Palo Alto Networks Onboarding Rules API

openapi: 3.2.0
info:
  version: 2.0.0
  title: Device Onboarding Onboarding Rules API
  description: These APIs are used to define Strata Cloud Manager device onboarding workflows.
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/setup/device-onboarding/v1
  description: Current
security:
- scmToken: []
tags:
- name: Onboarding Rules
  description: Onboarding rules information
paths:
  /onboarding-rules:
    post:
      tags:
      - Onboarding Rules
      summary: Create an onboarding rule
      description: 'Creates a new onboarding rule with match criteria, actions, and variable resolution.

        '
      operationId: createOnboardingRule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/create_onboarding_rule_request'
      responses:
        '201':
          description: Onboarding rule created successfully
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  data:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Onboarding rule ID
                      name:
                        type: string
                        description: Onboarding rule name
                  message:
                    type: string
                    description: Human-readable message
                  request_id:
                    type: string
                    format: uuid
                    description: Unique request identifier for troubleshooting
        '400':
          $ref: '#/components/responses/BadRequest'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
    get:
      tags:
      - Onboarding Rules
      summary: List onboarding rules
      description: 'Retrieves all onboarding rules ordered by priority.

        '
      operationId: listOnboardingRules
      responses:
        '200':
          description: Onboarding rules retrieved successfully
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/resolved_onboarding_rule'
                    description: Array of onboarding rules ordered by priority
                  message:
                    type: string
                    description: Human-readable message
                  metadata:
                    type: object
                    properties:
                      types_mapping:
                        type: object
                        description: Mapping of config service types to site manager types
                    description: Additional response metadata
                  request_id:
                    type: string
                    format: uuid
                    description: Unique request identifier for troubleshooting
        '500':
          $ref: '#/components/responses/InternalServerError'
  /onboarding-rules/{id}:move:
    post:
      tags:
      - Onboarding Rules
      summary: Move an onboarding rule
      description: 'Changes the priority order of an onboarding rule. The rule can be moved to top, bottom,

        or before/after another rule.

