first
Delete tag {name}.
Remove tag {name} from vsys {vsys}.