        '
      operationId: moveOnboardingRuleByID
      parameters:
      - $ref: '#/components/parameters/onboarding_rule_id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/move_onboarding_rule_request'
      responses:
        '200':
          description: Rule moved successfully
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                - message
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  message:
                    type: string
                    description: Human-readable message
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /onboarding-rules/{id}:
    get:
      tags:
      - Onboarding Rules
      summary: Get an onboarding rule
      description: Retrieves an onboarding rule by UUID
      operationId: getOnboardingRuleByID
      parameters:
      - $ref: '#/components/parameters/onboarding_rule_id'
      responses:
        '200':
          description: Onboarding rule retrieved successfully
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  data:
                    $ref: '#/components/schemas/resolved_onboarding_rule'
                    description: Onboarding rule with resolved variables
                  message:
                    type: string
                    description: Human-readable message
                  metadata:
                    type: object
                    description: Additional response metadata
                  request_id:
                    type: string
                    format: uuid
                    description: Unique request identifier for troubleshooting
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
    put:
      tags:
      - Onboarding Rules
      summary: Update an onboarding rule
      description: Updates an existing onboarding rule
      operationId: updateOnboardingRuleByID
      parameters:
      - $ref: '#/components/parameters/onboarding_rule_id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/update_onboarding_rule_request'
      responses:
        '200':
          description: Onboarding rule updated successfully
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  data:
                    $ref: '#/components/schemas/onboard_rule_entry'
                    description: Updated onboarding rule
                  message:
                    type: string
                    description: Human-readable message
                  request_id:
                    type: string
                    format: uuid
                    description: Unique request identifier for troubleshooting
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
    delete:
      tags:
      - Onboarding Rules
      summary: Delete an onboarding rule
      description: Deletes an onboarding rule by ID
      operationId: deleteOnboardingRuleByID
      parameters:
      - $ref: '#/components/parameters/onboarding_rule_id'
      responses:
        '200':
          description: Onboarding rule deleted successfully - returns deleted resource
          content:
            application/json:
              schema:
                type: object
                required:
                - status
                properties:
                  status:
                    type: string
                    enum:
                    - success
                    description: Response status indicator
                  data:
                    $ref: '#/components/schemas/onboard_rule_entry'
                    description: Deleted onboarding rule
                  message:
                    type: string
                    description: Human-readable message
                  request_id:
                    type: string
                    format: uuid
                    description: Unique request identifier for troubleshooting
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  schemas:
    resolved_variable:
      type: object
      required:
      - name
      - type
      - value
      properties:
        name:
          type: string
          description: Variable name
        type:
          type: string
          description: Variable type
        value:
          description: Resolved value (type varies)
    resource_validation_result:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: Resource UUID
        name:
          type: string
          description: Resource name
        validation_errors:
          type: array
          items:
            $ref: '#/components/schemas/resource_validation_error'
    resolved_onboarding_rule:
      type: object
      properties:
        id:
          type: string
          format: uuid
        tenant_id:
          type: string
        name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
        rule_type:
          type: string
        site_group:
          type: string
        match_criteria:
          type: object
          additionalProperties: true
        actions:
          type: object
          additionalProperties: true
        variables:
          type: array
          items:
            $ref: '#/components/schemas/variable'
          description: Original variables with resolution expression
        resolved_variables:
          type: array
          items:
            $ref: '#/components/schemas/resolved_variable'
          description: Variables resolved to their actual values
        resolution_errors:
          type: array
          items:
            type: string
          description: Errors encountered during variable resolution
        generated_at:
          type: string
    device_model:
      type: object
      properties:
        name:
          type: string
          description: Device model name
    model_criteria:
      type: object
      properties:
        include_models:
          type: array
          items:
            $ref: '#/components/schemas/device_model'
        exclude_models:
          type: array
          items:
            $ref: '#/components/schemas/device_model'
    onboard_match_criteria:
      type: object
      properties:
        models:
          $ref: '#/components/schemas/model_criteria'
    create_onboarding_rule_request:
      type: object
      required:
      - name
      - enable
      - rule_type
      - site_group
      - match_criteria
      - actions
      properties:
        name:
          type: string
        description:
          type: string
        enable:
          type: boolean
        rule_type:
          type: string
        site_group:
          type: string
        match_criteria:
          $ref: '#/components/schemas/onboard_match_criteria'
        actions:
          $ref: '#/components/schemas/onboard_actions'
        variables:
          type: array
          items:
            $ref: '#/components/schemas/variable'
    update_onboarding_rule_request:
      type: object
      required:
      - name
      - enable
      - rule_type
      - site_group
      - match_criteria
      - actions
      properties:
        id:
          type: string
          format: uuid
        tenant_id:
          type: string
        name:
          type: string
        description:
          type: string
        enable:
          type: boolean
        rule_type:
          type: string
        site_group:
          type: string
        match_criteria:
          $ref: '#/components/schemas/onboard_match_criteria'
        actions:
          $ref: '#/components/schemas/onboard_actions'
        variables:
          type: array
          items:
            $ref: '#/components/schemas/variable'
    variable:
      type: object
      required:
      - name
      - resolution_rule
      properties:
        name:
          type: string
          description: Variable name
        resolution_rule:
          $ref: '#/components/schemas/resolution_rule'
    resolution_rule:
      type: object
      required:
      - expression
      properties:
        expression:
          type: string
          description: Expression to resolve the variable (can reference properties with ${property_name})
    onboard_rule_entry:
      type: object
      required:
      - id
      - name
      - enable
      - rule_type
      - site_group
      properties:
        id:
          type: string
          format: uuid
        tenant_id:
          type: string
        name:
          type: string
        description:
          type: string
        enable:
          type: boolean
        rule_type:
          type: string
          description: Rule type (e.g., "site")
        site_group:
          type: string
        rule_order:
          type: integer
          description: Rule priority (lower number = higher priority)
        match_criteria:
          $ref: '#/components/schemas/onboard_match_criteria'
        actions:
          $ref: '#/components/schemas/onboard_actions'
        variables:
          type: array
          items:
            $ref: '#/components/schemas/variable'
        created_at:
          type: string
          format: date-time
        last_updated:
          type: string
          format: date-time
    onboard_actions:
      type: object
      additionalProperties: true
      description: Actions to perform during onboarding
    move_onboarding_rule_request:
      type: object
      required:
      - position
      properties:
        position:
          type: string
          enum:
          - before
          - after
          - top
          - bottom
          description: Position to move the rule to
        reference:
          type: string
          format: uuid
          description: UUID of reference rule (required for before/after positions)
    resource_validation_error:
      type: object
      required:
      - type
      - resource_id
      - resource_name
      - message
      properties:
        type:
          type: string
          enum:
          - site
          - rule
          - name_conflict
          description: Type of validation error
        resource_id:
          type: string
          description: ID of the affected resource
        resource_name:
          type: string
          description: Name of the affected resource
        message:
          type: string
          description: Detailed error message
  parameters:
    onboarding_rule_id:
      name: id
      in: path
      required: true
      description: Onboarding Rule UUID
      schema:
        type: string
        format: uuid
  responses:
    BadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            - error
            properties:
              status:
                type: string
                enum:
                - error
              data:
                type: array
                items:
                  $ref: '#/components/schemas/resource_validation_result'
              error:
                type: string
                description: Error message
    NotFound:
      description: Not Found
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            - error
            properties:
              status:
                type: string
                enum:
                - error
              error:
                type: string
                description: Error message
    InternalServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            - error
            properties:
              status:
                type: string
                enum:
                - error
              error:
                type: string
                description: Error message
    Conflict:
      description: Conflict
      content:
        application/json:
          schema:
            type: object
            required:
            - status
            - error
            properties:
              status:
                type: string
                enum:
                - error
              data:
                type: array
                items:
                  $ref: '#/components/schemas/resource_validation_result'
              error:
                type: string
                description: Error message
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow.  Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID.  The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n"
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow.  Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID.  The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n"
      scheme: bearer
      bearerFormat: JWT
x-internal: false